Komodia Rootkit - Desktop blank - Group Policy infected

Hello!  Until recently I've been able to combat any and all infections I've gotten but this one is on another level!!  I have ran every piece of anti-walware out there but haven't been able to get back to 100%.  I'm now not able to have a desktop when the computer loads, just a black screen which I can only enable by CTRL+ALT+DLT, run task manager, file-> run-> explorer.exe.  This reloads my desktop, but the virus has added group policies which disable me as an admin.  I also see a wsdscript.exe that is running in the background which I cannot get rid of because of the group policy (same with windows defender).  Any help would be much appreciated    Below is my FRST64 log, and the 'addition' file that appeared when I ran the scan.

 

 FRST.txt   63.9KB   6 downloads  Addition.txt   73.37KB   5 downloads

 

Edited by xXToffeeXx, 08 April 2016 - 12:05 PM.

Hi Ronins8,
 
We need to run a fix with FRST:

• Press the windows key + r on your keyboard at the same time. Type in notepad and press Enter.
• Copy and paste the script below in the notepad document:​

HKLM-x32\...\Run: [win_en_77] => [X]
HKLM-x32\...\Run: [Rt562@] => C:\WINDOWS\Disable  task manager .bat
C:\WINDOWS\Disable  task manager .bat
HKLM-x32\...\Run: [QwaT] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [Rty01] => C:\WINDOWS\call.vbs
C:\WINDOWS\call.vbs
HKLM-x32\...\Run: [TV] => C:\WINDOWS\TV
C:\WINDOWS\TV
HKLM-x32\...\Run: [QwaT78] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [QwaT21] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [Rt45] => C:\WINDOWS\auto explore.bat
C:\WINDOWS\auto explore.bat
HKLM-x32\...\Run: [QwaT55] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [QwaT22] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [QwaTgg] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [QwaT5] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [QwaT4] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [QwaT1] => C:\Documents and Settings\All Users\Start Menu\Programs\Startup\bsod.hta
HKLM-x32\...\Run: [BSOD] => C:\WINDOWS\bsod.hta
C:\WINDOWS\bsod.hta
HKLM-x32\...\Run: [rst] => C:\WINDOWS\rst.bat
C:\WINDOWS\rst.bat
HKLM-x32\...\RunOnce: [DeleteOnReboot] => C:\Users\RoNiN\AppData\Local\Temp\DeleteOnReboot.bat [134 2016-04-07] () <===== ATTENTION
C:\Users\RoNiN\AppData\Local\Temp\DeleteOnReboot.bat
HKLM\...\Winlogon: [Userinit] wscript,
HKU\S-1-5-21-470165136-1162808608-978993673-1001\...\Run: [wdbext] => rundll32.exe "C:\Users\RoNiN\AppData\Local\wdbext.dll",wdbext <===== ATTENTION
C:\Users\RoNiN\AppData\Local\wdbext.dll
AppInit_DLLs: C:\ProgramData\AppxikenoZ\Volity.dll => No File
C:\ProgramData\AppxikenoZ
AppInit_DLLs-x32: C:\ProgramData\AppxikenoZ\Goldenphase.dll => No File
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicyScripts-x32\User: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-470165136-1162808608-978993673-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {A2516833-3348-406A-96A6-26AAA93BF9DE} URL = 
SearchScopes: HKU\S-1-5-21-470165136-1162808608-978993673-1001 -> {A2516833-3348-406A-96A6-26AAA93BF9DE} URL = 
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
S4 kBTNrls; "C:\ProgramData\QsKNKvQ\kBTNrls.exe" [X]
S4 Muibguaw; "C:\Users\RoNiN\AppData\Roaming\JiahiMhwodn\Tugboxh.exe" -cms [X]
S4 Nijgatfy; "C:\Users\RoNiN\AppData\Roaming\Kalekuhrin\Kalekuhrin.exe" -cms [X]
C:\ProgramData\QsKNKvQ
C:\Users\RoNiN\AppData\Roaming\JiahiMhwodn
C:\Users\RoNiN\AppData\Roaming\Kalekuhrin
2016-03-13 19:52 - 2016-03-13 19:52 - 00000000 ____D C:\WINDOWS\system32\nod
2016-03-13 19:48 - 2016-03-13 19:48 - 00000000 ____D C:\WINDOWS\system32\aro
2016-03-13 19:38 - 2016-03-13 19:38 - 00000000 ____D C:\Users\RoNiN\AppData\Roaming\c
2016-03-13 19:38 - 2016-03-13 19:38 - 00000000 ____D C:\ProgramData\1457912307
2016-03-13 19:24 - 2016-03-13 19:47 - 06000640 _____ C:\Program Files (x86)\GUTD8C6.tmp
2016-03-13 19:24 - 2016-03-13 19:24 - 00000000 ____D C:\Program Files (x86)\GUMD7DA.tmp
2016-03-13 18:44 - 2016-03-13 18:44 - 00000000 ____D C:\WINDOWS\system32\keja
2016-03-13 18:44 - 2016-03-13 18:44 - 00000000 ____D C:\WINDOWS\system32\byeq
2016-03-13 14:35 - 2016-03-25 14:59 - 00000000 ____D C:\Users\RoNiN\AppData\Roaming\Vilvuk
2016-03-13 14:35 - 2016-03-22 23:42 - 00000000 ____D C:\Users\RoNiN\AppData\Roaming\MirhMevf
2016-03-11 19:32 - 2016-03-25 14:59 - 00000000 ____D C:\Users\RoNiN\AppData\Roaming\Kalekuhrin
Task: {FAC6784A-CB17-4B4D-BDC7-4A4F34BACBE2} - System32\Tasks\{08080F47-0D0F-0F09-7D11-7A79790B110F} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand OwA7ACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFAA (the data entry has 9540 more characters).

