[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection.

sashabella
New Helpee

Posts: 21

[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 13, 2017 10:08:53 GMT -8

Post by sashabella on Feb 13, 2017 10:08:53 GMT -8

I'm running Windows 10 64bit OS. Norton has found this file & continues daily to remove it without success.
I tried downloading FRST64, and Norton tried to remove it, so i reinstalled it, and now it won't run after i've disabled my Norton. Not sure what i'm doing wrong, but i'd like to remove this malware as it's becoming a nuisance to restart my computer constantly. Any help would be greatly appreciated

Last Edit: Mar 4, 2017 21:22:42 GMT -8 by dbrisen

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 13, 2017 15:00:36 GMT -8

Post by dbrisen on Feb 13, 2017 15:00:36 GMT -8

Delete the copy of FRST you have "installed" (there is no installation of FRST; it is a self contained, stand alone file that runs as is). Then right click on the Norton icon in the Notification Bar (the one usually in the right hand corner of the desktop) and select Disable AutoProtect; select for 30 minutes. Download a fresh copy of FRST and FRST64 to your desktop and try to run them. Only one of the files will run on your system as they are specific for a 32 or a 64 bit system. The one that runs is the correct one; the other you can delete.

Last Edit: Feb 13, 2017 15:01:14 GMT -8 by dbrisen

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

sashabella New Helpee Posts: 21	[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 13, 2017 17:39:35 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by sashabella on Feb 13, 2017 17:39:35 GMT -8 The option to "disable auto protect" is grayed out on my Norton, and won't let me run this file I tried going into the settings to disable every advanced feature, but that didn't help.

sashabella New Helpee Posts: 21	[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 13, 2017 18:02:01 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by sashabella on Feb 13, 2017 18:02:01 GMT -8 FINALLY, some progress wikisend.com/download/216200/FRST.txt wikisend.com/download/648338/Addition.txt Thanks!

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 13, 2017 22:15:29 GMT -8

Post by dbrisen on Feb 13, 2017 22:15:29 GMT -8

Did you manually disable Norton or is it expired?

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

QuickTime 7

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-1238042821-2718205052-1285772492-1001\...\RunOnce: [Uninstall C:\Users\Queen Bee\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Queen Bee\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"
HKU\S-1-5-21-1238042821-2718205052-1285772492-1001\...\MountPoints2: {d80b4098-6943-11e6-8f9f-b05adad58d07} - "G:\VZW_Software_upgrade_assistant.exe"
SearchScopes: HKLM-x32 -> {EC48F92F-2186-4391-8091-5110CBFC1E2E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1238042821-2718205052-1285772492-1001 -> {EC48F92F-2186-4391-8091-5110CBFC1E2E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
S3 dbx; system32\DRIVERS\dbx.sys [X]
C:\Windows\system32\DRIVERS\dbx.sys
Task: {1543F74D-C9EB-4363-BC8C-34397B27E4FE} - \YCMServiceAgent -> No File <==== ATTENTION
Task: {611C823C-437B-46E7-9683-5312DFFCFD7B} - \Microsoft\Windows\UpdateOrchestrator\Policy Install -> No File <==== ATTENTION
Task: {7ABD412D-9A31-4D9F-BC5D-EB81697094A4} - \avast! SL Update -> No File <==== ATTENTION
Task: {848DCC36-520C-4946-BF68-C7EFFEFA2F84} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot -> No File <==== ATTENTION
Task: {884F1D3C-01DA-4560-B969-A85C51A5244A} - \DropboxOEM -> No File <==== ATTENTION
Task: {D258A394-8AA0-46DF-9F09-613901AA4AAA} - \Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon -> No File <==== ATTENTION
Task: {DB845986-AD3C-4DDD-A906-63878E32CCEC} - \Avast SecureLine -> No File <==== ATTENTION
Task: {E6010D43-6AE7-4B59-8E67-EC78FD8E8E96} - \Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler -> No File <==== ATTENTION
Task: {E75E287C-7D96-4087-B513-344F10729C87} - \Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start -> No File <==== ATTENTION
Task: {EA3F661E-B31C-44A9-B40C-E3D5D56149D4} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display -> No File <==== ATTENTION
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.priceline.com/?refid=PLHBC6240OPQ&refclickid=square
HKU\S-1-5-21-1238042821-2718205052-1285772492-1001\...\Run: [*sxpdbj<*>] => "C:\Users\Queen Bee\AppData\Local\d0a93\47bfc.dd0be4" <===== ATTENTION (Value Name with invalid characters)
C:\Users\Queen Bee\AppData\Local\d0a93
HKU\S-1-5-21-1238042821-2718205052-1285772492-1001\Software\Classes\30699: "C:\WINDOWS\system32\mshta.exe" "javascript:ZTNgw5J="9nrrubx";b2A0=new ActiveXObject("WScript.Shell");DN2HOq="462mu";WwWP3=b2A0.RegRead("HKCU\\software\\ncno\\rgwvs");TaXG5jA="7Zm7S6z5";eval(WwWP3);oTTn4g="CmS4";" <===== ATTENTION
DeleteKey: HKCU\\software\\ncno
C:\WINDOWS\SysWOW64\000*.tmp
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

