12 replies to this topic

[dontlookbackinanger]

Apologies if this is in the wrong forum, but I'm new to this site and I really need help removing some malware.

It comes up as "total antimalware protection". I ran malwarebytes and it detects "hi.jacksearchpage". I select remove, but upon restarting it still isn't removed.

When I run a symantec endpoint protection scan, it detects the malware as "virusdoctor". Again, it isn't capable of removing it. What do I do now? Sorry if this is elementary, but I'm basically computer illiterate.

[MrCharlie]

Welcome to the forum, please start at the link below:

http://forums.malwar...?showtopic=9573

Post back the 2 logs.

<====><====><====><====><====><====><====><====>

Next.......

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller.

For Windows XP, double-click to start.
For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system (don't run any other options, they're not all bad!)
Post back the report.

MrC

[dontlookbackinanger]

Alright, I've posted the logs, thanks for the help MrCharlie!

Attached Files

•  Attach.txt   12.91K   4 downloads
•  DDS.txt   23.17K   1 downloads
•  RKreport1.txt   2.56K   1 downloads

[MrCharlie]

OK, run RogueKiller again and click Scan
When the scan completes > click on the Bad processes tab
Put a check next to all of these and uncheck the rest:

Quote

¤¤¤ Bad processes: 1 ¤¤¤
[SUSP PATH] TAe0e_8039.exe -- C:\ProgramData\e0e1fc\TAe0e_8039.exe -> KILLED [TermProc]

Now click Delete on the left hand column.

Repeat the process for these
Click on the Registry Entries > put a check next to these and uncheck the rest
Click on Delete

Quote

¤¤¤ Registry Entries: 13 ¤¤¤
[BLACKLIST DLL] HKCU\[...]\Run : cmexys (rundll32.exe "C:\Users\Richard\AppData\Local\Temp\cmexys.dll",GetComment) -> FOUND
[BLACKLIST DLL] HKCU\[...]\Run : rkbas (rundll32.exe "C:\Users\Richard\AppData\Local\Temp\rkbas.dll",HostAlloc) -> FOUND
[SUSP PATH] HKCU\[...]\Run : Total Anti Malware Protection ("C:\ProgramData\e0e1fc\TAe0e_8039.exe" /s /d) -> FOUND
[BLACKLIST DLL] HKUS\S-1-5-21-1720457431-1890699925-3428249428-1001[...]\Run : cmexys (rundll32.exe "C:\Users\Richard\AppData\Local\Temp\cmexys.dll",GetComment) -> FOUND
[BLACKLIST DLL] HKUS\S-1-5-21-1720457431-1890699925-3428249428-1001[...]\Run : rkbas (rundll32.exe "C:\Users\Richard\AppData\Local\Temp\rkbas.dll",HostAlloc) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-1720457431-1890699925-3428249428-1001[...]\Run : Total Anti Malware Protection ("C:\ProgramData\e0e1fc\TAe0e_8039.exe" /s /d) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowHelp (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND

-----------------------------------

Then run an OTL scan.....

Please download OTL from one of the links below:
http://oldtimer.geekstogo.com/OTL.exe
http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.
Double click on the icon on your desktop.
Click the Scan All Users checkbox.
Push the Quick Scan button.

The scan will take about 10 minutes...depends on your hard drive size.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)
OTL.txt <-- Will be opened
Extra.txt <-- Will be minimized

MrC

[dontlookbackinanger]

Here are the logs.

Attached Files

•  OTL.Txt   114.58K   2 downloads
•  Extras.Txt   87.49K   0 downloads

[MrCharlie]

If any of your folders, files, shortcuts etc are hidden, please run unhide:
http://www.bleepingc...opic405109.html <---unhide
----------------------------
Please do this:
Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following

