Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

USB Shortcut created and all files transfered to it.


  • This topic is locked This topic is locked
28 replies to this topic

#1 Elite Immanuel

Elite Immanuel

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 21 September 2013 - 02:34 PM

A shortcut with the name of my USB drive (pendrive or memory card ) is created, along with its memory in gb with the name, inside the usb itself . And all its contents are transfered in a hidden folder with no name. A desktop.ini and autorun.ini (both hidden ) is also created. Whenever i insert it even after formating them the same case repeats. Can anyone please tell me if its a virus and if it is a virus then is there any specific name of the virus and how to remove it. And can it even spread in all my internal hard disk drives. Any help would be great.

BC AdBot (Login to Remove)

 


#2 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:11:41 PM

Posted 21 September 2013 - 02:50 PM

Hello! Welcome to BleepingComputer Forums! :welcome:
My name is Georgi and and I will be helping you with your computer problems.

Before we begin, please note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

 

 

STEP 1

 

 

Please download and run the following tool and follow the prompts to disable Autorun.

 

 

STEP 2

 

 

Next please download and install MCShield 2

Go to Scanner tab and put a checkbox beside BulletProof then hit Apply.

Now plug-in your external hdd and wait to be scanned and repaired.

A log file should appear when this is done. Please post the content of the log in your next reply.

 

 

Regards,

Georgi


cXfZ4wS.png


#3 Elite Immanuel

Elite Immanuel
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 23 September 2013 - 04:50 AM

First of all Thanks for the welcome sir. And Sorry for this late reply.
I did as u said and ran microsoft fixit but it didnt showed any autorun options. And then i ran the mcshield 2 and i will post its log in the next reply. Thanks alot for ur quik response.

#4 Elite Immanuel

Elite Immanuel
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 23 September 2013 - 06:54 AM