• Save the file to your desktop and name it as fixlist.txt

Note: It's important that both files, FRST.exe/FRST64.exe and fixlist.txt are in the same location or the fix will not work
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• Run FRST.exe/FRST64.exe and press the Fix button just once and wait
• If for some reason the tool needs a restart, please make sure you let the system restart normally, then let the tool complete its run
• When finished, FRST will generate a log (Fixlog.txt) in the same location the tool was run.
• Please copy and paste the log in your next reply.

xXToffeeXx~

Toffee- 

Thanks so much for your quick reply!  Below is a paste of the fixlog.txt, and it did have me restart.  When it restarted the desktop came up this time     I'm still getting 'This app is turned off by group policy' when trying to activate windows defender, or edit/remove certain files.  It appears to have made a group 'TrustedInstaller' that has all the rights and my own user (previously an admin) now only has rights to read-only.

 

Hi Ronins8,
 
We will get to that in time, once the computer is clean
 
Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• The tool will start to update the database, please wait a bit.
• Click on I agree button.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

xXToffeeXx~

Hi Toffee!

Here is the log from adwcleaner.  Just to note I didn't hit the 'clean' button after the scan.

 

Thanks,

RoNiN

 

 

 

Edited by Ronins8, 08 April 2016 - 10:37 PM.

Hi Ronins8,
 
Double click on AdwCleaner.exe to run the tool again.

• The tool will start to update the database, please wait a bit.
• Click on the Scan button.
• AdwCleaner will begin to scan your computer like it did before.
• After the scan has finished.
• This time click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

--------------

Please re-run FRST, put a check into the box next to Addition.txt and press the scan button. It will produce FRST.txt and Addition.txt logs located on the desktop. Please copy and paste the logs into your next reply.
 
xXToffeeXx~

Thanks again Toffee! Here are the 3 logs - 

 

 

Hello,

Toffee is not available, so I will help you...
 

***

Copy FRST / FSRT64.exe to your desktop!

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
Save it in the same location as / FSRT / FSRT64 (usually your desktop) as fixlist.txt

