Help for clicker.trogan and smartsystem.rootkit

[DottieDo]

Hi,

I am truly desperate.  I've had this now for a few weeks.  I originally started using tools from bleepingcomputer to rid myself of this issue to no avail.  I finally started to get help from their forum, however, I don't know what happened.  I was having problems replying to threads and posting and the next thing I know they banned me for spamming.  I am not a spammer.  I don't know if it's even possible that this malware I have can create such.  Please, do not boot me, without first emailing me about it.  If I run into that issue again, I think my only hope is to do a full Windows 10 reset, which I'm trying to avoid.

I use the tool Super Antispyware twice a day and it finds around 1000 PUPs each time.  I have not used it since following your instructions.  Below are other things I've done prior to coming over to Computer Hope:

• Deleted C:\Windows\System32\drivers\ndistpr64.sys in Safe Mode
  Ran Emsisoft Anti-Malware ... It detected Smart System rootkit but it couldn't get rid of it
  Tried Bleeping Computers instruction to remove rootkit, but my system won't allow me to install Malwarebytes Anti-rootkit.  That was the first thing the instructions wanted me to do.
  Ran GMER software and it came back with C:\\WINDOWS\system32\drivers\monjmqtw.sys (*** hidden ***)  ---- Value [BOOT] nviat
  Did not delete the file GMER came up with because I started posting on Bleeping Computer and following those instructions
  Then no sooner did I start to get help from Bleeping I was banned for being a "spammer".  So no longer getting help from them

 

I have now followed Hope Computers instructions starting with CCleaner (apps & registry) and below are the logs requested:

1.  Malwarbytes Adware Cleaner

# AdwCleaner 7.0.3.1 - Logfile created on Sat Oct 21 15:13:52 2017
# Updated on 2017/29/09 by Malwarebytes
# Database: 09-29-2017.1
# Running on Windows 10 Home (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

2.  MalwareBytes Log

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 10/21/17
Scan Time: 9:38 AM
Log File: 81861c24-b66d-11e7-8e7b-f079591e2558.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2029
Components Version: 1.0.212
Update Package Version: 1.0.3061
License: Free

-System Information-
OS: Windows 10 (Build 14393.1770)
CPU: x64
File System: NTFS
User: LAPTOP\Tina

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 385744
Threats Detected: 1
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 4 min, 35 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Trojan.Clicker, C:\WINDOWS\SYSTEM32\DRIVERS\MSIDNTFS.SYS, Removal Failed, [21], [433332],1.0.3061

Physical Sector: 0
(No malicious items detected)


(end)

3.  Security Checkup

 Results of screen317's Security Check version 1.014 --- 12/23/15 
   x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````[/u]
 Windows Firewall Enabled! 
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````[/u]
 Java 8 Update 131 
 Java 8 Update 144 
 Java version 32-bit out of Date!
 Adobe Flash Player    27.0.0.170 
 Google Chrome (61.0.3163.100)
 Google Chrome (SetupMetrics...)
````````Process Check: objlist.exe by Laurent````````[/u] 
`````````````````System Health check`````````````````[/u]
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````[/u]

Appreciate whatever help you can give me and advice.

DottieDo

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Please download AdwareCleaner onto your Desktop. AdwCleaner

Before starting AdwCleaner, close all open programs and internet browsers, then double-click on the AdwCleaner icon.



If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.
When the AdwCleaner program will open, click on the Scan button as shown below.



AdwCleaner will now start to search for malicious files that may be installed on your computer.
To remove the files that were detected in the previous step, please click on the Clean button.



AdwCleaner will now prompt you to save any open files or data as the program will need to reboot the computer. Please do so and then click on the OK button. AdwCleaner will now delete all detected adware from your computer. When it is done it will display an alert that explains what PUPs (Potentially Unwanted Programs) and Adware are. Please read through this information and then press the OK button. You will now be presented with an alert that states AdwCleaner needs to reboot your computer.
Please click on the OK button to allow AdwCleaner reboot your computer.A log will be produced. Please copy and paste this log in your next reply.
*********************************************
Please download Junkware Removal Tool to your desktop.

•Warning! Once the scan is complete JRT will shut down your browser with NO warning.

•Shut down your protection software now to avoid potential conflicts.

•Temporarily disable your Antivirus and any Antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

•Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator

•The tool will open and start scanning your system.

•Please be patient as this can take a while to complete depending on your system's specifications.

