[coquelicot]

A few days ago, I left my room and when I came back, I found that Google Chrome had crashed. I then reopened it, tried to use Netflix, and it froze and crashed again. Something smelled funny so I then tried to run AVG. It would not open. I tried to uninstall, then reinstall but the new file would not even open. At this point, I've tried to run tdsskiller, Malwarebytes, Avast, and many other programs specifically for rootkits. None will open. Windows asks me for permission to open them - I say yes, and then nothing happens. I've been able to use Spybot S&D to run scans of individual files and folders, but it does not allow me to do a full scan. SUPER Antispyware Free Edition ran fine when I saved it to the desktop and ran it from there, but it has not remedied the problem. I then tried saving a bunch of other antivirus and antispyware programs on the desktop and executing them from there, but no luck. When I check msconfig for my startup programs, there's one called Microsoft Operating System that runs from some gibberish .dll file found in AppData\Roaming. It was on there 3 times - I disabled all, but one instance keeps coming back every time I restart. I deleted the gibberish file awhile ago, but it has made no difference. Google Chrome still regularly crashes or uses up way too much memory. Internet Explorer crashes less but still uses a lot of memory to run. I'm attaching the results from a FRST and adw scan. Any help would be greatly appreciated! I'm at my wit's end here.

 

EDIT: Oh, and AT&T apparently just sent my husband a message saying my computer is part of a botnet.

Attached Files

•  FRST.txt   34.57KB   580 downloads
•  AdwCleanerR5.txt   1.56KB   567 downloads

Edited by coquelicot, 24 October 2015 - 11:05 AM.

[Advertisements]

Let me know how the computer is after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
HKU\S-1-5-21-2886134629-1133402904-436001001-1000\...\Run: [733715270] => regsvr32.exe "C:\Users\User\AppData\Local\IazoBsoh\WejUqge.dll"
BHO-x32: No Name -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> No File
S2 BITS; %SystemRoot%\System32\qmgr.dll [X]
S3 BS3137338052; \??\C:\Users\User\AppData\Local\Temp\NTFS.sys [X]
2015-10-21 10:47 - 2015-10-21 10:47 - 00004096 _____ C:\ProgramData\4FmzteqKDDF4.dll
2015-10-21 10:45 - 2015-10-21 10:45 - 00004096 _____ C:\ProgramData\GheT3Z73DDF4.dll
2015-10-20 20:13 - 2015-10-23 12:38 - 03197188 _____ C:\Windows\system32\CFG3137338052
2015-10-20 20:04 - 2015-10-20 20:13 - 00000000 ____D C:\Users\User\AppData\Local\IazoBsoh
2015-10-20 20:02 - 2015-10-20 20:02 - 00000000 ___HD C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
C:\Users\User\AppData\Local\Temp\NTFS.sys
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it.
You may be offered the option of using virtualisation, accept that
When it offers to download the virus database allow that as well
Click the "Scan" button to start scan




On completion of the scan click save log, save it to your desktop and post in your next reply

[Essexboy]

Let me know how the computer is after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
HKU\S-1-5-21-2886134629-1133402904-436001001-1000\...\Run: [733715270] => regsvr32.exe "C:\Users\User\AppData\Local\IazoBsoh\WejUqge.dll"
BHO-x32: No Name -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> No File
S2 BITS; %SystemRoot%\System32\qmgr.dll [X]
S3 BS3137338052; \??\C:\Users\User\AppData\Local\Temp\NTFS.sys [X]
2015-10-21 10:47 - 2015-10-21 10:47 - 00004096 _____ C:\ProgramData\4FmzteqKDDF4.dll
2015-10-21 10:45 - 2015-10-21 10:45 - 00004096 _____ C:\ProgramData\GheT3Z73DDF4.dll
2015-10-20 20:13 - 2015-10-23 12:38 - 03197188 _____ C:\Windows\system32\CFG3137338052
2015-10-20 20:04 - 2015-10-20 20:13 - 00000000 ____D C:\Users\User\AppData\Local\IazoBsoh
2015-10-20 20:02 - 2015-10-20 20:02 - 00000000 ___HD C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
C:\Users\User\AppData\Local\Temp\NTFS.sys
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it.
You may be offered the option of using virtualisation, accept that
When it offers to download the virus database allow that as well
Click the "Scan" button to start scan




