Trojan.Kotver!gm2

Trojan.Kotver!gm2 Feb 22, 2017 7:35:44 GMT -8

Quote

Post by dbrisen on Feb 22, 2017 7:35:44 GMT -8

First of all, I apologize for the delay in replying to you. Secondly, for a "nooby", you did very well and the logs were posted correctly.

FIRST >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-2651713258-1864712650-3972746982-1001\...\Run: [*yxjjmpqa<*>] => "C:\Users\ashco\AppData\Local\94667\a6a09.6ea721" <===== ATTENTION (Value Name with invalid characters)
C:\Users\ashco\AppData\Local\94667
CHR Extension: (Google Slides) - C:\Users\ashco\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-10-26]
CHR Extension: (Google Drive) - C:\Users\ashco\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-10-26]
CHR Extension: (Chrome Web Store Payments) - C:\Users\ashco\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-10-26]
CHR Extension: (Chrome Media Router) - C:\Users\ashco\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-10-26]
C:\WINDOWS\SysWOW64\000*.tmp
HKU\S-1-5-21-2651713258-1864712650-3972746982-1001\Software\Classes\a34fd: "C:\WINDOWS\system32\mshta.exe" "javascript:ZZ6hgJS="o1";wf55=new ActiveXObject("WScript.Shell");DX5Hle7="guy";fE1SP=wf55.RegRead("HKCU\\software\\cjwkacyqcj\\yyvpmn");s0ShUm2="u";eval(fE1SP);vqz4l="W";" <===== ATTENTION
DeleteKey: HKCU\\software\\cjwkacyqcj
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

SECOND >>>>

Please download Malwarebytes Anti-Rootkit from here

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt .

[/ul]

LAST >>>>

INFO TO REPLY WITH:
How is your system running now?
The Fixlog.txt text file (you should be able to attach this file; no need for wikisend.com usually).
The logs from MBAR - mbar-log.txt and the system-log.txt files please.
Any questions?

Post by ashconley on Feb 20, 2017 8:49:29 GMT -8

Post by dbrisen on Feb 22, 2017 7:35:44 GMT -8