virus/malware removal

Hi deltalima,

Following is the BlitzBlank log:

BlitzBlank 1.0.0.32

File/Registry Modification Engine native application
CopyFileOnReboot: sourceFile = "\??\c:\windows\softwaredistribution\download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.1.7601.17514_none_a04fb2d2ba296321\csc.sys", destinationFile = "\??\c:\windows\system32\drivers\csc.sys"

Here's the SystemLook log:

SystemLook 04.09.10 by jpshortstuff
Log created at 19:32 on 12/03/2013 by Owner
Administrator - Elevation successful

========== file ==========

C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.1.7601.17514_none_a04fb2d2ba296321\csc.sys - File found and opened.
MD5: 3C2177A897B4CA2788C6FB0C3FD81D4B
Created at 13:33 on 07/06/2011
Modified at 08:44 on 20/11/2010
Size: 388096 bytes
Attributes: --a----
FileDescription: Windows Client Side Caching Driver
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
ProductVersion: 6.1.7601.17514
OriginalFilename: CSC.Sys
InternalName: csc.sys
ProductName: Microsoft® Windows® Operating System
CompanyName: Microsoft Corporation
LegalCopyright: © Microsoft Corporation. All rights reserved.

C:\Windows\SoftwareDistribution\Download\bd60fbfcf1ac006bf26f6afa5c1dff1a\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.1.7601.17514_none_a04fb2d2ba296321\csc.sys - File found and opened.
MD5: 3C2177A897B4CA2788C6FB0C3FD81D4B
Created at 21:58 on 20/10/2011
Modified at 08:44 on 20/11/2010
Size: 388096 bytes
Attributes: --a----
FileDescription: Windows Client Side Caching Driver
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
ProductVersion: 6.1.7601.17514
OriginalFilename: CSC.Sys
InternalName: csc.sys
ProductName: Microsoft® Windows® Operating System
CompanyName: Microsoft Corporation
LegalCopyright: © Microsoft Corporation. All rights reserved.

C:\Windows\System32\drivers\csc.sys - File found and opened.
MD5: 3C2177A897B4CA2788C6FB0C3FD81D4B
Created at 23:15 on 13/07/2009
Modified at 23:26 on 12/03/2013
Size: 388096 bytes
Attributes: --a----
FileDescription: Windows Client Side Caching Driver
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
ProductVersion: 6.1.7601.17514
OriginalFilename: CSC.Sys
InternalName: csc.sys
ProductName: Microsoft® Windows® Operating System
CompanyName: Microsoft Corporation
LegalCopyright: © Microsoft Corporation. All rights reserved.

-= EOF =-

Here's the Virustotal log:

SHA256: 98575cbd0664586e6211d02e71bdd52cbaa149a1658573550e29e74e5f7b1553
File name: CSC.Sys
Detection ratio: 0 / 46
Analysis date: 2013-03-05 22:04:21 UTC ( 1 week ago )

Hi wv2sc,

Update Adobe Reader

• You should Download and Install the newest version of Adobe Reader for reading pdf files.
• Older versions may have vulnerabilities that malware can use to infect your system.
• Go Here to download and install Adobe Reader X.
• Note: remember to Uncheck Free McAfee® Security Scan Plus (optional)

Update Java Runtime

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 7 Update 17.

• Download the latest version of Java Runtime Environment (JRE) 7 Here
• Scroll down to where it says "Java SE 7u17"
• Click the blue Download JRE button to the right
• Select the Windows platform from the dropdown menu
• Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 7 with JavaFX License Agreement". Click on Continue.The page will refresh
• Click on the link to download Windows Offline Installation & save the file to your desktop
• Close any programs you may have running - especially your web browser
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) ) in the name
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions
• Reboot your computer once all Java components are removed
• Then from your desktop double-click on jre-7u17-windows-i586.exe to install the newest version

Run OTL Script

• Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).
• Copy and Paste the following code into the textbox. Do not include the word Code
  

  
  
  :Commands
  
  [CREATERESTOREPOINT]
  
  :processes
  
  killallprocesses
  
  :files
  
  C:\TDSSKiller_Quarantine
  
  C:\_OTL\MovedFiles\03082013_143629\C_Windows\System32\drivers\etc\hosts
  
  set /c
  
  sc query wscsvc /c
  
  :commands
  
  [EMPTYTEMP]
  
  [EMPTYFLASH]
  
  [EMPTYJAVA]
  
  [RESETHOSTS]
  
  [REBOOT]
  
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

• First please Disable any Antivirus you have active, as shown in This topic.
• Note: Don't forget to re-enable it after the scan.
• Next hold down Control then click on the following link to open a new window to ESET online scannner
• Press the Blue Run ESET Online Scanner button on the left side of the page.
• A popup box will open.
• Select the option YES, I accept the Terms of Use then click on Start.
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology
• Now click on Start.
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on Finish.
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Hi deltalima,

With regard to running the OTL script, I get a blue screen immediately after clicking "Run Fix". Any ideas?

Hi wv2sc,

Reboot into Safe Mode and try OTL again.

