Rouge AV

[All Day Win]

Hey guys I have a rouge av (AGAIN -.-)

So if anyone wants to help me out that would be great

I have to stop watching porn -.-

 

[Griffin]

Only certified malware removal team members are allowed to reply in this section. I'd like you to supply myself with the following points before we commence further.

1. Do you currently have internet access?

2. What specifically occurs whilst trying to reboot your computer into safe mode?

3. Do you have access to another computer with Internet access besides the one you're currently on?

4. Do you have access to an external hard or another form of secondary storage such as a CD or USB?

5. Can you please supply myself with the name of the Rogue infection which is currently present on your machine?

 

[All Day Win]

1. Yes
2 Blue Screen
3. Yes
4. I got a USB
5. Antivirus xp 2012

 

[Griffin]

Apologies for the delay between responses. Please attempt these instructions and let me know how you progress.

Please download OTL to your Desktop. (If you already have it downloaded, then just follow the instructions below).

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in
  
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\*.sys
  %systemroot%\system32\drivers\*.dll
  %systemroot%\system32\drivers\*.ini
  %systemroot%\system32\drivers\*.exe
  %SYSTEMDRIVE%\*.*
  %PROGRAMFILES%\*.
  %appdata%\*.*
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  disk.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  usbstor.sys
  /md5stop
  CREATERESTOREPOINT
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) and paste (Edit->Paste) the contents of these files, one at a time to www.pastebin.com

Note: in the event that OTL fails to run, please use alternate download link to try again:

Download Link 1
Download Link 2

 

[All Day Win]

http://pastebin.com/BTArAivj

 

[Griffin]

Step One

Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :OTL
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
  O33 - MountPoints2\{20a606ce-770c-11df-8006-0015c5692895}\Shell - "" = AutoRun
  O33 - MountPoints2\{20a606ce-770c-11df-8006-0015c5692895}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{20a606ce-770c-11df-8006-0015c5692895}\Shell\AutoRun\command - "" = "H:\WD SmartWare.exe" autoplay=true
  O33 - MountPoints2\{339eba0c-9433-11df-801b-0015c5692895}\Shell - "" = AutoRun
  O33 - MountPoints2\{339eba0c-9433-11df-801b-0015c5692895}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{339eba0c-9433-11df-801b-0015c5692895}\Shell\AutoRun\command - "" = G:\LaunchU3.exe
  O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
  O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = E:\setup.exe
  O33 - MountPoints2\{854c2343-e77c-11df-8046-0015c5692895}\Shell - "" = AutoRun
  O33 - MountPoints2\{854c2343-e77c-11df-8046-0015c5692895}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{854c2343-e77c-11df-8046-0015c5692895}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RONzRIdEr.Exe
  O33 - MountPoints2\{c1eb0ca4-0d9b-11de-bfbc-0015c5692895}\Shell - "" = AutoRun
  O33 - MountPoints2\{c1eb0ca4-0d9b-11de-bfbc-0015c5692895}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{c1eb0ca4-0d9b-11de-bfbc-0015c5692895}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
  O35 - HKCU\..exefile [open] -- "C:\Documents and Settings\Reuben E. Rojas\Local Settings\Application Data\cha.exe" -a "%1" %* ()
  O36 - AppCertDlls: cmdltray - (C:\WINDOWS\system32\drivvaws.dll) - File not found
  O37 - HKCU\...exe [@ = exefile] -- "C:\Documents and Settings\Reuben E. Rojas\Local Settings\Application Data\cha.exe" -a "%1" %* ()
  @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4
  @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07BF512B
  @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
  @Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
  
  :Files
  C:\Documents and Settings\Reuben E. Rojas\Local Settings\Application Data\cha.exe
  
  
  :Commands
  [purity]
  [emptytemp]
  [resethosts]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then post the log from OTL presented after to Reboot.

Step Two

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

 

[All Day Win]

Everything works great thanks baby doll (;

 

[Griffin]

Please perform the rest of the procedures I've posted. I've got a feeling there might also be a rootkit present.

 

[All Day Win]

Found the rootkit, its gone.

 

[Griffin]

Post the results please as we still aren't finished. Those instructions which I've posted won't remove a rootkit if there is one present.

 

[All Day Win]

Alright let me do this when I get home :3

 

[Griffin]

Ok no worries, keep me updated