This is the log file generated automatically after
the installation of MCShield 2: MCShield ::Anti-
Malware Tool:: http://www.mcshield.net/
>>> v 2.7.4.23 / DB: 2013.7.15.1 / Windows XP
<<<
9/23/2013 3:08:05 PM > Drive C: - scan started
(no label ~20 GB, NTFS HDD )...
>>> C:\desktop.ini - Suspicious > Renamed.
(MD5: 8ff92f37a99a16a5db4e19ddde5199b7)
=> Suspicious files : 1/1 renamed.
____________________________________________
::::: Scan duration: 1sec ::::::::::::::::::
____________________________________________
9/23/2013 3:08:05 PM > Drive D: - scan started
( SOFTWARES ~38 GB, NTFS HDD )...
>>> D:\desktop.ini - Malware > Deleted. (13.09.23.
15.08 desktop.ini.44415; MD5:
77dfc47eed399f7fa33a004cb8bd72c0)
=> Malicious files : 1/1 deleted.
____________________________________________
::::: Scan duration: 1sec ::::::::::::::::::
____________________________________________
9/23/2013 3:08:05 PM > Drive E: - scan started
(SONGS & MOVIES ~38 GB, NTFS HDD )...
>>> E:\desktop.ini - Suspicious > Renamed.
(MD5: 382a0bc4281734fbf11bdf77701c4a23)
=> Suspicious files : 1/1 renamed.
____________________________________________
::::: Scan duration: 2sec ::::::::::::::::::
____________________________________________
9/23/2013 3:08:06 PM > Drive F: - scan started
(GAMES & WALLPAPERS ~36 GB, NTFS HDD )...
>>> F:\desktop.ini - Suspicious > Renamed.
(MD5: 793ec727fb8b23038fffb8e12f139b79)
=> Suspicious files : 1/1 renamed.
____________________________________________
::::: Scan duration: 2sec ::::::::::::::::::
____________________________________________
9/23/2013 3:08:06 PM > Drive G: - scan started
(Local Disk ~18 GB, NTFS HDD )...
>>> G:\desktop.ini - Suspicious > Renamed.
(MD5: d748e6480b2d77572910dd7f33c07cc5)
=> Suspicious files : 1/1 renamed.
____________________________________________
::::: Scan duration: 2sec ::::::::::::::::::
____________________________________________
9/23/2013 3:08:07 PM > Drive I: - scan started
(IMMU ~3816 MB, FAT32 flash drive )...
>>> I:\autorun.inf > Action failed.
>>> I:\desktop.ini - Malware > Deleted. (13.09.23.
15.08 desktop.ini.346626; MD5:
9a63a725542e72ddd28c14c08aa02a15)
>>> I:\IMMU (4GB).lnk - Malware > Deleted.
(13.09.23. 15.08 IMMU (4GB).lnk.393209; MD5:
e58742c7534261e92971dcd80c8f2708)
>>> I:\4#UYRQIXUBTGKPURS.ini - Malware >
Deleted. (13.09.23. 15.08 4#
UYRQIXUBTGKPURS.ini.913052; MD5:
c6b98d580fa3d160e1fc7d1bd145f07e)
>>> I:\autorun.inf - Malware > Deletion failed.
>>> I:\Thumbs.db - Malware > Deleted.
(13.09.23. 15.08 Thumbs.db.618063; MD5:
543fd850717028d3c7d896aa0614c5fa)
> Resetting attributes: I:\� < Successful.
=> Malicious files : 4/5 deleted.
=> Suspicious files : 0/1 renamed.
=> Hidden folders : 1/1 unhidden.
____________________________________________
::::: Scan duration: 18sec :::::::::::::::::
____________________________________________
""""""And now this is the 2nd log file after
bulletproof and scanning my pendrive: """""
MCShield ::Anti-Malware Tool:: http://
www.mcshield.net/
>>> v 2.7.4.23 / DB: 2013.7.15.1 / Windows XP
<<<
9/23/2013 4:00:08 PM > Drive I: - scan started
(IMMU ~3816 MB, FAT32 flash drive )...
>>> I:\autorun.inf > Action failed.
---> Note: paranoid mode is enabled.
>>> I:\desktop.ini - Malware > Deleted. (13.09.23.
16.00 desktop.ini.841610; MD5:
2c60ef8dd35038ca44fe2e1758a28ce1)
>>> I:\IMMU (4GB).lnk - Malware > Deleted.
(13.09.23. 16.00 IMMU (4GB).lnk.527061; MD5:
9e19f9077506a60ee3a14018dcd4f204)
>>> I:\4#FHGOIYNLK.ini - Malware > Deleted.
(13.09.23. 16.00 4#FHGOIYNLK.ini.431432; MD5:
a5bd62de9585e9f5cc3b56a5b0bc36d5)
>>> I:\autorun.inf - Malware > Deletion failed.
>>> I:\Thumbs.db - Malware > Deleted.
(13.09.23. 16.00 Thumbs.db.17845; MD5:
543fd850717028d3c7d896aa0614c5fa)
> Resetting attributes: I:\� < Successful.
=> Malicious files : 4/5 deleted.
=> Hidden folders : 1/1 unhidden.
____________________________________________
::::: Scan duration: 23sec :::::::::::::::::
____________________________________________

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,934 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:41 PM

Posted 23 September 2013 - 01:27 PM

Hello, just letting you know I moved this topic o here in the Virus, Trojan, Spyware, and Malware Removal Logs forum where it will stay.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 Elite Immanuel

Elite Immanuel
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 23 September 2013 - 01:42 PM

Ok no problem but please someone help me with this!!!!!!

#7 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:11:41 PM

Posted 23 September 2013 - 02:25 PM

Hi,

 

Now we can use more advanced tools so let's get started.

 

  • Please download OTL from the link below:
  • Save it to your desktop/
  • Double click on the otlDesktopIcon.png icon on your desktop.
  • OTL should now start. Change the following settings:
    - Click on Scan All Users checkbox given at the top.46625204.png
    - Under File Scans, change File age to 90
    - Change Standard Registry to All
    - Check the boxes beside LOP Check and Purity Check
  • Copy and Paste the following code into the customFix.png textbox.
  • Don't copy the word "quoted"

