Trying To Remove S.M.A.R.T Check Virus

[surgame]

At first I was not able to open my default browser Firefox due to the new virus. But I was able to use Internet Explorer to complete the removal instructions. After the last step using rogue killer, I am now able to use Firefox.

I Have been instructed to run Kaspersky and ESET Scanner Online and post the logs. I only have ESET logs, Kaspersky will not open. The ESET logs show 6 javascript Trojans...

I was also asked if I am using an administrator account and I don't think that I am... I have never actually setup an administrator account with a password, only used the built-in one?.. should I go ahead and create one or is it too late?

I have tried to run OTL but it stops responding while checking google chrome. So I uninstalled google chrome but it still stops responding while trying to check google chrome...

So below I have attached only the available logs right now, the aswMBR LOG and the ESET scan log.

Thank you for all your time.

 

[Jack]

Hi and welcome to the MALWARE TIPS forums!

I'm Jack and I am going to try to assist you with your problem. Please take note of the below:

• I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine!
• The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Refrain from running self fixes as this will hinder the malware removal process.
• It may prove beneficial if you print of the following instructions or save them to notepad as I post them.

Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

1.Run a HitmanPro scan
Download <a title="External link" href="http://www.surfright.nl/en/hitmanpro" rel="external">Hitman Pro</a> to your Desktop.  Make sure to download the 32-bit version.

Press the CTRL key and double-click on Hitman Pro.  Hitman Pro will shut down all unnecessary processes when ran this way.

If Hitman Pro wants to update, allow this request.

If Hitman Pro wants to download signatures, allow this request.

If Hitman Pro wants to remove something, allow this request.

Attach any logs produced by Hitman Pro.
<hr />

2.Run a scan with Kaspersky TDSSKiller
<>Read carefully and follow these steps.</>
<ol>
<li>Download <><a title="External link" href="http://support.kaspersky.com/downloads/utils/tdsskiller.exe" rel="external">TDSSKiller</a></> and save it to your Desktop.
</li>
<li>Double-click on <>TDSSKiller.exe</> to run the application.
<img src="http://img4.imageshack.us/img4/1907/tdss1.png" alt="Posted Image" /></li>
<li>Click <>Change parameters</>
<img src="http://img593.imageshack.us/img593/288/tdss2.png" alt="Posted Image" /></li>
<li>Check the boxes next to <>Verify Driver Digital Signature</> and <>Detect TDLFS file system</>, then click <>OK</>
<img src="http://img521.imageshack.us/img521/1456/tdss3.png" alt="Posted Image" /></li>
<li>Click on the <>Start Scan</> button to begin the scan and wait for it to finish.
<>NOTE:</> Do not use the computer during the scan!</li>
<li>During the scan it will look similar to the image below:
<img src="http://img6.imageshack.us/img6/9136/tdss4.jpg" alt="Posted Image" /></li>
<li>When it finishes, you will either see a report that no threats were found like below:
<img src="http://img696.imageshack.us/img696/9898/tdss5.jpg" alt="Posted Image" />
If no threats are found at this point, just click the <>Report</> selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved.</li>
<li>If any infection or suspected items are found, you will see a window similar to below:
<img src="http://img854.imageshack.us/img854/905/tdss7.jpg" alt="Posted Image" />
<ul>
<li>If you have files that are shown to fail <em>signature check</em> do not take any action on these. Make sure you select <[b]>Skip</[b]>. I will tell you what to do with these later. They may not be issues at all.</li>
<li>If <em>Suspicious objects</em> are detected, the default action will be Skip. Leave the default set to Skip.</li>
<li>If <em>Malicious objects</em> are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects
Make sure that <[b]>Cure</[b]> is selected. <[b]>Important!</[b]> - If <em>Cure</em> is not available, please choose <[b]>Skip</[b]> instead. Do not choose Delete unless instructed to do so.</li>
</ul>
</li>
<li>Click <[b]>Continue</[b]> to apply selected actions.</li>
<li>A reboot may be required to complete disinfection. A window like the below will appear:
<img src="http://img828.imageshack.us/img828/4812/tdss6.jpg" alt="Posted Image" />
Reboot immediately if TDSSKiller states that one is needed.</li>
<li>Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like <[b]>TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt</[b]> which is based on the program version # and date and time run.</li>
<li>Attach this log to your next reply.</li>
</ol>
<hr />
<[b]>Step 3: Run a scan with OTL by OldTimer:</[b]>
<ol><li>Download the OTL utility using the below link :
<[b]><a title="External link" href="http://oldtimer.geekstogo.com/OTL.exe" rel="nofollow external">OTL DOWNLOAD LINK</a> <em>(This link will automatically download OTL on your computer)</em></[b]></li>
<li>Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL-logo.png" alt="" title="OTL-logo" width="106" height="118" class="alignnone size-full wp-image-3946" /></li>
<li>When the window appears, <[b]>underneath Output</[b]> at the top change it to <[b]>Minimal Output</[b]>.</li>
<li>Check the boxes beside <[b]>LOP Check</[b]> and <[b]>Purity Check</[b]>.</li>
<li>Click the<[b]> Run Scan</[b]> button.
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL.png" alt="" title="OTL" width="658" height="584" class="alignnone size-full wp-image-3945" /></li>
<li>When the scan completes, it will open two notepad windows. <[b]>OTL.Txt</[b]> and <[b]>Extras.Txt</[b]>. These are saved in the same location as OTL.
<[b]>Please post this 2 logs in your first reply.</[b]>.</li></ol>
<em>Note: If OTL.exe will not run, it may be blocked by malware. Try these alternate versions: <a title="External link" href="http://www.itxassociates.com/OT-Tools/OTL.scr" rel="nofollow external">OTL.scr</a>, or <a title="External link" href="http://oldtimer.geekstogo.com/OTL.com" rel="nofollow external">OTL.com</a>.</em>
<hr />

