Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

System Recovery Virus?


  • Please log in to reply
13 replies to this topic

#1 twinstar459

twinstar459

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 11:31 AM

Hi there!
So I recently downloaded winrar from rarlab.com and it seems to have given me a Systerm Recovery Antivirus Scan Virus. I've download from rarlab.com on other computers before, but it seems as though mine has been infected. I also recently got a new Kingstom USB flash drive, but I don't think that's what gave me this virus. All my desktop icons have disappeared, and the virus restarted my computer. I'm currently running Malwarebytes, but what else should I do?
Help!

BC AdBot (Login to Remove)

 


#2 weatherman13

weatherman13

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 11:37 AM

Hello and Welcome to Bleeping Computer,
Running MalwareBytes is really all you can do right now. This topic will also probably have to be moved. Post MalwareBytes log after scan is complete.

Thanks

#3 twinstar459

twinstar459
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 11:46 AM

Oh okay alright. Should I be running a full scan? And I wasn't too sure where to post this at...

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:41 PM

Posted 08 August 2011 - 11:46 AM

Hello and welcome. I moved this from WIN7 to the Am I Infected forum.

First run RKill....

Download and Run RKill
  • Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

    Link 1
    Link 2
    Link 3
    Link 4

  • Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  • Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • If nothing happens or if the tool does not run, please let me know in your next reply

Do not reboot your computer after running rkill as the malware programs will start again. Or if rebooting is required run it again.


If you continue having problems running rkill.com, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Next follow this..
Please follow our Removal Guide here How to remove Google Redirects. You will move to the Automated Removal Instructions

If it finds something make sure Cure is selected
Next click Continue then Reboot now
A log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.


Please ask any needed questions,post logs and Let us know how the PC is running now.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 twinstar459

twinstar459
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 11:58 AM

Is this the correct scan log I should be posting?

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7411

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8/8/2011 12:54:52 PM
mbam-log-2011-08-08 (12-54-52).txt

Scan type: Quick scan
Objects scanned: 182507
Time elapsed: 4 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NuEpAJuQkAgJxm (Trojan.FakeAlert) -> Value: NuEpAJuQkAgJxm -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\nuepajuqkagjxm.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\p1kalmig2kb7fz.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\grace gee\AppData\Local\Temp\icreinstall\downloadmanagersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\grace gee\downloads\downloadmanagersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\grace gee\local settings\temporary internet files\Content.IE5\U12I5PGY\pusk3[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

#6 twinstar459

twinstar459
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 12:04 PM

For the TDSSKiller, no infection was found.

#7 twinstar459

twinstar459
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 12:07 PM

A popup from Malwarebytes said that it failed to perform required action error 2.

#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:41 PM

Posted 08 August 2011 - 01:22 PM

Uninstall MBAM through Programs and Features then reboot and reinstall it.

MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware and save it to your desktop.
Download Link 1
Download Link 2MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
    For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware



Are you on a router? Are other machines on it,if so are they redirecting?

Do you use Firefox?

Edited by boopme, 08 August 2011 - 01:25 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#9 twinstar459

twinstar459
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 04:38 PM

I am on a router, which I reset. Another computer that is on the router has been redirecting for about a week now, whereas mine just started redirecting today after it was infected. I use Google Chrome.

This is the RKill log:


This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 08/08/2011 at 17:33:09.
Operating System: Windows 7 Home Premium


Processes terminated by Rkill or while it was running:

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
C:\Windows\sysWow64\SearchProtocolHost.exe
C:\Windows\SysWOW64\grpconv.exe


Rkill completed on 08/08/2011 at 17:34:42.

#10 twinstar459

twinstar459
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 04:43 PM

Here is a new scan of Malwarebytes.


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7413

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8/8/2011 5:41:41 PM
mbam-log-2011-08-08 (17-41-41).txt

Scan type: Quick scan
Objects scanned: 183358
Time elapsed: 5 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\grace gee\AppData\Local\Temp\icreinstall\downloadmanagersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\grace gee\downloads\downloadmanagersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.

#11 twinstar459

twinstar459
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 04:55 PM

It seems as though nothing was detected when I ran Malwarebytes again.


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7413

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8/8/2011 5:54:34 PM
mbam-log-2011-08-08 (17-54-34).txt

Scan type: Quick scan
Objects scanned: 183320
Time elapsed: 5 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:41 PM

Posted 08 August 2011 - 07:32 PM

Your router is hijacked by trojan DNS-hijacker.

Download and update MBAM (below) Do not run yet.

Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds). If you donít know the router's default password, you can look it up HERE.
Note: After resetting your router, it is important to set a non-default password, and if possible, username, on the router. This will assist in eliminating the possibility of the router being hijacked again.


As there are other infected machines using the same router, they will need to be cleared with the above steps before resetting the router. Otherwise, the malware will simply go back and change the router's DNS settings. You also need to reconfigure any security settings you had in place prior to the reset. Check out this site HERE for video tutorials on how to properly configure your router's encryption and security settings. You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

Once you have ran Malwarebytes' Anti-Malware on the infected system, and reset the router to its default configuration you can reconnect to the internet, and router.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 twinstar459

twinstar459
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:41 PM

Posted 08 August 2011 - 09:51 PM

For the other infected computers using the same router, it seems like they were already experiencing the redirecting problems way before my computer had been infected. Should I still clear them with the steps above though?

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:41 PM

Posted 08 August 2011 - 09:56 PM

Yes they need to be scanned before you reconnect.
Install ,update MBAM. Disconnect.

scan all then reset the router.

Edited by boopme, 08 August 2011 - 09:58 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users