THIRD >>>>

Please download Malwarebytes Anti-Rootkit from here

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt .

[/ul]

LAST >>>>

INFO TO REPLY WITH:
How is your system running now?
How did the uninstall(s) go? Any problems?
The Fixlog.txt text file (you should be able to attach this file; no need for wikisend.com usually).
The logs from MBAR - mbar-log.txt and the system-log.txt files please.
Any questions?

Last Edit: Feb 13, 2017 22:16:17 GMT -8 by dbrisen

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

sashabella
New Helpee

Posts: 21

[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 14, 2017 6:20:09 GMT -8

Post by sashabella on Feb 14, 2017 6:20:09 GMT -8

Fix result of Farbar Recovery Scan Tool (x64) Version: 14-02-2017
Ran by Queen Bee (14-02-2017 09:11:26) Run:1
Running from C:\Users\Queen Bee\Desktop
Loaded Profiles: Queen Bee (Available Profiles: Queen Bee)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-1238042821-2718205052-1285772492-1001\...\RunOnce: [Uninstall C:\Users\Queen Bee\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Queen Bee\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"
HKU\S-1-5-21-1238042821-2718205052-1285772492-1001\...\MountPoints2: {d80b4098-6943-11e6-8f9f-b05adad58d07} - "G:\VZW_Software_upgrade_assistant.exe"
SearchScopes: HKLM-x32 -> {EC48F92F-2186-4391-8091-5110CBFC1E2E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1238042821-2718205052-1285772492-1001 -> {EC48F92F-2186-4391-8091-5110CBFC1E2E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
S3 dbx; system32\DRIVERS\dbx.sys [X]
C:\Windows\system32\DRIVERS\dbx.sys
Task: {1543F74D-C9EB-4363-BC8C-34397B27E4FE} - \YCMServiceAgent -> No File <==== ATTENTION
Task: {611C823C-437B-46E7-9683-5312DFFCFD7B} - \Microsoft\Windows\UpdateOrchestrator\Policy Install -> No File <==== ATTENTION
Task: {7ABD412D-9A31-4D9F-BC5D-EB81697094A4} - \avast! SL Update -> No File <==== ATTENTION
Task: {848DCC36-520C-4946-BF68-C7EFFEFA2F84} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot -> No File <==== ATTENTION
Task: {884F1D3C-01DA-4560-B969-A85C51A5244A} - \DropboxOEM -> No File <==== ATTENTION
Task: {D258A394-8AA0-46DF-9F09-613901AA4AAA} - \Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon -> No File <==== ATTENTION
Task: {DB845986-AD3C-4DDD-A906-63878E32CCEC} - \Avast SecureLine -> No File <==== ATTENTION
Task: {E6010D43-6AE7-4B59-8E67-EC78FD8E8E96} - \Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler -> No File <==== ATTENTION
Task: {E75E287C-7D96-4087-B513-344F10729C87} - \Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start -> No File <==== ATTENTION
Task: {EA3F661E-B31C-44A9-B40C-E3D5D56149D4} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display -> No File <==== ATTENTION
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.priceline.com/?refid=PLHBC6240OPQ&refclickid=square
HKU\S-1-5-21-1238042821-2718205052-1285772492-1001\...\Run: [*sxpdbj<*>] => "C:\Users\Queen Bee\AppData\Local\d0a93\47bfc.dd0be4" <===== ATTENTION (Value Name with invalid characters)
C:\Users\Queen Bee\AppData\Local\d0a93
HKU\S-1-5-21-1238042821-2718205052-1285772492-1001\Software\Classes\30699: "C:\WINDOWS\system32\mshta.exe" "javascript:ZTNgw5J="9nrrubx";b2A0=new ActiveXObject("WScript.Shell");DN2HOq="462mu";WwWP3=b2A0.RegRead("HKCU\\software\\ncno\\rgwvs");TaXG5jA="7Zm7S6z5";eval(WwWP3);oTTn4g="CmS4";" <===== ATTENTION
DeleteKey: HKCU\\software\\ncno
C:\WINDOWS\SysWOW64\000*.tmp
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