[SIZE=4][b]What's next?
Please post in your next reply:

1.HitmanPro log
2.Kaspersky TDSSKiller log
3. OTL Logs
4. QUESTION: How is your computer running?[/SIZE]

 

[surgame]

Here they are. The log file from Hitman was in .xml format and this forum doesn't seem to allow me to attach that in this post. So I went ahead and turned the .xml file into a .txt file. Please correct me if this is inadequate.

Computer is running fine like before but I'm still too paranoid to restart the computer just yet for fear of having to do this all over again.

Thank you for all your help so far.

 

[karenlsu]

:sI feel your pain!
Best of luck. I'm following your thread too.

 

[surgame]

:sI feel your pain!
Best of luck. I'm following your thread too.

Thanks. Have your own issues been solved yet?

So grateful for this website and its team. Truly noble human beings.

 

[Jack]

Ok , looks good.+1 for the .txt file for the HitmanPro log.......Next,please run the below tools...
1. Run a scan with RogueKiller
<ol>
<li>Please <>download the latest official version of </><>RogueKiller</>.
<a href="http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe" rel="nofollow" target="_blank">RogueKiller Download Link</a> (This link will automatically download RogueKiller on your computer)</li>
<li><>Double click on RogueKiller.exe</> to start this utility and then <>wait for the Prescan to complete</>.This should take only a few seconds and then you can <>click the Start button</> to perform a system scan.
<img title="Click on the Start button to perform a system scan" src="http://malwaretips.com/blogs/wp-content/uploads/2012/04/roguek-1.png" alt="[Image: roguekiller-1.png]" width="600" height="450" border="0" /></li>
<li>After the scan has completed, <>press the Delete button</> to remove any malicious registry keys.
<img title="Press Delete to remove the malicious registry keys" src="http://malwaretips.com/blogs/wp-content/uploads/2012/04/roguek-2.png" alt="[Image: roguekiller-2.png]" width="600" height="450" border="0" /></li>
<li>Next we will need to restore your shortcuts, <>so click on the ShortcutsFix button </>and allow the program to run.
<img title="Click on the Start button to perform a system scan" src="http://malwaretips.com/blogs/wp-content/uploads/2012/04/roguek-3.png" alt="[Image: roguekiller-1.png]" width="600" height="450" border="0" /></li>
</ol>

The report has been created on the desktop.In your next reply please post:

All RKreport.txt text files located on your desktop.

