Help With Rootkit Removal?

Derek February 10, 2015 at 14:07:23

While you are waiting for further attention download, save and run the file from here: http://www.bleepingcomputer.com/dow... (blue download button top right) Scan then run "Cleaning". Save all logs because they are likely to be required Always pop back and let us know the outcome - thanks

Mmai February 10, 2015 at 14:48:10

Downloaded and ran AdwCleaner. Log: https://www.dropbox.com/s/vbw23zq0x...

Johnw February 10, 2015 at 14:50:37

"Those that did, didn't seem to help fix them" Copy & Paste the contents of those that did logs, in your reply please. Ditto for the AdwCleaner log.

Mmai February 10, 2015 at 15:58:07

AdwCleaner Log: https://www.dropbox.com/s/vbw23zq0x... TDDSKiller Log: https://www.dropbox.com/s/qeyiq672j... ComboFix Log: https://www.dropbox.com/s/i98itwn5z... ESET Log: https://www.dropbox.com/s/6rqxgosci... aswMBR also found a rootkit, but I can't find the log for it.

Johnw February 10, 2015 at 16:02:09

Thanks. Step 2: Run Junkware Removal Tool http://www.softpedia.com/get/Securi... http://www.bleepingcomputer.com/dow... http://thisisudax.blogspot.com.au/2... Download Junkware Removal Tool onto your Desktop. If your default download location is not the Desktop, drag it out of it's location onto the Desktop. Warning! Once the scan is complete JRT will shut down your browser with NO warning. Shut down your protection software now to avoid potential conflicts. Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them. http://www.bleepingcomputer.com/for... http://www.techsupportforum.com/for... Run the tool by double-clicking it. If you are using Windows Vista or Windows 7/8, right-click JRT and select Run as Administrator. The tool will open and start scanning your system. Please be patient as this can take a while to complete depending on your system's specifications. On completion, a log (JRT.txt) is saved onto your Desktop and will automatically open. Copy and Paste the contents of the JRT.txt log please.

Mmai February 10, 2015 at 16:18:25

JRT.txt Log: https://www.dropbox.com/s/58j0hogs5... message edited by Mmai

Johnw February 10, 2015 at 16:22:13

Please download Farbar Recovery Scan Tool and save it onto your Desktop. If your default download location is not the Desktop, drag it out of it's location onto the Desktop. http://www.bleepingcomputer.com/dow... If we have to run Farbar more than once, refer this SS. http://i.imgur.com/yUxNw0j.gif Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) on the Desktop. The first time the tool is run, it makes also another log (Addition.txt). The logs are large, upload them please.

Mmai February 10, 2015 at 16:29:24

Farbar Logs: Addition.txt - https://www.dropbox.com/s/htw5reu67... FRST.txt - https://www.dropbox.com/s/tdgq3nvfc...

Johnw February 10, 2015 at 16:37:56

Need about 3/4 of an hour, back ASAP.

Johnw February 10, 2015 at 16:40:10

In the meantime, can you run aswMBR again please. Post the log.

Mmai February 10, 2015 at 16:57:30

aswMBR Log: https://www.dropbox.com/s/iqqy2f0t7...

Johnw February 10, 2015 at 17:18:02

Copy & Paste the text below ( starting closeprocesses: ), save it into Notepad on your Desktop & name it fixlist.txt NOTE: It is important that Notepad is used. The fix will not work if Word or some other program is used. NOTE: It is important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system. closeprocesses: emptytemp: HKU\S-1-5-21-44363915-1807462207-3784643384-1000\Software\Classes\exefile: <===== ATTENTION! ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File HKU\S-1-5-21-44363915-1807462207-3784643384-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-44363915-1807462207-3784643384-1000 -> {50206772-A040-47C3-9804-463D87F21289} URL = FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File CHR HomePage: Default -> hxxp://www.bing.com/ CHR StartupUrls: Default -> "hxxp://www.google.com/", "hxxp://www.bing.com/", "hxxp://myschool.pacyber.org/" S0 is3srv; SySWOW64\drivers\is3srv64.sys [X] U3 aswMBR; \??\C:\Users\PACYBE~1\AppData\Local\Temp\aswMBR.sys [X] U3 aswVmm; \??\C:\Users\PACYBE~1\AppData\Local\Temp\aswVmm.sys [X] C:\Users\PA CYBER\AppData\Local\Temp\dllnt_dump.dll C:\Users\PA CYBER\AppData\Local\Temp\Quarantine.exe C:\Users\PA CYBER\AppData\Local\Temp\sqlite3.dll Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that, let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please Copy & Paste the contents into your reply.

