Cannot Remove OpenCloud AV Spyware

I have a client's laptop (running Windows 7 Ultimate) that was infected with OpenCloud AV spyware. I tried to download and run Malware Bytes. It installs and updates just fine, but then the program abruptly shuts down after less than 1 minute. Ditto for SuperAntiSpyware. This happens even in Safe Mode.

Client already had a paid version of AVG Anti-Virus installed. However, when I try to run a scan, it says "No infection was found during this scan" after less than 10 seconds of scanning. So it seems that the spyware infection is tricking AVG into thinking it did a full scan when it obviously did not.

I tried to run ComboFix but got a warning that it would not run unless I first uninstall AVG. However, I get an error message when I try to uninstall AVG, so that failed.

I found that the shortcut link for OpenCloud AV points to annGG4ammHsWjfL.exe under Windows\System32\ so I deleted that file and rebooted. But still having all the above problems.

Running RKill doesn't find any illegal processes.

Feeling really stuck here. How can I get rid of this infection?
anuneznycAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AlienwalkerCommented:
Hi anuneznyc,

There is an auto remove OpenCloud AV spyware if you google for it.

Boot into safe mode, can you run your AV from there?

To manually delete av files and dlls look for;

%LocalAppData%\<random>.exe
 %StartMenu%\Programs\OpenCloud AV\
 %StartMenu%\Programs\OpenCloud AV\Buy OpenCloud AV.lnk
 %StartMenu%\Programs\OpenCloud AV\Launch OpenCloud AV.lnk
 %System%\drivers\<random>.sys
 %UserProfile%\Desktop\Buy OpenCloud AV.lnk

Unregister OpenCloud AV registry values:

HKEY_CLASSES_ROOT\CLSID\{19090308-636D-4e9b-A1CE-A647B6F794BF}
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{19090308-636D-4e9b-A1CE-A647B6F794BF}

You may have to kill Openclouds process first (crss.exe)  

note: Please check to see in Internet Explorer there is no proxy setting set in lan settings (a symptom of opencloud)

further reading: http://www.net-studio.org/eng/patch/patch/315-free-removal-tool-for-opencloud-antivirus.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Adam LeinssServer SpecialistCommented:
Scan the laptop offline with Microsoft Standalone System Sweeper:

http://connect.microsoft.com/systemsweeper
0
anuneznycAuthor Commented:
Thanks for the advice, guys. I cannot seem to kill either instance of csrss.exe.

I am now running a full scan with Microsoft Standalone System Sweeper. Will update when it's finished.
0
anuneznycAuthor Commented:
Microsoft Standalone System Sweeper finished its scan. It found & removed 2 infections:

1. Rogue:Win32/FakeScanti
2. TrojanDropper:Win32/Sirefef.I

I wrote down the details for the files/directories infected by the 2nd one:
\users\thinkpad\appdata\local\temp0.24064498337964824.exe
\users\thinkpad\appdata\locallow\sun\java\deployment\cache\6.0\12\6b7fb14c-44fa79d3
\windows\temp\9b88.exe

I was hoping that removing these 2 infections would solve the problem. But it hasn't b/c when I try to install & run Malwarebytes, again it only scans for less than 20 seconds and then abruptly shuts down. So seems like there is definitely some infection left over.

Right now I'm using a copy of Trinity Rescue Kit (http://trinityhome.org/) to run a full scan using Avast AntiVirus. However, I think I will ultimately have to edit the registry entries to remove the references to the infected processes that are launching every time I boot Windows. I will need to use an offline registry editor. Is there one of those on the Ultimate Boot CD for Windows??

0
anuneznycAuthor Commented:
Thanks Alienwalker. Running that free removal tool from the link you sent me seems to have finally killed off this nasty malware. I am now able to run Malwarebytes with no problems. Thanks!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.