<hr />

2.Run a Combofix scan
Download ComboFix from one of these locations:

<>Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop</>

<a title="External link" href="http://download.bleepingcomputer.com/sUBs/ComboFix.exe" rel="external"><>Link 1</></a>
<a title="External link" href="http://www.infospyware.net/antimalware/combofix/" rel="external"><>Link 2</></a>

<[b]>* IMPORTANT !!! Save ComboFix to your Desktop</[b]>
<ul>
<li>Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See <a title="External link" href="http://www.bleepingcomputer.com/forums/topic114351.html" rel="external">HERE</a> for help</li>
<li>Double click on Combo-Fix & follow the prompts.</li>
<li>As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's [b]ly recommended to have this pre-installed on your machine before doing any malware removal.  It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.</li>
<li>Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.</li>
</ul>
**Please note: (This applies to Windows XP systems only) If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

<img src="http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif" alt="Posted Image" />
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

<img src="http://img.photobucket.com/albums/v706/ried7/whatnext.png" alt="Posted Image" />
Click on <[b]>Yes</[b]>, to continue scanning for malware.

When finished, ComboFix will produce a log.

<[b]>Note:</[b]>
[color=#FF0000]1. Do not mouseclick combofix's window while it's running. That may cause it to stall!
2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.[/color]

[SIZE=4][b]What's next?
Please post in your next reply:
1.RogueKiller logs
2.Combofix logs
3.Let me know if you had any problems with the above instructions and also <>let me know how things are running now!</[b]>[/SIZE]

 

[surgame]

I ran Rogue Killer scan before this forum post and it did pickup like 6-7 problems from that scan which I then deleted. I don't know why but I deleted the log files from that scan...but I didn't delete the RK_Quarantine folder that was left over from that scan. So I will attach the Quarantine Report from that folder below. Hope this is satisfactory.

I've ran ComboFix -> it found some infection(s) -> finished/cleaned -> rebooted -> then generated the log, which I saved to desktop.

However, the problem is that I can't open any program right now...it just warns me that:

"Illegal operation attempted on a registry key that has been marked for deletion."
THEN I PRESS OK AND IT SAYS:
"The item you selected us unavailable. It might have been moved, renamed, or removed. Do you want to remove it from the list?
YES OR NO -> I PRESS NO

So I copied the Quarantine Report and combofix log to a usb and am using my mac desktop to write this and attach them.

Do I need to just reboot the computer again to fix the file opening problem?

 

[Jack]

Yes,please restart your computer and the let me know how things are running.

 

[Jack]

OK,we need to use ComboFix to remove some stuff.
<ol>
<li>Make sure that the copy of combofix.exe that you downloaded earlier is on your Desktop but Do not run it!</li>
<li>If it is not on your Desktop, the below will not work.</li>
<li>Download the CFscript.txt (By right-clicking and selecting 'Save link as..') and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

[attachment=1745]
</li>
<li>At this point, you MUST EXIT ALL BROWSERS NOW before continuing!</li>
<li>You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.</li>
<li>Now use your mouse to drag CFScript.txt on top of ComboFix.exe
<img src="http://img213.imageshack.us/img213/1218/cfscript1.gif" alt="Posted Image" /></li>
<li>Follow the prompts.</li>
<li>When it finishes, a log will be produced named c:\combofix.txt</li>
<li>I will ask for this log below</li>
</ol>
<>Note:</> <>DO NOT</> mouseclick combofix's window while it is running. That may cause it to stall.

The ComboFix folder should <>not</> be renamed since ComboFix and even we would have suspicions about it. Also when you uninstall CF, the folder would not be removed since it does not look for that folder name.

 

[surgame]

Alright before I follow these instructions I just want to clarify that ComboFix is ok being named Combo-Fix.exe on my desktop.

Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

These instructions above told me to save ComboFix to my desktop as Combo-Fix.exe

Do you want me to keep it named Combo-Fix.exe on my desktop or rename it to ComboFix.exe before I drag and drop the CFScript.txt?

Thanks.

 

[Jack]

Quick question: Are you still having problems when you try to start programs?

 

[surgame]

Whoops. Should have noted that first. I restarted the computer and now everything is working and opening fine. The only exception seems to be Firefox. When I try to open Firefox it asks me to all it to make changes to the computer, just like when I first installed it... should I just answer yes and thats it or do you want me to continue with the CFScript.txt?

 

[Jack]

Skip the CFScript.txt...As far as Firefox goes , I can't really understand what "Firefox it asks me to all it to make changes to the computer, just like when I first installed it" means..but you can allow this request if you know is legit.

