Recycler Virus--How to get rid of it?

Printable View

15.05.2010, 15:28
juntariman

Recycler Virus--How to get rid of it?

I'm using McAfee Virus Enterprise as my main defense with Spybot Search and Destroy anti-spyware before a RECYCLER VIRUS got into my system.

I had used several virus/malware removal tools but to no avail in getting rid of the recycler virus.

I have attached the log files created after the system analysis as instructed by VirusInfo.

Please help. Thanks...

JUN TARIMAN
Philippines

[ATTACH]237854[/ATTACH]

[ATTACH]237855[/ATTACH]

[ATTACH]237856[/ATTACH]
15.05.2010, 16:12
Rene-gad

- Remove ALL antimalware tools you've installed excepted ONLY McAfee Antivirus and Malwarebytes Antimalware!!!
Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
StopService('f9fA5');
StopService('e9e5');
StopService('e16D');
StopService('d926');
StopService('bf1A');
StopService('be0AD');
StopService('ba1A7');
StopService('afbAB');
StopService('ae8E');
StopService('9ccA9');
StopService('8b4A3');
StopService('7d216');
StopService('761C');
StopService('68d8');
StopService('6539');
StopService('62f15');
StopService('51c14');
StopService('4f811');
StopService('3ed12');
StopService('0fa4');
StopService('0f8A8');
StopService('0f110');
StopService('0e8A4');
StopService('019AC');
QuarantineFile('C:\WINDOWS.0\Temp\JET3705.tmp','');
QuarantineFile('C:\WINDOWS.0\system32\f9fA5.sys','');
QuarantineFile('C:\WINDOWS.0\system32\Event Agent\PopMenu.exe','');
QuarantineFile('C:\WINDOWS.0\system32\Event Agent\bin\smss .exe','');
QuarantineFile('C:\WINDOWS.0\system32\eaLsp.dll','');
QuarantineFile('C:\WINDOWS.0\system32\e9e5.sys','');
QuarantineFile('C:\WINDOWS.0\system32\e16D.sys','');
QuarantineFile('C:\WINDOWS.0\system32\d926.sys','');
QuarantineFile('C:\WINDOWS.0\system32\bf1A.sys','');
QuarantineFile('C:\WINDOWS.0\system32\be0AD.sys','');
QuarantineFile('C:\WINDOWS.0\system32\ba1A7.sys','');
QuarantineFile('C:\WINDOWS.0\system32\afbAB.sys','');
QuarantineFile('C:\WINDOWS.0\system32\ae8E.sys','');
QuarantineFile('C:\WINDOWS.0\system32\9ccA9.sys','');
QuarantineFile('C:\WINDOWS.0\system32\8b4A3.sys','');
QuarantineFile('C:\WINDOWS.0\system32\7d216.sys','');
QuarantineFile('C:\WINDOWS.0\system32\761C.sys','');
QuarantineFile('C:\WINDOWS.0\system32\68d8.sys','');
QuarantineFile('C:\WINDOWS.0\system32\6539.sys','');
QuarantineFile('C:\WINDOWS.0\system32\62f15.sys','');
QuarantineFile('C:\WINDOWS.0\system32\51c14.sys','');
QuarantineFile('C:\WINDOWS.0\system32\4f811.sys','');
QuarantineFile('C:\WINDOWS.0\system32\3ed12.sys','');
QuarantineFile('C:\WINDOWS.0\system32\0fa4.sys','');
QuarantineFile('C:\WINDOWS.0\system32\0f8A8.sys','');
QuarantineFile('C:\WINDOWS.0\system32\0f110.sys','');
QuarantineFile('C:\WINDOWS.0\system32\0e8A4.sys','');
QuarantineFile('C:\WINDOWS.0\system32\019AC.sys','');
QuarantineFile('C:\Program Files\Internet Explorer\SABProcEnum.sys','');
DeleteService('f9fA5');
DeleteService('e9e5');
DeleteService('e16D');
DeleteService('d926');
DeleteService('bf1A');
DeleteService('be0AD');
DeleteService('ba1A7');
DeleteService('afbAB');
DeleteService('ae8E');
DeleteService('9ccA9');
DeleteService('8b4A3');
DeleteService('7d216');
DeleteService('761C');
DeleteService('68d8');
DeleteService('6539');
DeleteService('62f15');
DeleteService('51c14');
DeleteService('4f811');
DeleteService('3ed12');
DeleteService('0fa4');
DeleteService('0f8A8');
DeleteService('0f110');
DeleteService('0e8A4');
DeleteService('019AC');
DeleteFile('C:\WINDOWS.0\Temp\JET3705.tmp');
DeleteFile('C:\WINDOWS.0\system32\f9fA5.sys');
DeleteFile('C:\WINDOWS.0\system32\e9e5.sys');
DeleteFile('C:\WINDOWS.0\system32\e16D.sys');
DeleteFile('C:\WINDOWS.0\system32\d926.sys');
DeleteFile('C:\WINDOWS.0\system32\bf1A.sys');
DeleteFile('C:\WINDOWS.0\system32\be0AD.sys');
DeleteFile('C:\WINDOWS.0\system32\ba1A7.sys');
DeleteFile('C:\WINDOWS.0\system32\afbAB.sys');
DeleteFile('C:\WINDOWS.0\system32\ae8E.sys');
DeleteFile('C:\WINDOWS.0\system32\9ccA9.sys');
DeleteFile('C:\WINDOWS.0\system32\8b4A3.sys');
DeleteFile('C:\WINDOWS.0\system32\7d216.sys');
DeleteFile('C:\WINDOWS.0\system32\761C.sys');
DeleteFile('C:\WINDOWS.0\system32\68d8.sys');
DeleteFile('C:\WINDOWS.0\system32\6539.sys');
DeleteFile('C:\WINDOWS.0\system32\62f15.sys');
DeleteFile('C:\WINDOWS.0\system32\51c14.sys');
DeleteFile('C:\WINDOWS.0\system32\4f811.sys');
DeleteFile('C:\WINDOWS.0\system32\3ed12.sys');
DeleteFile('C:\WINDOWS.0\system32\0fa4.sys');
DeleteFile('C:\WINDOWS.0\system32\0f8A8.sys');
DeleteFile('C:\WINDOWS.0\system32\0f110.sys');
DeleteFile('C:\WINDOWS.0\system32\0e8A4.sys');
DeleteFile('C:\WINDOWS.0\system32\019AC.sys');
BC_DeleteSvc('f9fA5');
BC_DeleteSvc('e9e5');
BC_DeleteSvc('e16D');
BC_DeleteSvc('d926');
BC_DeleteSvc('bf1A');
BC_DeleteSvc('be0AD');
BC_DeleteSvc('ba1A7');
BC_DeleteSvc('afbAB');
BC_DeleteSvc('ae8E');
BC_DeleteSvc('9ccA9');
BC_DeleteSvc('8b4A3');
BC_DeleteSvc('7d216');
BC_DeleteSvc('761C');
BC_DeleteSvc('68d8');
BC_DeleteSvc('6539');
BC_DeleteSvc('62f15');
BC_DeleteSvc('51c14');
BC_DeleteSvc('4f811');
BC_DeleteSvc('3ed12');
BC_DeleteSvc('0fa4');
BC_DeleteSvc('0f8A8');
BC_DeleteSvc('0f110');
BC_DeleteSvc('0e8A4');
BC_DeleteSvc('019AC');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot:
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/CODE]
- Upload the C:\quarantine.zip here: [url]http://virusinfo.info/upload_virus_eng.php?tid=78390[/url]
- Make a new AVPTool log file.
- Make a new log of Malwarebytes Antimalware
- Attach both logs to your new post..
15.05.2010, 21:15
juntariman