On completion of the scan click save log, save it to your desktop and post in your next reply

[coquelicot]

Unfortunately, I cannot run aswMBR.exe -- still having the same problem as with other programs. I did run the FRST fix tool though.

 

EDIT: And now my wifi keeps failing.

Attached Files

•  Fixlog.txt   7.68KB   581 downloads

Edited by coquelicot, 24 October 2015 - 12:35 PM.

[Essexboy]

OK lets try this programme

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
  
  http://img.photobuck...claimer_ENG.png

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.
• Notes:
  1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
  
  
  Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[coquelicot]

Ok, I was able to run ComboFix!! I rebooted and everything and initially, it seemed like everything was running more smoothly. I opened up IE (I'm still afraid to try opening Chrome) to reply to you, and it froze. The good thing is, I checked msconfig and that one instance of "Microsoft Windows Operating System" I couldn't get rid of before was not only disabled but completely gone from the list. It looks like that IazoBsoh directory with the gibberish .dll file still exists. Should I perhaps try deleting it now to see if it's still being run? My wifi has also stayed connected since I rebooted so I think that's a good sign. I've attached the ComboFix log to this reply.

Attached Files

•  ComboFix.txt   24.61KB   556 downloads

[Essexboy]

I will remove it with combofix, a bit safer that way..  Let me know how the computer is after this including AVG

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:
 

Folder::
c:\program files\Elantech
c:\users\User\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}
C:\Users\User\AppData\Local\IazoBsoh

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[coquelicot]

I think that fixed it! The file and folder are no longer there. Everything seems to be working ok. I'll attach the log anyway just in case. You have been EXTREMELY helpful. I was about to lose it there for a while lol. Thank you so much for the help.

 

EDIT: I spoke too soon. I am still not able to open or run anything like AVG or malwarebytes. I tried to just to make sure everything was back to normal, but no luck.

 

EDIT2: Sorry, just didn't want to double post but wanted to keep you updated on what's going on: IE has now begun freezing and crashing. On top of that, at one point, using it spiked physical memory to 94%, even higher than before I ran any scans. It's like trying to get bees out of your garage but having to agitate them in the process. Every time I take a step forward, the dang thing acts out. Anyway, thanks again for the help!

Attached Files

•  ComboFix.txt   24.61KB   577 downloads

Edited by coquelicot, 24 October 2015 - 11:09 PM.

[Essexboy]

OK this may not work but it is worth a try

Download the following to your desktop.. However, do not run it
Reboot to safemode with networking and run the programme from there

Download AVZ tool from here to your desktop
Unzip all files to a folder on your desktop
Reboot to safemode with networking
Open the folder and double click the AVZ icon
When the tool opens select "File" > "Standards scripts"


Place a tick in :


5. Update signature database

Then press "Execute selected scripts"


Once that has execute then
select "File" > "Standards scripts"
Place a tick in :

3. Advanced System Analysis with malware removal mode enabled


When finished look in the folder AVZ4 on your desktop
Open the LOG folder
Attach virusinfo_syscure to your next post

[coquelicot]

Ok, ran it and attached the log. Quick question for you: My wireless capability keeps getting turned off randomly now - do you think this is due to the virus (assuming that's what it is) or due to the different scans having to remove some stuff that might have affected my wireless? Should I re-download drivers (from a trusted source, of course) for my comp after we finish this process? Thanks!