•On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

•Copy and Paste the JRT.txt log into your next message.
**********************************************************
Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
 You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe
iExplore.exe

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  
• If not, delete the file, then download and use the one provided in Link 2.
  
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.

[DottieDo]

Thank you, Sugar Dave, for your assistance.

All day this took me.  I had to uninstall super anti-spyware for the Adware Cleaner to work.  I wasn't able to get Junkware Removal Tool to work.  Anyway, below are the two files that I have and also the message I get when trying to install the JRT.

# AdwCleaner 7.0.3.1 - Logfile created on Mon Oct 23 19:54:30 2017
# Updated on 2017/29/09 by Malwarebytes
# Running on Windows 10 Home (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[C1].txt - [5109 B] - [2015/11/28 5:13:45]
C:/AdwCleaner/AdwCleaner[C2].txt - [1477 B] - [2015/11/29 19:58:58]
C:/AdwCleaner/AdwCleaner[S2].txt - [1218 B] - [2015/11/28 5:7:36]
C:/AdwCleaner/AdwCleaner[S3].txt - [4890 B] - [2015/11/29 19:57:40]


########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt ##########


JRT gives me a pop-up:
Could not create file "C:\Users\Tina\AppData\Local\Temp\jrt\clean_shortcut.vbs".  Access is denied.

Rkill 2.9.1 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2017 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 10/23/2017 08:18:39 PM in x64 mode.
Windows Version: Windows 10 Home

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Windows Defender Disabled

   [HKLM\SOFTWARE\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * HOSTS file entries found:

  0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
  0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
  0.0.0.0 media.opencandy.com
  0.0.0.0 cdn.opencandy.com
  0.0.0.0 tracking.opencandy.com
  0.0.0.0 api.opencandy.com
  0.0.0.0 api.recommendedsw.com
  0.0.0.0 rp.yefeneri2.com
  0.0.0.0 os.yefeneri2.com
  0.0.0.0 os2.yefeneri2.com
  0.0.0.0 installer.betterinstaller.com
  0.0.0.0 installer.filebulldog.com
  0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
  0.0.0.0 inno.bisrv.com

  20 out of 44 HOSTS entries shown.
  Please review HOSTS file for further entries.

Program finished at: 10/23/2017 08:21:12 PM
Execution time: 0 hours(s), 2 minute(s), and 33 seconds(s)

It's been a long day.  Thank you, again, for your help.

DottieDo

[Mark.]

Sugar Dave hey.... excellent typo Dottie. 
You would have made his day.

[SuperDave]

Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• It should update automatically if the computer is connected to the internet.
• Click on Threat Scan and click on Scan Now.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete make sure all the infections have "quarantine" selected in the Action box.
  
• Click on "Apply actions" You may be asked to Restart your computer to completely remove the infections.
  
• When disinfection is completed you can click on "Copy to Clipboard".
  
• Paste the log in you next reply (CTRL+ V)

[DottieDo]

SUPER Dave,

My work schedule is crazy right now and I won't get to the Malwarebytes until Sunday.  Please don't drop me.  And btw, "Sugar" Dave was not a typo.  I actually thought that is what I seen ... just so grateful to be getting help.

[SuperDave]

I actually never noticed that until it was brought up. There's no hurry. Whenever you're ready.

[DottieDo]

Hi,

Yeah!  Caught malware during untinstall/install and having to go briefly on internet to download executable.  Malwarebytes did quarantine that but not the clicker.trogan.  Here's my malwarebytes log file below:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 10/29/17
Scan Time: 8:44 PM
Log File: d938f20a-bd13-11e7-86e8-f079591e2558.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2029
Components Version: 1.0.212
Update Package Version: 1.0.3125
License: Free

-System Information-
OS: Windows 10 (Build 14393.1770)
CPU: x64
File System: NTFS
User: LAPTOP\Tina

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 386459
Threats Detected: 2
Threats Quarantined: 1
Time Elapsed: 5 min, 6 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 2
Trojan.Clicker, C:\WINDOWS\SYSTEM32\DRIVERS\MSIDNTFS.SYS, Removal Failed, [21], [433332],1.0.3125
Adware.CrossAd.Generic, C:\USERS\TINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\d7phfry3.default-1505427235000\EXTENSIONS\@1df4e663-b9f3-4708-9f5d-44265b33397e.xpi, Quarantined, [9070], [443246],1.0.3125

Physical Sector: 0
(No malicious items detected)


(end)

Thank you,

DottieDo Dah Day

[SuperDave]

Please download Junkware Removal Tool to your desktop.

•Warning! Once the scan is complete JRT will shut down your browser with NO warning.