Mmai February 10, 2015 at 17:29:49

FRST Fixlog: https://www.dropbox.com/s/d22i96f6f...

Johnw February 10, 2015 at 17:33:23

Run Malwarebytes again please. Post the log. Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box to Scan for rootkits. http://i.imgur.com/dZgt1g2.gif If potential threats are detected, ensure that Quarantine is selected as the Action for all the listed items, and click the Apply Actions button. If your MBAM log indicates "No action taken". That's usually a result of NOT clicking the Apply Actions button after the scan. In most cases, a restart will be required. From the aswMBR log. 19:48:49.622 File: C:\windows\system32\autochk.exe **INFECTED** Win32:Rootkit-gen [Rtk] False positive. http://www.freefixer.com/library/fi... 19:49:19.137 File: C:\windows\system32\rpcnetp.exe **SUSPICIOUS** Probably a false positive, run VirusTotalScanner on it. http://www.softpedia.com/get/Securi... http://securityxploded.com/virus-to...

Mmai February 10, 2015 at 17:49:29

Malwarebytes Log: https://www.dropbox.com/s/fsur4id28...

Johnw February 10, 2015 at 17:52:02

"The free space on my disk drive is currently 8.51 GB out of 97.3 GB" Delete files using Disk Cleanup http://windows.microsoft.com/en-au/... With the browsers you use, set the Temp files setting to 50mb. Java in Control Panel, set that to 100mb for temps. System Restore, make sure that is set on Min.

Mmai February 10, 2015 at 18:17:41

I used Disk Cleanup, set System Restore to minimum, and changed Java to 100mb for temporary files. I wasn't sure how to change the temp file settings for Chrome. I now have 18.8 GB free out of 97.3 GB. This is without any documents of any kind being on my computer, so I'm wondering what's still taking up all the space?

Johnw February 10, 2015 at 18:23:21

We shall find out soon where your space is going. Run Wise Disk Cleaner ( Run the 1st three tabs, left to right. I use default settings, leave boxes that are unchecked, unchecked ) Reboot when finished. http://www.softpedia.com/get/System... http://www.freewarefiles.com/Wise-D... http://www.freewarefiles.com/screen... http://www.wisecleaner.com/download... http://i.imgur.com/Jecnfvb.gif http://i.imgur.com/0xHwdom.gif http://i.imgur.com/JZLYOLf.gif http://i.imgur.com/4kfaeGW.gif

Johnw February 10, 2015 at 18:31:08

How to set Google Chrome cache to 50mb max temporary files. With comps, there is always more than one way to do things, try this way. Right click on the Google Chrome shortcut > Properties. Copy & Paste this below after .exe" as per SS ( Screenshot ) NOTE: There is a space after .exe" http://i.imgur.com/vgkU3X1.gif --disk-cache-size=50000" Click > Apply & then OK.

Derek February 10, 2015 at 18:34:55

When you ran disk cleanup did you use the Cleanup System Files button? Always pop back and let us know the outcome - thanks message edited by Derek

Mmai February 10, 2015 at 18:45:27

I ran the 1st 3 tabs in Wise Disk Cleaner and rebooted. Then pasted " --disk-cache-size=50000" in Chrome's properties. I opened Disk Cleanup, selected Windows7_OS (C:), clicked OK. I checked the boxes beside Downloaded Program Files, Temporary Internet Files, Recycle Bin, and Temporary files. Selected OK, then Delete Files.

Johnw February 10, 2015 at 18:48:02

"so I'm wondering what's still taking up all the space?" TreeSize Free http://www.softpedia.com/get/System... http://www.freewarefiles.com/TreeSi... http://www.freewarefiles.com/screen... http://www.jam-software.com/freewar...

Mmai February 10, 2015 at 20:12:59

According to TreeSize, there is only 36.7 GB used on C:. That's still about 55 GB of space unaccounted for? Screenshot: https://www.dropbox.com/s/wnuy9fwaz...