Lets move on :
<>1. Run Windows Repair by Tweaking.com </>
Download <><a title="External link" href="http://www.tweaking.com/content/page/windows_repair_all_in_one.html" rel="nofollow">Windows Repair by Tweaking.com</a></> to your desktop.  Use the direct download link for the Portable version of Windows Repair by Tweaking.com
<ol>
<li>Double-click <>tweaking.com_windows_repair_aio.zip</> and extract the <>Tweaking.com - Windows Repair</> folder to your desktop.</li>
<li>Now open this folder and double-click <>Repair_Windows.exe</>.</li>
<li>Click the <>Start Repairs</> tab on the far right.</li>
<li>Click the <>Start</> button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.</li>
<li>Click <>Unselect All</></li>
<li>Put a checkmark in the following items:
<ul>
<li>Repair Temp Files</li>
<li>Remove Policies Set By Infections</li>
</ul>
Note: Leave everything else unchecked</li>
<li>Put a checkmark in <>Restart System When Finished</></li>
<li>Now click the <>Start</> button (bottom right)</li>
</ol>

<hr />
<[b]>2.Run a scan with Kaspersky Virus Removal Tool</[b]>
Click <a title="External link" href="http://www.kaspersky.com/antivirus-removal-tool?form=1" rel="nofollow external" rel="nofollow"><[b]>here</[b]></a> to download the Kaspersky Virus Removal Tool.
<ol>
<li>Save it to your desktop.</li>
<li>Double click the setup file to run it.</li>
<li>Follow the onscreen prompts until it is installed</li>
<li>Click the Options button (the 'Gear' icon), then make sure only the following are ticked:
<ul>
<li><span style="color: #ff0000;">System Memory</span></li>
<li><span style="color: #ff0000;">Hidden startup objects</span></li>
<li><span style="color: #ff0000;">Disk boot sectors</span></li>
<li><span style="color: #ff0000;">Local Disk (C: )</span></li>
<li><span style="color: #ff0000;">Also any other drives (Removable that you may have)</span></li>
</ul>
</li>
<li>Then click on <[b]>Actions</[b]> on the left hand side</li>
<li>Click <[b]>Select Action</[b]>, then make sure both <[b]>Disinfect</[b]> and <[b]>Delete if disinfection fails</[b]> are ticked</li>
<li>Click on <[b]>Automatic Scan</[b]></li>
<li>Now click the <[b]>Start Scanning</[b]> button, to run the scan</li>
<li>After the scan is complete, click the reports button ('Paper icon', next to the 'Gear' icon) on the right hand side</li>
<li>Click <[b]>Detected threats</[b]> on the left</li>
<li>Now click the <[b]>Save</[b]> button, and save it as <[b]>kaslog.txt</[b]> to your <[b]>Desktop</[b]></li>
<li>Please attach kaslog.txt in your next reply.</li>
</ol>
<hr />

 

[surgame]

Alright finished both, Kaspersky didn't detect any threats so there is no Detected Threats Report to save. The only report to save is the Automatic Scan Report, but that is around 30MB and therefore greater than the allocated attachment usage of 1MB.

As a side note when scanning the C Drive Kaspersky made a bell sound every time it came across some password protected files. I don't know if that's normal or not since I've never made a password for this computer.

Thanks once again, everything appears clean. Is there anything else you recommend I do?

 

[Jack]

We're almost done........
<hr />

<>STEP 1: Run a scan with Security Check</>
Download <>Security Check</> from <a href="http://screen317.changelog.fr/SecurityCheck.exe" target="_blank">HERE</a>, and save it to your <>Desktop</>.
<ol>
<li>Double-click <>SecurityCheck.exe</></li>
<li>Follow the onscreen instructions inside of the black box.</li>
<li>A <>Notepad</> document should open automatically called <>checkup.txt</>; please post the contents of that document.