*****************

Restore point was successfully created.

sashabella New Helpee Posts: 21	[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 14, 2017 6:32:00 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by sashabella on Feb 14, 2017 6:32:00 GMT -8 Sorry, it seems that the last post was truncated... here's the link wikisend.com/download/880460/Fixlog.txt

sashabella New Helpee Posts: 21	[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 14, 2017 17:42:56 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by sashabella on Feb 14, 2017 17:42:56 GMT -8 Followed the instructions, and rebooted after i ran the mbar, and it did a cleanup. Rebooted & Norton found the trojan file again, so i ran the mbar again, and it found nothing...?

sashabella
New Helpee

Posts: 21

[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 14, 2017 17:50:40 GMT -8

Post by sashabella on Feb 14, 2017 17:50:40 GMT -8

wikisend.com/download/596630/system-log.txt

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
main: v2017.02.14.05
rootkit: v2017.02.11.01

Windows 10 x64 NTFS
Internet Explorer 11.576.14393.0
Queen Bee :: DESKTOP-NF20HT4 [administrator]

2/14/2017 10:39:28 AM
mbar-log-2017-02-14 (10-39-28).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 315848
Time elapsed: 25 minute(s), 48 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 85
C:\Program Files (x86)\Mozilla Firefox\00013016.tmp (Trojan.Agent.ENM) -> Delete on reboot. [6f6e4e54307872c4fcbab03e54adfc04]
C:\Program Files (x86)\Mozilla Firefox\00013208.tmp (Trojan.Agent.ENM) -> Delete on reboot. [bb224959e8c0d066d3e33db153ae15eb]
C:\Program Files (x86)\Mozilla Firefox\00013216.tmp (Trojan.Agent.ENM) -> Delete on reboot. [0fce633fa0087abcdcda1ed0ec159a66]
C:\Program Files (x86)\Mozilla Firefox\00013722.tmp (Trojan.Agent.ENM) -> Delete on reboot. [6b724161baee83b3b7ff747af70a10f0]
C:\Program Files (x86)\Mozilla Firefox\00013790.tmp (Trojan.Agent.ENM) -> Delete on reboot. [4d90abf77434989e9c1a08e6de23b848]
C:\Program Files (x86)\Mozilla Firefox\00014101.tmp (Trojan.Agent.ENM) -> Delete on reboot. [2fae455d268279bd46709e5032cf12ee]
C:\Program Files (x86)\Mozilla Firefox\00014527.tmp (Trojan.Agent.ENM) -> Delete on reboot. [ebf24a58a00868ce6e4848a6fa07cd33]
C:\Program Files (x86)\Mozilla Firefox\00014774.tmp (Trojan.Agent.ENM) -> Delete on reboot. [8756f1b19e0a42f43b7b628cba47b749]
C:\Program Files (x86)\Mozilla Firefox\00014820.tmp (Trojan.Agent.ENM) -> Delete on reboot. [edf062403177f93dd5e1fcf2897848b8]
C:\Program Files (x86)\Mozilla Firefox\00015383.tmp (Trojan.Agent.ENM) -> Delete on reboot. [3ca131716b3d5dd92b8bea04ce335ea2]
C:\Program Files (x86)\Mozilla Firefox\00015666.tmp (Trojan.Agent.ENM) -> Delete on reboot. [726baaf808a010268d290be3c140f40c]
C:\Program Files (x86)\Mozilla Firefox\00016101.tmp (Trojan.Agent.ENM) -> Delete on reboot. [24b9980ac1e70630e1d50fdfa55c4fb1]
C:\Program Files (x86)\Mozilla Firefox\00016361.tmp (Trojan.Agent.ENM) -> Delete on reboot. [e4f900a2099f38fe5c5ad41a09f843bd]