Johnw February 10, 2015 at 20:24:40

Can I have a SS ( screenshot ) of everything that shows in Wise. Wise Program Uninstaller http://www.softpedia.com/get/Tweak/... http://www.freewarefiles.com/Wise-P... http://www.freewarefiles.com/screen... http://wisecleaner.com/wiseuninstal...

Mmai February 10, 2015 at 20:37:09

Wise Program Uninstaller Screenshots: 1: https://www.dropbox.com/s/2z9xx4688... 2: https://www.dropbox.com/s/hddihoqif... 3: https://www.dropbox.com/s/m1bl5h6rj... 4: https://www.dropbox.com/s/7wxhabner... 5: https://www.dropbox.com/s/pbnxw0wls... 6: https://www.dropbox.com/s/8fbie6aby...

Johnw February 10, 2015 at 20:48:21

Whilst I remember, just in case more SS's are needed, when you save, change the setting to GIF, quality is Ok & a fraction of the size.

Mmai February 10, 2015 at 20:49:27

Will do, thanks for letting me know.

Johnw February 10, 2015 at 20:57:42

Are you using the Apple stuff & QuickTime. Your logs show iTunes, but that may be tied in with the above.

Mmai February 10, 2015 at 20:59:57

No, I'm not using them. Uninstall?

Johnw February 10, 2015 at 21:01:33

Yep, process of elimination. Use Wise, it is a 2 step process.

Mmai February 10, 2015 at 21:04:58

Alright, they've been uninstalled.

Johnw February 10, 2015 at 21:09:50

Tell me your unused space. message edited by Johnw

Mmai February 10, 2015 at 21:12:49

Rebooted, 18.4 GB free.

Johnw February 10, 2015 at 21:14:00

Uninstall Google Drive, Silverlight & Bonjour.

Mmai February 10, 2015 at 21:17:33

Uninstalled all of them. Rebooted, 18.3 GB unused space. message edited by Mmai

Johnw February 10, 2015 at 21:26:19

http://computerlearnhow.com/how-to-... Refer SS. http://i.imgur.com/NiDQ69Y.gif

Mmai February 10, 2015 at 21:35:57

Followed the instructions, made sure settings were the same as in SS. Rebooted. Still only 18.3 GB of free space.

Johnw February 10, 2015 at 21:37:52

Now to make really sure the hard drive isn't misreporting it's size. Here are some checks. 1: Physically look at the label. 2: Device Manager & give me the model of the drive. message edited by Johnw

Mmai February 10, 2015 at 21:42:20

Model of disk drive: Samsung MZ7TE128HMGR-000 SCSI Disk Device

Johnw February 10, 2015 at 21:46:05

All Ok. Time for a break for both of us. I'll be back. I'm here. http://www.timeanddate.com/worldclo...

Johnw February 10, 2015 at 21:47:35

One more thought, SS of the System page.

Mmai February 10, 2015 at 21:47:55

Misread the clock there. It's 1 am here, so I'm fine with a break. Thanks for the help so far. SS of System page: https://www.dropbox.com/s/pjdx1qru2... message edited by Mmai

Johnw February 10, 2015 at 21:59:16

Your Farbar log shows this > Partition: GPT Partition Type I reckon a different setting in the bios may get the correct reading of the drive status. But it is only a guess & you will need to google it. UEFI & Legacy are the other settings.

Johnw February 11, 2015 at 04:48:24

"Misread the clock there" Thought you must have. I haven't been able to come up with any better suggestions, shall wait to see what your researching finds. Nearly my bed time, I'm an early riser.

Derek February 11, 2015 at 06:35:13

Re #21 Disk Cleanup After you have checked the boxes and told Disk Cleanup to do its thing it should eventually show a button Cleanup System Files. You then have a chance to run it to include Windows Update setup files etc. That will remove some more unwanted items (check box screen comes up again).. Always pop back and let us know the outcome - thanks

Derek February 12, 2015 at 11:35:16

Just to add that you might not be able to do much better with that free space. About every computer I've had dealings with the free space keeps gradually reducing over time. There are several possible reasons for this (having got malware out of the way), such as Windows Updates, updates to other programs on board, videos (which are big) and even pictures and documents take up space. Go into "Control Panel > Programs and Features". See if there are any big programs that you don't really need. Other than that it is a matter of scouring the hard drive to see the large folders/files that are using space. Careful what you delete though - could cause issues. Always pop back and let us know the outcome - thanks