Hi deltalima,

Following is the OTL log:

All processes killed
========== COMMANDS ==========
Unable to start System Restore Service. Error code 1084
========== PROCESSES ==========
========== FILES ==========
C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000\tdlfs0000 folder moved successfully.
C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000\mbr0000 folder moved successfully.
C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000 folder moved successfully.
C:\TDSSKiller_Quarantine\06.03.2013_22.09.55 folder moved successfully.
C:\TDSSKiller_Quarantine folder moved successfully.
C:\_OTL\MovedFiles\03082013_143629\C_Windows\System32\drivers\etc\hosts moved successfully.
< set /c >
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Owner\AppData\Roaming
CLASSPATH=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=OWNER-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Owner
LOCALAPPDATA=C:\Users\Owner\AppData\Local
LOGONSERVER=\\OWNER-PC
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\HP\Digital Imaging\bin;C:\Program Files\HP\Digital Imaging\bin\;C:\Program Files\HP\Digital Imaging\bin\Qt\Qt 4.3.3
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 14 Stepping 12, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0e0c
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
SAFEBOOT_OPTION=NETWORK
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Owner\AppData\Local\Temp
TMP=C:\Users\Owner\AppData\Local\Temp
USERDOMAIN=Owner-PC
USERNAME=Owner
USERPROFILE=C:\Users\Owner
windir=C:\Windows
C:\Users\Owner\Desktop\cmd.bat deleted successfully.
C:\Users\Owner\Desktop\cmd.txt deleted successfully.
< sc query wscsvc /c >
SERVICE_NAME: wscsvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
C:\Users\Owner\Desktop\cmd.bat deleted successfully.
C:\Users\Owner\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Owner
->Temp folder emptied: 1213730 bytes
->Temporary Internet Files folder emptied: 587407 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 30952713 bytes
->Flash cache emptied: 1001 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14756 bytes
RecycleBin emptied: 4092027 bytes

Total Files Cleaned = 35.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Owner
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Owner
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.69.0 log created on 03132013_171815

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Hi deltalima,

I just realized that I forgot to run and post the ESET scan results...I'm running the scan now and will post the results as soon as it's finished. Sorry for the mistake.

Hi wv2sc,

I'm running the scan now and will post the results as soon as it's finished.

No problem, post the log when ready.

It's looking good now, one more run with OTL as a final check (boot into normal mode for this).

Run OTL Script

• Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).
• Copy and Paste the following code into the textbox. Do not include the word Code
  

  
  
  :files
  
  sc query wscsvc /c
  
  
  
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Hi deltalima,

Following are the results of the ESET scan:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=455774845e423f4a8ecbc90a92c3eb43
# engine=13359
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-03-11 11:55:37
# local_time=2013-03-11 07:55:37 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1039 16777213 100 99 3404 49236921 0 0
# compatibility_mode=5893 16776574 66 94 39490423 114590928 0 0
# scanned=122976
# found=8
# cleaned=0
# scan_time=2515
sh=C8757A0E961BAE1D35A9890C2CB2FE8A0F621345 ft=1 fh=a7b6cbaf38017ab8 vn="Win32/Olmarik.AFK trojan" ac=I fn="C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000\tdlfs0000\tsk0005.dta"
sh=1F6E742329EEEFB968360A68A2A730A8685048B3 ft=1 fh=8f2c7595a93029ff vn="Win64/Olmarik.R trojan" ac=I fn="C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000\tdlfs0000\tsk0006.dta"
sh=DFFBDFFD6F2BA1D31E2753A049629DE8179558D8 ft=1 fh=738bcfb426fc330d vn="Win64/Olmarik.R trojan" ac=I fn="C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000\tdlfs0000\tsk0007.dta"
sh=5DDCD3ADC731EECF0554C8CD62EE70A57E6ECA20 ft=1 fh=b8e8029d98b1e3c7 vn="Win64/Olmarik.A trojan" ac=I fn="C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000\tdlfs0000\tsk0008.dta"
sh=AD8A9B2E3F3E31E14B513E7D0A64D02EEC56AD18 ft=1 fh=7ec732fe852496af vn="Win32/Olmarik.AMN trojan" ac=I fn="C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000\tdlfs0000\tsk0009.dta"
sh=53E8DE5235F5E31A44E67E01997246F7753B0107 ft=1 fh=110b647f36d70a0b vn="a variant of Win32/TrojanProxy.Agent.NJZ trojan" ac=I fn="C:\TDSSKiller_Quarantine\06.03.2013_22.09.55\mbr0000\tdlfs0000\tsk0010.dta"
sh=F8991D6A8D50AA04B1FEC6692149612074C932EC ft=1 fh=2bbfbc0ad6442093 vn="Win32/Rootkit.Agent.NUT trojan" ac=I fn="C:\Windows\System32\drivers\csc.sys"
sh=84F402817E098893861BE859D40A296FB086DD8C ft=0 fh=0000000000000000 vn="Win32/Qhost trojan" ac=I fn="C:\_OTL\MovedFiles\03082013_143629\C_Windows\System32\drivers\etc\hosts"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=455774845e423f4a8ecbc90a92c3eb43
# engine=13375
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-03-13 09:48:29
# local_time=2013-03-13 05:48:29 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1039 16777213 100 99 0 49402093 0 0
# compatibility_mode=5893 16776574 66 94 39092104 114756100 0 0
# scanned=21818
# found=0
# cleaned=0
# scan_time=1278

Following is the OTL log:

========== FILES ==========
< sc query wscsvc /c >
SERVICE_NAME: wscsvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
C:\Users\Owner\Desktop\cmd.bat deleted successfully.
C:\Users\Owner\Desktop\cmd.txt deleted successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 03132013_175114

Hi wv2sc,

Now that you are clean, please follow these steps in order to keep your computer clean and secure.

Remove GMER

Delete the GMER icon from your desktop.

Clear restore points

• Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).
• Copy and Paste the following code into the textbox. Do not include the word Code
  

  
  
  :commands
  
  [clearallrestorepoints] 
  
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Please do so if asked.

Clean up with OTL

• Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.

Now make sure Windows 7 is updated to Service Pack 1 and all security updates are applied.

Happy surfing and stay clean!

Hi deltalima,

Thank you so much for all your help in cleaning this computer...I really appreciate it! I had no idea removing a virus or malware would be so intensive. Thanks again!

You're welcome!

Glad we could help.

As your problems appear to have been resolved,