C:\Program Files (x86)\Mozilla Firefox\00016433.tmp (Trojan.Agent.ENM) -> Delete on reboot. [904dc0e200a88ea8aa0c7d71a25f8a76]
C:\Program Files (x86)\Mozilla Firefox\00016827.tmp (Trojan.Agent.ENM) -> Delete on reboot. [c21bc2e0f7b1f5419c1ac02e7f826799]
C:\Program Files (x86)\Mozilla Firefox\00017071.tmp (Trojan.Agent.ENM) -> Delete on reboot. [25b8ecb6feaa4ee883336688c53c0bf5]
C:\Program Files (x86)\Mozilla Firefox\00017382.tmp (Trojan.Agent.ENM) -> Delete on reboot. [edf05052b2f6f343d5e17a7481802dd3]
C:\Program Files (x86)\Mozilla Firefox\00017795.tmp (Trojan.Agent.ENM) -> Delete on reboot. [28b51a88ddcbff374571c529a45d57a9]
C:\Program Files (x86)\Mozilla Firefox\00006947.tmp (Trojan.Agent.ENM) -> Delete on reboot. [2cb1911100a862d4c1f5b73705fc629e]
C:\Program Files (x86)\Mozilla Firefox\00012899.tmp (Trojan.Agent.ENM) -> Delete on reboot. [36a7218142669e98edc93bb3ea178d73]
C:\Program Files (x86)\Mozilla Firefox\00018290.tmp (Trojan.Agent.ENM) -> Delete on reboot. [627be4be6f3970c6f4c26c8226db768a]
C:\Program Files (x86)\Mozilla Firefox\00028145.tmp (Trojan.Agent.ENM) -> Delete on reboot. [b02d9c06bdebb08634825698966b0df3]
C:\Program Files (x86)\Mozilla Firefox\00028650.tmp (Trojan.Agent.ENM) -> Delete on reboot. [c11cc9d9e3c5f5418234d618af5248b8]
C:\Program Files (x86)\Mozilla Firefox\00029187.tmp (Trojan.Agent.ENM) -> Delete on reboot. [38a5485adbcdba7c01b51cd2ac55629e]
C:\Program Files (x86)\Mozilla Firefox\00029635.tmp (Trojan.Agent.ENM) -> Delete on reboot. [99445949a0083ff7d9dd2fbf50b150b0]
C:\Program Files (x86)\Mozilla Firefox\00029985.tmp (Trojan.Agent.ENM) -> Delete on reboot. [d805257da30501358f2734ba78894eb2]
C:\Program Files (x86)\Mozilla Firefox\00030231.tmp (Trojan.Agent.ENM) -> Delete on reboot. [6e6fc0e29f095cda25912dc1ce330af6]
C:\Program Files (x86)\Mozilla Firefox\00031268.tmp (Trojan.Agent.ENM) -> Delete on reboot. [8756059d693f90a6ebcb9a5408f9bd43]
C:\Program Files (x86)\Mozilla Firefox\00031386.tmp (Trojan.Agent.ENM) -> Delete on reboot. [c914693934748fa7684eeb033cc5ba46]
C:\Program Files (x86)\Mozilla Firefox\00031845.tmp (Trojan.Agent.ENM) -> Delete on reboot. [5f7e168c9a0ecd69ffb7da14a958e719]
C:\Program Files (x86)\Mozilla Firefox\00031928.tmp (Trojan.Agent.ENM) -> Delete on reboot. [d20b6a38357380b67b3b0ee052af9a66]
C:\Program Files (x86)\Mozilla Firefox\00032194.tmp (Trojan.Agent.ENM) -> Delete on reboot. [10cdbbe7ebbda3932591797531d02dd3]
C:\Program Files (x86)\Mozilla Firefox\00000030.tmp (Trojan.Agent.ENM) -> Delete on reboot. [8a538b17c0e80135ecca6787b54c46ba]
C:\Program Files (x86)\Mozilla Firefox\00000191.tmp (Trojan.Agent.ENM) -> Delete on reboot. [b627cbd72781bf77585e41ad8f72ac54]
C:\Program Files (x86)\Mozilla Firefox\00000964.tmp (Trojan.Agent.ENM) -> Delete on reboot. [409ddfc313955cda269024cacc3525db]
C:\Program Files (x86)\Mozilla Firefox\00000977.tmp (Trojan.Agent.ENM) -> Delete on reboot. [03da0c964d5b9b9b6a4c30bef40d8080]
C:\Program Files (x86)\Mozilla Firefox\00001175.tmp (Trojan.Agent.ENM) -> Delete on reboot. [02dbbae89612b581a51123cb956c936d]