start
CreateRestorePoint:
CloseProcesses:
GroupPolicyScripts-x32\User: Restriction <======= ATTENTION
SearchScopes: HKLM -> OldSearch URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAMI&src=IE-SearchBox 
SearchScopes: HKLM-x32 -> {DF74C2BD-9885-45D2-AC3E-F2865A90DEAB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAMI&src=IE-SearchBox 
SearchScopes: HKU\S-1-5-21-470165136-1162808608-978993673-1001 -> {0F462454-2A7D-48CE-B2B5-ECD4B55B6026} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1 
SearchScopes: HKU\S-1-5-21-470165136-1162808608-978993673-1001 -> {C9D867C8-1E65-4F71-970A-C677CAECFCC3} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default 
SearchScopes: HKU\S-1-5-21-470165136-1162808608-978993673-1001 -> {DF74C2BD-9885-45D2-AC3E-F2865A90DEAB} URL = 
U3 idsvc; no ImagePath 
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] 
U3 wpcsvc; no ImagePath
C:\ProgramData\WceNM3o.dat 
C:\Users\RoNiN\autoplaylist.dat 
C:\Users\RoNiN\cddbcontrol.dll 
C:\Users\RoNiN\cddblink.dll 
C:\Users\RoNiN\cddbmusicid.dll 
C:\Users\RoNiN\convert.exe 
C:\Users\RoNiN\dbghelp.dll 
C:\Users\RoNiN\dunzip32.dll 
C:\Users\RoNiN\fixrjb.exe 
C:\Users\RoNiN\hxaudiodevicehook.dll 
C:\Users\RoNiN\ierjplug.dll 
C:\Users\RoNiN\keys.dat 
C:\Users\RoNiN\mc_enc_h263.dll 
C:\Users\RoNiN\mediainfo.dll 
C:\Users\RoNiN\mmcdda32.dll 
C:\Users\RoNiN\rdsf3260.dll 
C:\Users\RoNiN\realcleaner.exe 
C:\Users\RoNiN\realconverter.exe 
C:\Users\RoNiN\realjbox.exe 
C:\Users\RoNiN\realplay.exe 
C:\Users\RoNiN\realshare.exe 
C:\Users\RoNiN\realtrimmer.exe 
C:\Users\RoNiN\rjbres.dll 
C:\Users\RoNiN\rjdlg.dll 
C:\Users\RoNiN\rjprog.dll 
C:\Users\RoNiN\rjwmapln.dll 
C:\Users\RoNiN\rndevicedbbuilder.exe 
C:\Users\RoNiN\rpau3260.dll 
C:\Users\RoNiN\rphelperapp.exe 
C:\Users\RoNiN\rpplugprot.dll 
C:\Users\RoNiN\rpshell.dll 
C:\Users\RoNiN\rpshellextension.dll 
C:\Users\RoNiN\rpshellsearch.dll 
C:\Users\RoNiN\rpwa3260.dll 
C:\Users\RoNiN\strs23.dat 
C:\Users\RoNiN\strs26.dat 
C:\Users\RoNiN\tnetdtct.dll 
C:\Users\RoNiN\tpasdk.dll 
C:\Users\RoNiN\tsasdk.dll 
C:\Users\RoNiN\wmdmhelper.dll
C:\Users\RoNiN\AppData\Local\Temp\392590059.exe 
C:\Users\RoNiN\AppData\Local\Temp\523578965.exe 
C:\Users\RoNiN\AppData\Local\Temp\ARCompanionForSession1.exe 
C:\Users\RoNiN\AppData\Local\Temp\dsHostCheckerSetup.exe 
C:\Users\RoNiN\AppData\Local\Temp\Execute2App.exe 
C:\Users\RoNiN\AppData\Local\Temp\File_Downloader.exe 
C:\Users\RoNiN\AppData\Local\Temp\i4jdel0.exe 
C:\Users\RoNiN\AppData\Local\Temp\io1.exe 
C:\Users\RoNiN\AppData\Local\Temp\jre-8u73-windows-au.exe 
C:\Users\RoNiN\AppData\Local\Temp\JuniperSetupClientInstaller.exe 
C:\Users\RoNiN\AppData\Local\Temp\libeay32.dll 
C:\Users\RoNiN\AppData\Local\Temp\lowproc.exe 
C:\Users\RoNiN\AppData\Local\Temp\msvcp90.dll 
C:\Users\RoNiN\AppData\Local\Temp\msvcr120.dll 
C:\Users\RoNiN\AppData\Local\Temp\msvcr90.dll 
C:\Users\RoNiN\AppData\Local\Temp\sqlite3.dll 
C:\Users\RoNiN\AppData\Local\Temp\stubhelper.dll
Task: {102A620C-F30C-4549-9641-182161BCECEB} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION 
Task: {1BAAE6FE-C34D-4631-9BB2-16D444231725} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION 
Task: {323B5AD8-0CF3-498F-B85C-6889DE79CF89} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION 
Task: {431A8418-553F-414C-B938-84B7D6C11432} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION 
Task: {564B49C2-B6F5-4F1E-97F5-C10111DA8EE4} - \{99331EF5-343D-47FD-B006-40F37A0D5E9D} -> No File <==== ATTENTION 
Task: {5AE1ACA2-BEE0-4554-BD58-6D5A059FC8AD} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION 
Task: {5AF597F4-43A4-4292-9389-1D19188D828F} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION 
Task: {5B6A393D-57E5-4198-BD7E-00E0B9EF3F77} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION 
Task: {5BD1D165-089F-40BA-8D52-B90C85B1BB0D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION 
Task: {6D890055-866E-4872-979D-B8AB3884F1DC} - System32\Tasks\WMMAWVKOLXONAOYC => C:\ProgramData\Service1291\Service1291.exe <==== ATTENTION 
Task: {874B492C-C094-4938-A93E-0F5141822989} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION 
Task: {BE0F7D0B-3323-406F-AAEF-1A12388A1C9C} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION 
Task: {D3ACB7DB-7815-42A9-A39F-8D89E1EDF573} - System32\Tasks\Pritc => C:\Users\RoNiN\AppData\Local\Temp\is-TIN56.tmp\print.exe <==== ATTENTION 
Task: {D92D97F2-2EDF-4800-82E5-E726F16D0395} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION 
Task: {E86953B2-7A47-4920-B975-308AAEEA66E9} - System32\Tasks\BJZJKCUBLH1 => C:\ProgramData\FlashBeat\FlashBeat.exe <==== ATTENTION 
Task: {FC48FBF3-30B8-44A9-9A0B-C568A2FC47CD} - \LuckyTab -> No File <==== ATTENTION 
Task: C:\WINDOWS\Tasks\BJZJKCUBLH1.job => C:\ProgramData\FlashBeat\FlashBeat.exe <==== ATTENTION 
Task: C:\WINDOWS\Tasks\WMMAWVKOLXONAOYC.job => C:\ProgramData\Service1291\Service1291.exe <==== ATTENTION
C:\ProgramData\Service1291
EmptyTemp:
end

NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system

Run FRST / FSRT64 again like we did before but this time press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

***

FRST / FSRT64: run it again.

• Right-click FRST / FSRT64 then click "Run as administrator" (XP users: click run after receipt of Windows Security Warning - Open File).
• When the tool opens, click Yes to disclaimer.
• Put a check into the box next to Addition.txt and
  press the Scan button.
• When finished, it will produce a log called FRST.txt in the same directory the tool was run from.
• Please copy and paste the log in your next reply.

***

Please download Malwarebytes Anti-Rootkit and save it to your desktop.

• Be sure to print out and follow the instructions provided on that same page.
• Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
• Double click on downloaded file. OK self extracting prompt.
• MBAR will start. Click in the introduction screen "next" to continue.
• Click in the following screen "Update" to obtain the latest malware definitions.
• Once the update is complete select "Next" and click "Scan".

With some infections, you may see two messages boxes.

• 'Could not load protection driver'. Click 'OK'.
• 'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

• If malware is found - do not press the Clean up button, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
• If there is no malware found, please let me know as well.

Hi Jo!  Thanks for your help.  I have placed all the logs below.  When I ran the mbar scan it came back that no malware was found

 

 

Going over your logs I noticed that you have p2p program BitTorrent installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
• They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall p2p program BitTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.
If you wish to keep it, please do not use it until your computer is cleaned.

---

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
Save it in the same location as / FSRT / FSRT64 (usually your desktop) as fixlist.txt
 