Attached Files

•  virusinfo_syscure.zip   29.82KB   533 downloads

[Essexboy]

We will check the wifi next but first run this AVZ from safe mode please

FIX

Open AVZ as before
Click "File" > "Custom scripts"


A dialogue will open
Copy and paste the following script into the marked space then press run


Script for insertion :
 

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Nuance PDF Reader-reminder');
 DeleteFile('regsvr32.exe /s C:\PROGRA~3\4FmzteqKDDF4.dll','32');
 BC_DeleteFile('regsvr32.exe /s C:\PROGRA~3\4FmzteqKDDF4.dll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\4FmzteqKDDF4','command');
 DeleteFile('C:\PROGRA~3\4FmzteqKDDF4.dll','32');
 BC_DeleteFile('C:\PROGRA~3\4FmzteqKDDF4.dll');
 DeleteFile('regsvr32.exe C:\Users\User\AppData\Local\IazoBsoh\WejUqge.dll','32');
 BC_DeleteFile('regsvr32.exe C:\Users\User\AppData\Local\IazoBsoh\WejUqge.dll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\733715270','command');
 DeleteFile('C:\Users\User\AppData\Local\IazoBsoh\WejUqge.dll','32');
 BC_DeleteFile('C:\Users\User\AppData\Local\IazoBsoh\WejUqge.dll');
 DeleteFile('C:\Users\User\AppData\Roaming\BackUp3137338052.exe','32');
 BC_DeleteFile('C:\Users\User\AppData\Roaming\BackUp3137338052.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BackUp3137338052','command');
 DeleteFile('C:\Users\User\Downloads\unetbootin-windows-585.exe','32');
 BC_DeleteFile('C:\Users\User\Downloads\unetbootin-windows-585.exe');
 DeleteFile('C:\Windows\system32\Tasks\{1C52199A-C09D-4ECD-9ADF-4DBF17E94BE3}','64');
 DeleteFile('C:\Users\User\Downloads\irssi-win32-0.8.12.exe','32');
 BC_DeleteFile('C:\Users\User\Downloads\irssi-win32-0.8.12.exe');
 DeleteFile('C:\Windows\system32\Tasks\{E8145B50-AA1D-4181-97F7-60406AE842AD}','64');
BC_ImportDeletedList;
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Ensure that you copy from begin to end

THEN

Download Windows All In One Repair from Tweaking.com to your desktop
Install the programme

Reboot to safe mode with networking
Run Windows All In One
Select Step 2
Select open Pre-repairs scan then click scan
Let that complete
Save the results to a text file on your desktop



Next select Step 5 and back up the registry



Open the Repairs tab



Select the following repair numbers :

1, 3, 7, 10, 13, 15, 26 and 27

Set the system to reboot on completion
The press Start Repairs

[coquelicot]

Ok, here is the file of the pre-scan results. Update on computer behavior: a few reboots ago, got a blue screen of death. Unfortunately, don't remember what it said. It hasn't happened since though. Computer seems to be running smoothly other than the issue mentioned about the wifi, which seems now to only turn off when returning to normal functionality after safe mode, but can easily be turned back on (thus not a huge problem). Should I go ahead and try to download and install AVG again as a test?

Attached Files

•  Tweaking.com - Windows Repair - Pre-Scan.txt   11.22KB   633 downloads

[Essexboy]

Yes do that and let me know what errors occur please

[coquelicot]

No luck. Downloading AVG to the desktop and trying to run it just leads to the computer asking me if it's okay to open, and then nothing happening again. I tried AVAST too because I heard it was better than AVG anyway and same thing. It's so odd because everything else appears fine at this point. No blue screens of death or browsers crashing since my last update.

[Essexboy]

Could I have a fresh FRST scan please

[coquelicot]

Here ya' go. Computer hasn't frozen or crashed since my last post, thankfully, but I'm also not able to stream my favorite radio. :s

Attached Files

•  FRST.txt   34.2KB   611 downloads

Edited by coquelicot, 25 October 2015 - 07:54 PM.