C:\Program Files (x86)\Mozilla Firefox\00001689.tmp (Trojan.Agent.ENM) -> Delete on reboot. [f9e4752deabe79bde2d4e10d4cb537c9]
C:\Program Files (x86)\Mozilla Firefox\00001946.tmp (Trojan.Agent.ENM) -> Delete on reboot. [0dd0257d4f59082eecca9856a65b2ad6]
C:\Program Files (x86)\Mozilla Firefox\00002046.tmp (Trojan.Agent.ENM) -> Delete on reboot. [7568f0b2baeec37305b14ba310f151af]
C:\Program Files (x86)\Mozilla Firefox\00002169.tmp (Trojan.Agent.ENM) -> Delete on reboot. [cd10ffa34464d2646e4811dd68997987]
C:\Program Files (x86)\Mozilla Firefox\00002662.tmp (Trojan.Agent.ENM) -> Delete on reboot. [32abd5cd802835016a4c1cd2b24f2ed2]
C:\Program Files (x86)\Mozilla Firefox\00002710.tmp (Trojan.Agent.ENM) -> Delete on reboot. [21bc930f9c0cc76f5c5a00eead5458a8]
C:\Program Files (x86)\Mozilla Firefox\00003096.tmp (Trojan.Agent.ENM) -> Delete on reboot. [30ad742e9c0c2412a0169f4f946dce32]
C:\Program Files (x86)\Mozilla Firefox\00003109.tmp (Trojan.Agent.ENM) -> Delete on reboot. [a33ac5dd971164d2387e23cbef1208f8]
C:\Program Files (x86)\Mozilla Firefox\00003482.tmp (Trojan.Agent.ENM) -> Delete on reboot. [6974534f8d1bae8893230ce220e1b14f]
C:\Program Files (x86)\Mozilla Firefox\00003498.tmp (Trojan.Agent.ENM) -> Delete on reboot. [d607cdd5cedaa294f1c5b53956abc040]
C:\Program Files (x86)\Mozilla Firefox\00003972.tmp (Trojan.Agent.ENM) -> Delete on reboot. [e7f6abf70e9a7eb8cee89d51a25f5aa6]
C:\Program Files (x86)\Mozilla Firefox\00004212.tmp (Trojan.Agent.ENM) -> Delete on reboot. [429b4a58f7b1e056dbdbd816db266c94]
C:\Program Files (x86)\Mozilla Firefox\00004491.tmp (Trojan.Agent.ENM) -> Delete on reboot. [1ebfd0d24563da5c10a6ee0049b86e92]
C:\Program Files (x86)\Mozilla Firefox\00004746.tmp (Trojan.Agent.ENM) -> Delete on reboot. [c914a0029711082e6b4bf1fd26db2dd3]
C:\Program Files (x86)\Mozilla Firefox\00005585.tmp (Trojan.Agent.ENM) -> Delete on reboot. [7964980ac9df1b1bb1050ae4f50cbe42]
C:\Program Files (x86)\Mozilla Firefox\00005705.tmp (Trojan.Agent.ENM) -> Delete on reboot. [d30ac5dd3d6ba195c3f3cc22cb368779]
C:\Program Files (x86)\Mozilla Firefox\00006787.tmp (Trojan.Agent.ENM) -> Delete on reboot. [2cb16e3434743ff7397d8f5fa45d7987]
C:\Program Files (x86)\Mozilla Firefox\00018367.tmp (Trojan.Agent.ENM) -> Delete on reboot. [eeefccd6ebbdff376c4a0be3f110ff01]
C:\Program Files (x86)\Mozilla Firefox\00018746.tmp (Trojan.Agent.ENM) -> Delete on reboot. [469751518127b3837640955988794cb4]
C:\Program Files (x86)\Mozilla Firefox\00019162.tmp (Trojan.Agent.ENM) -> Delete on reboot. [15c8e9b99414a6903482c82634cda759]
C:\Program Files (x86)\Mozilla Firefox\00019814.tmp (Trojan.Agent.ENM) -> Delete on reboot. [1bc25e44bdebd2642e884da1f70a48b8]
C:\Program Files (x86)\Mozilla Firefox\00020393.tmp (Trojan.Agent.ENM) -> Delete on reboot. [b924b5ed2e7ad75f03b35f8fb051ea16]
C:\Program Files (x86)\Mozilla Firefox\00021082.tmp (Trojan.Agent.ENM) -> Delete on reboot. [be1ff6ac614766d0ad0932bcba47e31d]
C:\Program Files (x86)\Mozilla Firefox\00023281.tmp (Trojan.Agent.ENM) -> Delete on reboot. [e7f63a6824843ef808ae9b53da27c838]