start
CreateRestorePoint:
CloseProcesses:
S3 MFE_RR; \??\C:\Users\RoNiN\AppData\Local\Temp\mfe_rr.sys [X]
2016-03-11 19:25 - 2016-04-09 16:22 - 00000368 ____H C:\WINDOWS\Tasks\WMMAWVKOLXONAOYC.job 
2016-03-11 19:25 - 2016-04-09 16:22 - 00000356 _____ C:\WINDOWS\Tasks\BJZJKCUBLH1.job 
2016-03-11 19:25 - 2016-03-11 19:25 - 00003444 _____ C:\WINDOWS\System32\Tasks\WMMAWVKOLXONAOYC 
2016-03-11 19:25 - 2016-03-11 19:25 - 00002928 _____ C:\WINDOWS\System32\Tasks\BJZJKCUBLH1
Task: {369CA7CD-5C89-4F7B-834D-8F15564BB1DC} - System32\Tasks\Rocfokt => C:\PROGRA~1\SHOPPE~1\Balditii.bat 
C:\PROGRA~1\SHOPPE~1
Task: {AF19F91F-CBDD-4187-8FA0-9B762E84BFB5} - System32\Tasks\Lhsorj => C:\PROGRA~1\GROOVE~1\Jascusjh.bat
AlternateDataStreams: C:\Users\RoNiN\Desktop\Natephotobomb.jpg:SummaryInformation [0] 
AlternateDataStreams: C:\Users\RoNiN\Desktop\Natephotobomb.jpg:Updt_SummaryInformation [151] 
AlternateDataStreams: C:\Users\RoNiN\Desktop\Natephotobomb.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0] 
AlternateDataStreams: C:\Users\RoNiN\Downloads\BBKings Everclear.png:SummaryInformation [0] 
AlternateDataStreams: C:\Users\RoNiN\Downloads\BBKings Everclear.png:Updt_SummaryInformation [151] 
AlternateDataStreams: C:\Users\RoNiN\Downloads\BBKings Everclear.png:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0] 
AlternateDataStreams: C:\Users\RoNiN\Downloads\wddrnote.gif:SummaryInformation [151] 
AlternateDataStreams: C:\Users\RoNiN\Downloads\wddrnote.gif:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0] 
AlternateDataStreams: C:\Users\RoNiN\Downloads\wdid.gif:SummaryInformation [151] 
AlternateDataStreams: C:\Users\RoNiN\Downloads\wdid.gif:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0] 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File 
CustomCLSID: HKU\S-1-5-21-470165136-1162808608-978993673-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\RoNiN\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll => No File

EmptyTemp:
end

NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system

Run FRST / FSRT64 again like we did before but this time press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

---

Run Malwarebytes Anti-Rootkit again: Right-click mbar.exe and select Run As Administrator

• Scan your system for malware
• If malware is found, click on the Cleanup
• button to remove any threats and reboot if prompted to do so.

• Wait while the system shuts down and the cleanup process is performed.
• then please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
• If there is no malware found, please let me know as well.

***

Double click on AdwCleaner.exe to run the tool again.
Vista / Windows 7/8 users right-click and select Run As Administrator.

• Click on the Scan button.
• AdwCleaner will begin to scan your computer like it did before.
• When the scan has finished, the actual line should say "Pending. Please uncheck elements you do not want to remove". Look through the scan results and uncheck any entries that you do not wish to remove.
• This time, click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[C#].txt) will open automatically (where the largest value of # represents the most recent report).
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

***

Please download Junkware Removal Tool from HERE and save it to your desktop.
Shutdown your antivirus to avoid any potential conflicts.
Double click JRT.exe to run the tool.
Vista / Windows 7/8 users right-click and select Run As Administrator.

• JRT will begin to backup your registry and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, the log JRT.txt is saved on your desktop and will automatically open.

Enable your antivirus!
Post the contents of JRT.txt into your next reply.

***

How the computer is running now?

Download and run Chrome Software Cleaner

---

Why do you think you have Komodia Rootkit?

Did you uninstall Emsisoft Anti-Malware?

Your logs show 4 user profiles: Which of these user accounts did you create?
Available Profiles:
- RoNiN
- postgres
- DefaultAppPool
- Mcx1-RONIN-LAPTOP

Which user accounts can you see in the User Accounts control panel?

---

Log on to all your user accounts now - without restarting !

FRST / FSRT64: run it again.

• Right-click FRST / FSRT64 then click "Run as administrator" (XP users: click run after receipt of Windows Security Warning - Open File).
• When the tool opens, click Yes to disclaimer.
• Put a check into the box next to Addition.txt and press the Scan button.
• When finished, it will produce logs called FRST.txt and Addition.txt in the same directory the tool was run from.
• Please copy and paste both logs in your next reply.

---

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  Vista / Windows 7/8 users right-click and select Run As Administrator.

• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Edited by Jo*, 16 April 2016 - 04:53 PM.