I've successfully done the scripts but the RECYCLER and SYSTEM VOLUME INFORMATION folders are still there in my local drives and external drives.
15.05.2010, 21:25
Rene-gad

[QUOTE=juntariman;637469]I've successfully done the scripts but the RECYCLER and SYSTEM VOLUME INFORMATION folders are still there in my local drives and external drives.[/QUOTE]What would you like to do with these system folders of Windows???

[QUOTE]- Make a new AVPTool log file.
- Make a new log of Malwarebytes Antimalware
- Attach both logs to your new post.. [/QUOTE]????
15.05.2010, 21:32
juntariman

I think the folders i'm referring to are virus/trojans. It keep on reappearing on my drives. It causes my system to stall after attempting something on my system. I can hear error warning sounds then shortly my laptop hangs.

I'll scan again my system with MalwareBytes...
16.05.2010, 05:34
juntariman

Вложений: 1

Here's the new log for Malwarebytes...
16.05.2010, 11:07
Rene-gad

When would like to begin to read our recommendations?
[QUOTE]- Make a new AVPTool log file.[/QUOTE]
????
[QUOTE=juntariman;637477]I think the folders i'm referring to are virus/trojans.[/QUOTE]
What kind of external drives are there? If they are HDDs - it's OK, for flash memory drives it's suspicious.
16.05.2010, 15:53
juntariman

The RECYCLER folder are all in my local drives C,D,E and in my 2 external HDD (toshiba & WD passport).

This is the symptoms:

[LIST=1][*]I can hear ERROR tones, something like the virus is trying to modify or trying to enter into in my machine;[*]Moments later, I can notice that the temperature of my laptop is increasing(meaning it's getting hotter);[*]If i'm not going to delete the RECYCLER folder in my local folder, the machine will come into halt or hang. But if i can delete all the RECYCLER folders, then my system will continue to run.[/LIST]
I have no other thought but a virus is modifying or doing something in my system which in turn blocked the attempt.

[size="1"][color="#666686"][B][I]Добавлено через 8 минут[/I][/B][/color][/size]

I'm doing a new scan now using the AVZ AV tool...
16.05.2010, 17:25
juntariman

Here's the new AV tool log file...
16.05.2010, 20:17
Rene-gad

[QUOTE=juntariman;637926]Here's the new AV tool log file...[/QUOTE]Pls. make 3 logs similar to the logs in your 1st message.
[QUOTE=juntariman;637873][*]I can hear ERROR tones, something like the virus is trying to modify or trying to enter into in my machine;[/QUOTE]It's paranoia
[QUOTE=juntariman;637873][*]Moments later, I can notice that the temperature of my laptop is increasing(meaning it's getting hotter);[/QUOTE]the same
[QUOTE=juntariman;637873][*]If i'm not going to delete the RECYCLER folder in my local folder, the machine will come into halt or hang. But if i can delete all the RECYCLER folders, then my system will continue to run.[/LIST]
[/QUOTE]You need a doctor, not your notebook
17.05.2010, 19:36
juntariman

Tell me you're joking!!!!! Anyway, here again the logs:
17.05.2010, 20:34
Rene-gad

Remove ALL antimalware tools you've installed excepted ONLY McAfee Antivirus and Malwarebytes Antimalware!!!
18.05.2010, 20:34
CyberHelper

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]61[/B][*]В ходе лечения вредоносные программы в карантинах не обнаружены[/LIST]