C:\Program Files (x86)\Mozilla Firefox\00023531.tmp (Trojan.Agent.ENM) -> Delete on reboot. [6e6fc9d97c2c2511952109e56b9630d0]
C:\Program Files (x86)\Mozilla Firefox\00023854.tmp (Trojan.Agent.ENM) -> Delete on reboot. [6d702e74e5c33cfaa115ea047190b64a]
C:\Program Files (x86)\Mozilla Firefox\00024240.tmp (Trojan.Agent.ENM) -> Delete on reboot. [8b528d1591175fd7b10522cce41da15f]
C:\Program Files (x86)\Mozilla Firefox\00024464.tmp (Trojan.Agent.ENM) -> Delete on reboot. [a7365f438424da5cac0ae10d06fb04fc]
C:\Program Files (x86)\Mozilla Firefox\00025008.tmp (Trojan.Agent.ENM) -> Delete on reboot. [dffe614141678bab486ef7f77d848080]
C:\Program Files (x86)\Mozilla Firefox\00025078.tmp (Trojan.Agent.ENM) -> Delete on reboot. [1dc0980a1098db5bc4f2806e7b860af6]
C:\Program Files (x86)\Mozilla Firefox\00026168.tmp (Trojan.Agent.ENM) -> Delete on reboot. [6f6e92101c8c83b341753bb3f80933cd]
C:\Program Files (x86)\Mozilla Firefox\00026300.tmp (Trojan.Agent.ENM) -> Delete on reboot. [f3ea49598a1e44f2f0c617d7c53cb54b]
C:\Program Files (x86)\Mozilla Firefox\00026962.tmp (Trojan.Agent.ENM) -> Delete on reboot. [d30a901236725dd9eacc3cb2ba47d12f]
C:\Program Files (x86)\Mozilla Firefox\00027879.tmp (Trojan.Agent.ENM) -> Delete on reboot. [2fae6f33f5b3a88ef7bf8767ff02867a]
C:\Program Files (x86)\Mozilla Firefox\00007046.tmp (Trojan.Agent.ENM) -> Delete on reboot. [9a43c0e2b6f28caa09adc529c73a6799]
C:\Program Files (x86)\Mozilla Firefox\00007232.tmp (Trojan.Agent.ENM) -> Delete on reboot. [a33a60427830ef4705b1f3fbbb46d52b]
C:\Program Files (x86)\Mozilla Firefox\00007719.tmp (Trojan.Agent.ENM) -> Delete on reboot. [c518b6ec9b0dcd69288e04eacf32fb05]
C:\Program Files (x86)\Mozilla Firefox\00008149.tmp (Trojan.Agent.ENM) -> Delete on reboot. [5687f0b26f39d363fabccf1f3dc458a8]
C:\Program Files (x86)\Mozilla Firefox\00008951.tmp (Trojan.Agent.ENM) -> Delete on reboot. [12cb2a789810c274486e6e807e83946c]
C:\Program Files (x86)\Mozilla Firefox\00009198.tmp (Trojan.Agent.ENM) -> Delete on reboot. [7a637230fdabcd69724401ed719036ca]
C:\Program Files (x86)\Mozilla Firefox\00009234.tmp (Trojan.Agent.ENM) -> Delete on reboot. [38a59e041890f93d7442b33bdd2420e0]
C:\Program Files (x86)\Mozilla Firefox\00009326.tmp (Trojan.Agent.ENM) -> Delete on reboot. [518c188ab2f6cf678a2c05e9c63b7a86]
C:\Program Files (x86)\Mozilla Firefox\00009676.tmp (Trojan.Agent.ENM) -> Delete on reboot. [bf1e9e04e5c3a98d22941dd10ef3e21e]
C:\Program Files (x86)\Mozilla Firefox\00010415.tmp (Trojan.Agent.ENM) -> Delete on reboot. [617c01a1d9cfa6908135876707fafb05]
C:\Program Files (x86)\Mozilla Firefox\00011338.tmp (Trojan.Agent.ENM) -> Delete on reboot. [c31a61412c7c54e2863008e6946d17e9]
C:\Program Files (x86)\Mozilla Firefox\00011430.tmp (Trojan.Agent.ENM) -> Delete on reboot. [15c889197f29c86e971f846a7f8205fb]
C:\Program Files (x86)\Mozilla Firefox\00011908.tmp (Trojan.Agent.ENM) -> Delete on reboot. [aa33a3ffe5c353e3a70f4f9f9170bd43]
C:\Program Files (x86)\Mozilla Firefox\00012339.tmp (Trojan.Agent.ENM) -> Delete on reboot. [607d8220faaee1556f47f5f97a876b95]