<>NOTE</> SecurityCheck may produce some false warning(s), so leave the results reading to me.</li>
</ol>
<hr />
<>STEP 2: Run a scan with OTL by OldTimer:</>
<ol><li>Download the OTL utility using the below link :
<><a title="External link" href="http://oldtimer.geekstogo.com/OTL.exe" rel="nofollow external">OTL DOWNLOAD LINK</a> <em>(This link will automatically download OTL on your computer)</em></></li>
<li>Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL-logo.png" alt="" title="OTL-logo" width="106" height="118" class="alignnone size-full wp-image-3946" /></li>
<li>When the window appears, <>underneath Output</> at the top change it to <[b]>Minimal Output</[b]>.</li>
<li>Check the boxes beside <[b]>LOP Check</[b]> and <[b]>Purity Check</[b]>.</li>
<li>Under the [b]Custom Scan box paste this in:

%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.exe
%APPDATA%\*.
/md5start
atapi.sys
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
csrss.exe
PrintIsolationHost.exe
consrv.dll
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles

</li>
<li>Click the<> Run Scan</[b]> button.</li>
<li>When the scan completes, it will open two notepad windows. <[b]>OTL.Txt</[b]> and <[b]>Extras.Txt</[b]>. These are saved in the same location as OTL.
<[b]>Please post this 2 logs in your first reply.</[b]>.</li></ol>
<em>Note: If OTL.exe will not run, it may be blocked by malware. Try these alternate versions: <a title="External link" href="http://www.itxassociates.com/OT-Tools/OTL.scr" rel="nofollow external">OTL.scr</a>, or <a title="External link" href="http://oldtimer.geekstogo.com/OTL.com" rel="nofollow external">OTL.com</a>.</em>
<hr />
[SIZE=4][b]What's next?
Please post in your next reply:

1.Security Check log
2.OTL logs
3.Let me know if you had any problems with the above instructions and also <>let me know how things are running now!</[b]>[/SIZE]

 

[surgame]

Okay here's the checkup.txt and OTL.txt Logs.

 

[Jack]

<span style="color: #ff0000;"><>Warning!</></span> <em><>This fix is only relevant for this system and no other, using on another computer may cause problems</> </em>

<span style="color: #ff0000;">Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot</span>

Run the below OTL Fix:
<ul>
<li>Under the <>Custom Scans/Fixes</> box at the bottom, paste in the following.
[attachment=1774]

:OTL

:Files
C:\ProgramData\-1aWaXmZs18WCxc
C:\ProgramData\-1aWaXmZs18WCxcr
C:\ProgramData\-PGAxy6u8WVkNMmr
C:\ProgramData\-PGAxy6u8WVkNMm

:Commands
[Reboot]

</li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot the PC when it is done</li>
<li>Open OTL again and click the <>Quick Scan</> button. Post the log it produces in your next reply.</li>
</ul>

NEXT,Your <>JAVA</> is out of date ,so we need to updated it.

<img src="http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif" alt="Posted Image" /> <>UPDATE JAVA</>

Your version of <>Java</><> is out of date</>. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older versions of <>Java</> components and update:
<ul>
<li>Please download <a title="External link" href="http://singularlabs.com/software/javara/javara-download/" rel="nofollow external"><[b]>JavaRa</[b]></a> to your desktop.
<ul>
<li>Click the <[b]>Download</[b]> button next to <[b]>Windows Binary (.zip)</[b]> Version 1.16 to download <[b]>JavaRA</[b]> and unzip it to its own folder.</li>
</ul>
</li>
<li><[b]>Run JavaRa.exe</[b]></li>
<li>Pick the language of your choice and click <[b]>Select</[b]>. Then click <[b]>Remove Older Versions</[b]>. Accept any prompts.
<img src="http://singularlabs.com/wp-content/uploads/2011/05/JavaRa1.png" alt="Posted Image" /></li>
<li><[b]>Open JavaRa.exe again</[b]> and select <[b]>Search For Updates</[b]>.</li>
<li>Select <[b]>Update Using Sun Java's Website</[b]> then click <[b]>Search</[b]> and click on the <[b]>Open Webpage</[b]> button. Download and install the latest Java Runtime Environment (JRE) version for your computer.
</li>
</ul>

 

[surgame]

Did as instructed, have the latest java and the Quick Scan OTL Log is below.

 

[Jack]

Ok surgame,looks good...How are things running?Are you experiencing any problems?

 

[surgame]

Everything is running like normal again. Thank you so much Jack.

2 Questions

Is it safe to have all the logs that I've attached throughout this thread be public? I see that many of them have been download many times over.
&
Is there by any chance a antivirus program that you or this community most recommends? I would really like to purchase under an affiliate link of this website if this is possible?

Thanks again for your time