    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %SYSTEMDRIVE%\*.*
    %USERPROFILE%\*.*
    %USERPROFILE%\AppData\Local\*.*
    %USERPROFILE%\AppData\Local\*.
    %USERPROFILE%\AppData\Local\temp\*.exe
    %USERPROFILE%\AppData\Roaming\*.*
    %USERPROFILE%\AppData\Roaming\*.
    %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Templates\*.*
    %USERPROFILE%\AppData\Local\Microsoft\*.*
    %USERPROFILE%\AppData\Local\Microsoft\*.
    %USERPROFILE%\AppData\Roaming\Microsoft\*.*
    %USERPROFILE%\AppData\Roaming\Microsoft\*.
    %windir%\AppPatch\*.*
    %windir%\AppPatch\*.
    %Public%\Documents\*.*
    %Public%\Documents\*.
    %ProgramData%\*.*
    %ProgramData%\*.
    %CommonProgramFiles%\*.*
    %CommonProgramFiles%\*.
    %CommonProgramFiles%\ComObjects\*.exe
    %ProgramFiles%\*.*
    %ProgramFiles%\*.
    %programdata%\Microsoft\Windows\DRM\*.tmp
    %programdata%\Microsoft\DRM\*.tmp
    %systemroot%\System32\config\systemprofile\*.*
    %systemroot%\System32\config\systemprofile\*.
    %systemroot%\SysWow64\config\systemprofile\*.*
    %systemroot%\SysWow64\config\systemprofile\*.
    %systemroot%\system32\config\systemprofile\AppData\Local\*.*
    %systemroot%\system32\config\systemprofile\AppData\Local\*.
    %systemroot%\system32\config\systemprofile\AppData\Roaming\*.*
    %systemroot%\system32\config\systemprofile\AppData\Roaming\*.
    %windir%\SysWOW64\config\systemprofile\AppData\Local\*.*
    %windir%\SysWOW64\config\systemprofile\AppData\Local\*.
    %windir%\SysWOW64\config\systemprofile\AppData\Roaming\*.*
    %windir%\SysWOW64\config\systemprofile\AppData\Roaming\*.
    %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.tlb
    %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.tlb
    %windir%\temp\*.exe
    %windir%\*.
    %windir%\ShellNew\*.*
    %windir%\installer\*.
    %windir%\system32\*.
    %windir%\sysnative\*.
    %Temp%\smtmp\1\*.*
    %Temp%\smtmp\2\*.*
    %Temp%\smtmp\3\*.*
    %Temp%\smtmp\4\*.*
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\syswow64\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /90
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\syswow64\drivers\*.sys /90
    %systemroot%\syswow64\drivers\*.sys /lockedfiles
    %SYSTEMDRIVE%\*. /rp /s
    %systemroot%\assembly\tmp\*.* /S /MD5
    %systemroot%\assembly\temp\*.* /S /MD5
    %systemroot%\assembly\GAC\*.ini
    %systemroot%\assembly\GAC_32\*.ini
    %systemroot%\assembly\GAC_64\*.ini
    %SystemRoot%\assembly\GAC_MSIL\*.ini
    wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn
    %systemdrive%\$Recycle.Bin|@;true;true;true /fp
    HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s
    HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
    HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s
    HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
    HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
    HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
    HKEY_CLASSES_ROOT\CLSID\{118BEDCC-A901-4203-B4F2-ADCB957D1887} /s
    HKEY_CLASSES_ROOT\CLSID\{312BED3C-A901-4203-B4F2-ADCB957D1887} /s
    HKEY_CLASSES_ROOT\CLSID\{F12BE2CC-A901-4203-B4F2-ADCB957D1887} /s
    HKEY_CLASSES_ROOT\CLSID\{312BFDCE-A901-4203-B4F2-ADCB957D1887} /s
    HKEY_CLASSES_ROOT\CLSID\{212B3DCC-A901-4203-B4F2-ADCB957D1887} /s
    HKEY_CLASSES_ROOT\CLSID\{A12BEDCC-A901-4203-B4F2-ADCB957D1887} /s
    HKEY_CLASSES_ROOT\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188F} /s
    HKEY_CLASSES_ROOT\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B} /s
    HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers /s
    HKEY_CURRENT_USER\Software\Classes\Directory\shellex\CopyHookHandlers /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers /s
    HKEY_CURRENT_USER\Software\MSOLoad /s
    type C:\WINDOWS\system.ini >> test.txt /c
    bcdedit /enum all /v >C:\boot.txt /c
    >C:\commands.txt echo list vol /raw /hide /c
    /wait
    >C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
    /wait
    type c:\diskreport.txt /c
    /wait
    erase c:\commands.txt /hide /c
    /wait
    erase c:\diskreport.txt /hide /c
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    consrv.dll
    services.exe
    explorer.exe
    lsass.exe
    svchost.exe
    wininit.exe
    winlogon.exe
    userinit.exe
    imapi.sys
    fastfat.sys
    atapi.sys
    iaStor.sys
    serial.sys
    volsnap.sys
    disk.sys
    redbook.sys
    i8042prt.sys
    afd.sys
    netbt.sys
    csc.sys
    tcpip.sys
    kbdclass.sys
    kbdhid.sys
    mouclass.sys
    mouhid.sys
    spldr.sys
    dfsc.sys
    hlp.dat
    str.sys
    CREXVX.OCX
    crexv.ocx
    msseedir.dll
    msdr.dll
    lmbd.dll
    wsse.dll
    /md5stop
  • Push the runscanbutton.png button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