Physical Sectors Detected: 0
(No malicious items detected)

(end)

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection. Feb 14, 2017 22:28:01 GMT -8

Post by dbrisen on Feb 14, 2017 22:28:01 GMT -8

It looks like (from the logs) that FRST deleted what was showing and that MBAR found extra files but we need to be sure. Please re-scan the system.

Read Slowly and all of it.

If you still have a Addition.txt log file on your desktop, please delete it now.

Start FRST64 that is on your Desktop by right clicking it, selecting "Run as Administrator" and allowing the software to run when the User Access Control asks (if it does).

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Select Additional.txt and 90 Days Files in the Optional Scans section of FRST64.

Press Scan button.

It will make two logs (FRST.txt and Addition.txt) on your Desktop. Please post the logs in your reply back via Wikisend.com as you did earlier.

Notes:

If your Security software blocks the running or download of FRST / FRST64, please disable the security software or make an exception for this file. FRST is updated very frequently and is safe to run but because of the frequent changes (to keep up with newest malware techniques) most Security Software does not approve of the unknown file.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

[ti]SOLVED[/ti] Trojan.Kotver!gm2 infection.

Post by sashabella on Feb 13, 2017 10:08:53 GMT -8

Post by dbrisen on Feb 13, 2017 15:00:36 GMT -8

Post by sashabella on Feb 13, 2017 17:39:35 GMT -8

Post by sashabella on Feb 13, 2017 18:02:01 GMT -8

Post by dbrisen on Feb 13, 2017 22:15:29 GMT -8

Post by sashabella on Feb 14, 2017 6:20:09 GMT -8

Post by sashabella on Feb 14, 2017 6:32:00 GMT -8

Post by sashabella on Feb 14, 2017 17:42:56 GMT -8

Post by sashabella on Feb 14, 2017 17:50:40 GMT -8

Post by dbrisen on Feb 14, 2017 22:28:01 GMT -8