Hi Jo,

 

1) I thought it was Komodia because originally malwarebytes and a few others were reporting it on my pc but after each clean it would remain there. komodia rootkit

2) Yes I had uninstalled as my system resources kept running low and I was getting warnings

3) RoNiN is the account I created

4)I only see 1 user account in my profile - RONIN-LAPTOP/RoNiN

5)

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
Save it in the same location as / FSRT / FSRT64 (usually your desktop) as fixlist.txt

 

Start
CreateRestorePoint:
CloseProcesses:
CHR DefaultSearchURL: Default -> hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=Unknown
CHR DefaultSearchKeyword: Default -> www-searching.com
CHR DefaultSuggestURL: Default -> hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
CHR HKLM-x32\...\Chrome\Extension: [gihfmmedoddijgnhkgfgnkeohkpbipol] - hxxps://clients2.google.com/service/update2/crx
AlternateDataStreams: C:\Users\RoNiN\Desktop\Natephotobomb.jpg:SummaryInformation [0]
AlternateDataStreams: C:\Users\RoNiN\Desktop\Natephotobomb.jpg:Updt_SummaryInformation [151]
AlternateDataStreams: C:\Users\RoNiN\Downloads\BBKings Everclear.png:SummaryInformation [0]
AlternateDataStreams: C:\Users\RoNiN\Downloads\BBKings Everclear.png:Updt_SummaryInformation [151]
AlternateDataStreams: C:\Users\RoNiN\Downloads\wddrnote.gif:SummaryInformation [151]
AlternateDataStreams: C:\Users\RoNiN\Downloads\wdid.gif:SummaryInformation [151]
HKLM\...\StartupApproved\StartupFolder: => "bsod.hta"
CMD: type C:\TDSSKiller.3.1.0.9_07.04.2016_15.05.40_log.txt
EmptyTemp:
Hosts:
End

NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system

Run FRST / FSRT64 again like we did before but this time press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

---

Download and run Chrome Software Cleaner

---

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 5 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7/8/10 users need to right click and choose Run as Administrator
You only need to get one of them to run, not all of them.

• rkill.exe
• rkill.com
• rkill.scr
• WiNlOgOn.exe
• uSeRiNiT.exe

Do not reboot your computer after running rkill as the malware programs will start again.

---

Malwarebytes' Anti-Malware
If this program is already installed: Skip the installation and run only the scan!
Download and install: Please download Malwarebytes Anti-Malware to your desktop.

• Double-click mb3-setup-1878.1878-3.5.1.2522.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to the following:
  • Launch Malwarebytes Anti-Malware
  • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
• Click Finish.
• On the Dashboard, click the 'Update Now >>' link
• After the update completes, click the 'Scan Now >>' button.
• Or, on the Dashboard, click the Scan Now >> button.
• If an update is available, click the Update Now button.
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
• In most cases, a restart will be required.
• Wait for the prompt to restart the computer to appear, then click on Yes.

How to get logs: (Export log to save as txt)

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click 'Export'.
• Click 'Text file (*.txt)'
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named 'File Saved' should appear stating "Your file has been successfully exported".
• Click Ok
• Attach that saved log to your next reply.

(Copy to clipboard for pasting into forum replies or tickets)

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click 'Copy to Clipboard'
• Paste the contents of the clipboard into your reply.

---

Try LastPass Superfish Checker

Check the certificates:

• Click the Windows Start button
• Type certmgr.msc into the Search box
• Click the certmgr.msc Program to launch it
• If prompted for administrator password, enter the password or provide confirmation
• Click on Trusted Root Certification Authorities
• Open Certificates
• Look for certificates mentioning Superfish Inc.
• Right-click on any Superfish Inc certificates and delete
• Restart your browser

Firefox & Thunderbird Users:

• Open Firefox
• Click the menu in the top right and select "Options" or open the Tools menu > Options
• Click the Advanced tab
• Click "View Certificates"
• Scroll through until you see Superfish Inc
• Click the Superfish, Inc - Software Security Device option
• Press "Delete or Distrust"
• Confirm it shows "Superfish Inc" and press OK

Did you find certificates mentioning Superfish Inc.?

---

Edited by Jo*, 01 May 2016 - 02:58 AM.

Hi,

it has been several days since I sent my last set of instructions to help with your computer problem.

Please let me know if you are having problems and still need help.

Note: Thread will be closed if no response after 3 days.