•Shut down your protection software now to avoid potential conflicts.

•Temporarily disable your Antivirus and any Antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

•Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator



•The tool will open and start scanning your system. At the Command Prompt, you’ll need to press any key to perform a scan.



•Please be patient as this can take a while to complete depending on your system's specifications.

•On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

•Copy and Paste the JRT.txt log into your next message.
******************************************************
ESET Online Scanner
Note : If you use Internet Explorer to get the ESET Online Scanner, you won't have to download, nor install the tool, as everything will be ran in a contextual (pop-up) window of Internet Explorer. However, for every other browsers, you will have to download and install ESET Online Scanner. In this set of instruction, I'll use Google Chrome to download it and run it (since a lot of people will do it), however, except for the download and installation procedure, the same instructions applies if you use Internet Explorer. Please note that two or three prompts will appear if you use Internet Explorer asking you to reload the page, authorize the application, execute it, etc. Accept all of them in order to run ESET Online Scanner.

    Download and execute ESET OnlineScan (on this window, click on ESET Smart Installer to trigger the download). People accessing this URL via Internet Explorer will start the integration process of ESET Online Scanner in their browser;
    Once the installation is done (it requires Admin Rights), check the following settings (two of them are under Advanced Settings, click on it to display them) :

        Enable detection of potentially unwanted applications;
        Scan archives;
        Scan for potentially unsafe applications;
        Optional : If you want to scan more drives, click on Change... and select the drives you want to include in the scan;

   

    After you're done checking these options, click on Start and ESET Online Scanner will download it's virus signature database before starting the scan;
   

    Once done, the scan will start automatically. Detections will appear at the bottom of the window. ESET Online Scanner can have an extremely long scan time that can last between 2 or 3 hours. So if you start the scan, do not interrupt it, let it complete until the end;
   

    After the scan is finished, a summary window will appear to give you the information about the scan. Then you'll have to the option to see what threads were found and to manage the threats that were quarantined;
   


    Click on List of found threats, it'll display every threat identified during that scan, their type and what action was taken against them. Click on Copy to clipboard to copy these results on our clipboard and post them in your next reply;
   


    Once you're done, click on the Back button;
    Check both checkboxes at the bottom: Uninstall application on close and Delete quarantined files before clicking on the Finish button;

[Kryptonite]

To Super Dave and Dottie or whoever is seeking and receiving help here on CH.  I am .mostly posting a comment ing here to a k,knowledge ( an aside about misspeings which are happen,ing on my computers a,d my smart phone < using my android phone now to write this > all devices are acting up. That said I want to praise to the highest degree all a,d everyone who gives their to.e a,d knowledge to right the diseases that we catch cor whatever reAsons.

You will be rewarded in wAys that we all won't get to see necessarily. Tha,k you for all of your help!

I need to post my own story of woe and disaster here I, a few minutes.



ThAt,k you!

Kryptonite

[DottieDo]

Hi,

I'm still unable to run JRT.  I am still getting the popup error: "Could not create file "C:\Users\Tina\AppData\Local\temp\jrt\clean_shortcut.vbs". Access is denied.

I did an echo of my temp directory and it's normal.  JRT starts creating the file and then stops with the Error.  It actually creates the jrt file and a few other things but then it stops.  I even tried in Safe Mode as Administrator.  I totally uninstalled my Avast Anti virus.


Malwarebyte Anti Rootkit still won't work either.  And Malwarebytes Adw Cleaner doesn't seem to detect squat.  I use it and I know that I have adware because that's what this trojan/rootkit does.  It bloats my disk to 100%.  When I'm online I can see all of the adware being downloaded in the lower bar of my browsers' windows.  So I had to re-install Super Antispyware in order for it to get rid of it because Malwarebytes Adware Cleaner isn't cutting it. 

I felt so desperate I ran GMER again and disabled the rootkit.  But once I reboot, it is re-enabled.  I thought I'd try to remove the system file manually, but it comes back with a new name similar to the last one.  I looked in my registry for HKLM\SYSTEM\CurrentControlSet\Services\nviat, which is the rootkit registry but it's not apparent.  How could that be?

I have the rootkit system file disabled now.  But tomorrow morning when I fire up the laptop it will be enabled again. 

I will do the ESET scan.  Probably not tonight.  Do I have to disable everything again to run it?

[SuperDave]

I will do the ESET scan.  Probably not tonight.  Do I have to disable everything again to run it?

No. ESET will run because it's running from outside your computer.