BleepingComputer.com: System Recovery Virus?

Hi there!
So I recently downloaded winrar from rarlab.com and it seems to have given me a Systerm Recovery Antivirus Scan Virus. I've download from rarlab.com on other computers before, but it seems as though mine has been infected. I also recently got a new Kingstom USB flash drive, but I don't think that's what gave me this virus. All my desktop icons have disappeared, and the virus restarted my computer. I'm currently running Malwarebytes, but what else should I do?
Help!

Hello and Welcome to Bleeping Computer,
Running MalwareBytes is really all you can do right now. This topic will also probably have to be moved. Post MalwareBytes log after scan is complete.

Thanks

Oh okay alright. Should I be running a full scan? And I wasn't too sure where to post this at...

Hello and welcome. I moved this from WIN7 to the Am I Infected forum.

First run RKill....

Download and Run RKill

Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

Link 1
Link 2
Link 3
Link 4



• Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  
  
• Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  
  
• A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  
  
• If nothing happens or if the tool does not run, please let me know in your next reply

Do not reboot your computer after running rkill as the malware programs will start again. Or if rebooting is required run it again.


If you continue having problems running rkill.com, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Next follow this..
Please follow our Removal Guide here How to remove Google Redirects. You will move to the Automated Removal Instructions

If it finds something make sure Cure is selected
Next click Continue then Reboot now
A log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.


Please ask any needed questions,post logs and Let us know how the PC is running now.

Is this the correct scan log I should be posting?

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7411

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8/8/2011 12:54:52 PM
mbam-log-2011-08-08 (12-54-52).txt

Scan type: Quick scan
Objects scanned: 182507
Time elapsed: 4 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NuEpAJuQkAgJxm (Trojan.FakeAlert) -> Value: NuEpAJuQkAgJxm -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\nuepajuqkagjxm.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\p1kalmig2kb7fz.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\grace gee\AppData\Local\Temp\icreinstall\downloadmanagersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\grace gee\downloads\downloadmanagersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\grace gee\local settings\temporary internet files\Content.IE5\U12I5PGY\pusk3[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

For the TDSSKiller, no infection was found.

A popup from Malwarebytes said that it failed to perform required action error 2.

Uninstall MBAM through Programs and Features then reboot and reinstall it.

MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware and save it to your desktop.

Download Link 1
Download Link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware



Are you on a router? Are other machines on it,if so are they redirecting?

Do you use Firefox?

This post has been edited by boopme: 08 August 2011 - 01:25 PM

I am on a router, which I reset. Another computer that is on the router has been redirecting for about a week now, whereas mine just started redirecting today after it was infected. I use Google Chrome.

This is the RKill log:


This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 08/08/2011 at 17:33:09.
Operating System: Windows 7 Home Premium


Processes terminated by Rkill or while it was running:

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
C:\Windows\sysWow64\SearchProtocolHost.exe
C:\Windows\SysWOW64\grpconv.exe


Rkill completed on 08/08/2011 at 17:34:42.

Here is a new scan of Malwarebytes.


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7413

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8/8/2011 5:41:41 PM
mbam-log-2011-08-08 (17-41-41).txt

Scan type: Quick scan
Objects scanned: 183358
Time elapsed: 5 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\grace gee\AppData\Local\Temp\icreinstall\downloadmanagersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\grace gee\downloads\downloadmanagersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.

It seems as though nothing was detected when I ran Malwarebytes again.


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7413

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8/8/2011 5:54:34 PM
mbam-log-2011-08-08 (17-54-34).txt

Scan type: Quick scan
Objects scanned: 183320
Time elapsed: 5 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Your router is hijacked by trojan DNS-hijacker.

Download and update MBAM (below) Do not run yet.

Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds). If you don’t know the router's default password, you can look it up HERE.
Note: After resetting your router, it is important to set a non-default password, and if possible, username, on the router. This will assist in eliminating the possibility of the router being hijacked again.


As there are other infected machines using the same router, they will need to be cleared with the above steps before resetting the router. Otherwise, the malware will simply go back and change the router's DNS settings. You also need to reconfigure any security settings you had in place prior to the reset. Check out this site HERE for video tutorials on how to properly configure your router's encryption and security settings. You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

Once you have ran Malwarebytes' Anti-Malware on the infected system, and reset the router to its default configuration you can reconnect to the internet, and router.

For the other infected computers using the same router, it seems like they were already experiencing the redirecting problems way before my computer had been infected. Should I still clear them with the steps above though?

Yes they need to be scanned before you reconnect.
Install ,update MBAM. Disconnect.

scan all then reset the router.

This post has been edited by boopme: 08 August 2011 - 09:58 PM