 

Regards,

Georgi


cXfZ4wS.png


#8 Elite Immanuel

Elite Immanuel
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 23 September 2013 - 02:32 PM

First of all thanks for the reply. But its almost 1 am now in my country timeline. So i will just download the files u showed and post the log tmrw.
At which time u can b available tmrw?

#9 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:11:41 PM

Posted 23 September 2013 - 02:38 PM

Hi,

 

It's 22:33 pm here so we definetely have different timezone. No worries - I am not non stop online due to my personal obligations but I'll check the topic several time a day and will respond as fast as possible.

Regarding the MCShield 2 log you have worm.Gamarue and we should be able to remove it. :)

 

Good night!

 

Regards,

Georgi


cXfZ4wS.png


#10 Elite Immanuel

Elite Immanuel
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 23 September 2013 - 02:44 PM

Thanks n gud night keep up the noble work.
Feeling alot sleepy.

#11 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:11:41 PM

Posted 23 September 2013 - 02:53 PM

Will catch you tomorrow then. ;)

Sleep well - I might follow your example since I'm very tired and I might fall asleep while typing. :P

 

One note: We disabled Autorun but it's advisable to not plug the infected flash drives to another computers until they are completely clean.

 

 

 

Regards,

Georgi


cXfZ4wS.png


#12 Elite Immanuel

Elite Immanuel
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 24 September 2013 - 07:15 AM

This is the Extra log file:

Attached Files



#13 Elite Immanuel

Elite Immanuel
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 24 September 2013 - 07:38 AM

This is the OLT log file in rar format as it took lots of time to paste or upload the original text file(6.20 mb). And eventualy upload failed.

So uploading in rar format after renaming it to .txt format, change it from .txt to .rar file.

Awaiting ur reply. :clapping: 

Attached Files



#14 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:11:41 PM

Posted 24 September 2013 - 05:45 PM

Hi,

 

The log was kinda strange - I realized that I gave you scan search pattern instructions for Windows 7 and you have Windows XP but however the output log (especially the file path was kinda strange). Anyway - I found the little bugger:

 

 

 

We need to run an OTL Fix


 

  • Please reopen otlDesktopIcon.png on your desktop.
  • Copy and Paste the following code into the customFix.png textbox. Do not include the word "Code"

    :OTL
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 11182 = C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\cctriokai.cmd (House)
    :commands
    [emptytemp]
  • Push runFixbutton.png
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click btnOK.png.
  • A report will open. Copy and Paste that report in your next reply.
  • If a report is not shown please navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present.
  • Copy/paste the content of the log back here in your next post.

 

 

Regards,

Georgi


cXfZ4wS.png


#15 Elite Immanuel

Elite Immanuel
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:11 AM

Posted 24 September 2013 - 10:59 PM

This is the log file:

All processes killed
========== OTL ==========
Registry value Invalid\\\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 111557 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170
bytes
User: Immanuel Vaiphei
->Temp folder emptied: 16426475 bytes
->Temporary Internet Files folder emptied:
4661717 bytes
->FireFox cache emptied: 20248262 bytes
->Flash cache emptied: 663 bytes
User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170
bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170
bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2142714
bytes
%systemroot%\System32 .tmp files removed:
2577 bytes
%systemroot%\System32\dllcache .tmp files
removed: 0 bytes
%systemroot%\System32\drivers .tmp files
removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile
\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile
\Local Settings\Temporary Internet Files folder
emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 42.00 mb
OTL by OldTimer - Version 3.2.69.0 log created
on 09252013_090721
Files\Folders moved on Reboot...
C:\Documents and Settings\All Users\Local
Settings\Temp\cctriokai.cmd moved
successfully.
C:\WINDOWS\temp\_avast_\Webshlock.txt
moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...

Now the usb drive is not showing any problem.
Is the problem solved now?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users