  :OTL
  MOD - [2012/04/25 00:38:32 | 000,300,032 | ---- | M] () -- C:\Users\Richard\AppData\Local\Temp\rkbas.dll
  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
  O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  [2012/05/03 19:29:54 | 000,000,000 | -HSD | C] -- C:\Users\Richard\AppData\Roaming\Total Anti Malware Protection
  [2012/05/03 19:29:51 | 000,000,000 | -HSD | C] -- C:\ProgramData\TAVYMP
  [2012/05/03 19:29:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\e0e1fc
  [2012/05/04 11:37:23 | 000,001,645 | ---- | M] () -- C:\Users\Richard\Application Data\Microsoft\Internet Explorer\Quick Launch\Total Anti Malware Protection.lnk
  [2012/05/04 11:37:23 | 000,001,619 | ---- | M] () -- C:\Users\Richard\Desktop\Total Anti Malware Protection.lnk
  [2012/05/03 21:38:18 | 000,001,619 | ---- | C] () -- C:\Users\Richard\Desktop\Total Anti Malware Protection.lnk
  [2012/05/03 19:30:15 | 000,001,645 | ---- | C] () -- C:\Users\Richard\Application Data\Microsoft\Internet Explorer\Quick Launch\Total Anti Malware Protection.lnk
  [2012/03/24 10:19:34 | 000,000,176 | ---- | C] () -- C:\ProgramData\~LABlxYFAgEdtppr
  [2012/03/24 10:19:33 | 000,000,264 | ---- | C] () -- C:\ProgramData\~LABlxYFAgEdtpp
  [2012/03/24 10:19:23 | 000,000,408 | ---- | C] () -- C:\ProgramData\LABlxYFAgEdtpp
  [2012/05/03 19:30:13 | 000,000,000 | -HSD | M] -- C:\Users\Richard\AppData\Roaming\Total Anti Malware Protection
  [2012/05/03 21:38:18 | 000,001,651 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Total Anti Malware Protection.lnk
  

• Then click the Run Fix button at the top
  
• Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  
• Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

MrC

[dontlookbackinanger]

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
C:\Users\Richard\AppData\Roaming\Total Anti Malware Protection folder moved successfully.
C:\ProgramData\TAVYMP folder moved successfully.
C:\ProgramData\e0e1fc\TAMPSys folder moved successfully.
C:\ProgramData\e0e1fc\Quarantine Items folder moved successfully.
C:\ProgramData\e0e1fc\BackUp folder moved successfully.
C:\ProgramData\e0e1fc folder moved successfully.
C:\Users\Richard\Application Data\Microsoft\Internet Explorer\Quick Launch\Total Anti Malware Protection.lnk moved successfully.
C:\Users\Richard\Desktop\Total Anti Malware Protection.lnk moved successfully.
File C:\Users\Richard\Desktop\Total Anti Malware Protection.lnk not found.
File C:\Users\Richard\Application Data\Microsoft\Internet Explorer\Quick Launch\Total Anti Malware Protection.lnk not found.
C:\ProgramData\~LABlxYFAgEdtppr moved successfully.
C:\ProgramData\~LABlxYFAgEdtpp moved successfully.
C:\ProgramData\LABlxYFAgEdtpp moved successfully.
Folder C:\Users\Richard\AppData\Roaming\Total Anti Malware Protection\ not found.
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Total Anti Malware Protection.lnk moved successfully.

OTL by OldTimer - Version 3.2.42.2 log created on 05042012_150400

[MrCharlie]

One more scan should do it.....

Please download and run ComboFix.
The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Please include the C:\ComboFix.txt in your next reply for further review.

Note:
If you get the message Illegal operation attempted on registry key that has been marked for deletion. after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.
MrC

[dontlookbackinanger]

Here's the combofix log.

Attached Files

•  log.txt   17.5K   1 downloads

[MrCharlie]

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how it is, MrC

[dontlookbackinanger]

I restarted and everything seems back to normal! Can I delete the logs and programs now?

Thank you very much!!

[MrCharlie]

Great

A little cleanup to do....

Please Uninstall ComboFix:

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /



Then hit enter.
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

---------------------------------

Please download OTL from one of the links below:
http://oldtimer.geekstogo.com/OTL.exe
http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

-------------------------------


You have out date Java on the system, older versions are vulnerable to malware.

Please go to your control panel > Java > Update Tab > Update Now
Here's the Java Update info:

http://www.java.com/...va_update12.jpg

Java™ 6 Update 29 <-------should be 32

-----------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.