Malware mostly fixed, still have some redirect problems

Let's start with this:

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now use windows explorer to find and delete:
c:\docume~1\Trish\LOCALS~1\Temp\nvsvc32.exe

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!


Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
• If TDSSKiller does not run, try renaming it.
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
• Click the Start Scan button.
• Do not use the computer during the scan
• If the scan completes with nothing found, click Close to exit.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_14.17.05_log.txt) will be created and saved to the root directory ( usually Local Disk C ).
• Attach this log to your next message

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Try removing those HJT items again:

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now use windows explorer to find and delete:
C:\Documents and Settings\Trish\Local Settings\temp\7zS9.tmp
C:\Documents and Settings\Trish\Local Settings\temp\7zSA.tmp

Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  
  • Done! Press ENTER to exit...
  
  
• Or you will see more information like below if a problem is found:
  
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  
  
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message.

Now ( With AVG uninstalled ) re-run ComboFix. Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:
* MBRCheck log.
* C:\ComboFix.txt
* C:\MGlogs.zip

 

Yes, the hidden run keys are still being an issue. Let's try combo:

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
c:\docume~1\Trish\LOCALS~1\Temp\nvsvc32.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"4h41Z4HpEhduxyXdtYSJsoO1s4ST4oRQWH7sxxhy9itUOE9VSH81lBJXSBMBAQA7=="=-
"4h41Z4HpEhduxyXdtYSJsoO1s4ST4oRQWH7sxxhy9itUOE9VSH81lBJXSBMBAQA7=="=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"4h41Z4HpEhduxyXdtYSJsoO1s4ST4oRQWH7sxxhy9itUOE9VSH81lBJXSBMBAQA7=="=-
"4h41Z4HpEhduxyXdtYSJsoO1s4ST4oRQWH7sxxhy9itUOE9VSH81lBJXSBMBAQA7=="=-

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe

* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

The Comodo scan is mostly finding files in the quarantine folders as well as a few false positives.

Please boot into the other user account ( Marianne ) and then do this:

Download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe And select " Run as administrator " to run it.
• Paste the following code under the area. Do not include the word Code.

Code:

:Reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "4h41Z4HpEhduxyXdtYSJsoO1s4ST4oRQWH7sxxhy9itUOE9VSH81lBJXSBMBAQA7=="=- "4h41Z4HpEhduxyXdtYSJsoO1s4ST4oRQWH7sxxhy9itUOE9VSH81lBJXSBMBAQA7=="=-  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "4h41Z4HpEhduxyXdtYSJsoO1s4ST4oRQWH7sxxhy9itUOE9VSH81lBJXSBMBAQA7=="=- "4h41Z4HpEhduxyXdtYSJsoO1s4ST4oRQWH7sxxhy9itUOE9VSH81lBJXSBMBAQA7=="=-

:Commands
[purity]
[ResetHosts]
[createrestorepoint]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.

 

It is possible that you are having system errors. Please run MGTools on the Marianne account and attach the log.

 

Your system is in bad shape. I don't know if we can get you clean, but let's try.

What is this:
C:\Documents and Settings\Marianne\Application Data\hotfix.exe?

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\WINDOWS\system32\unzhk7b3.dll, SystemServer
C:\WINDOWS\system32\ygd5j6irdw.dll, SystemServer
C:\DOCUME~1\Marianne\LOCALS~1\Temp\x5frjwxr9.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\mitvsjh.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\system.exe
C:\WINDOWS\win.exe
C:\WINDOWS\user.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\debug.exe
C:\WINDOWS\login.exe
C:\WINDOWS\hexdump.exe
C:\WINDOWS\install.exe
C:\WINDOWS\wininst.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\lsass.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\avp32.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\setup.exe
C:\WINDOWS\mdm.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\gdi32.exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\iexplarer.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\sysedit.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\gdi32.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\hexdump.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\user.exe
C:\DOCUME~1\Marianne\LOCALS~1\Temp\mdm.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\nvsvc32.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\win16.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\user.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\system.exe
C:\WINDOWS\avp.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\taskmgr.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\iexplarer.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\setup.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\csrss.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\hexdump.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\sysedit.exe
C:\WINDOWS\cmd.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\login.exe
C:\WINDOWS\winamp.exe
C:\WINDOWS\services.exe
C:\WINDOWS\taskmgr.exe
C:\WINDOWS\debug.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\avp.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\win32.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\cmd.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\spoolsv.exe
C:\WINDOWS\winlogon.exe
C:\WINDOWS\drweb.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\avp32.exe
C:\WINDOWS\setup.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\mdm.exe
C:\WINDOWS\avp32.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\nvsvc32.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\debug.exe
C:\WINDOWS\spoolsv.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\smss.exe
C:\WINDOWS\win32.exe
C:\DOCUME~1\Trish\LOCALS~1\Temp\winamp.exe
C:\WINDOWS\sysedit.exe
C:\WINDOWS\system.exe

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe

* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Let's try Avenger.

Now download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):
* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Some of the problems are system wide. That could indicate some registry corruption. It would be a good idea to delete the Marianne account and create a new one. In the meantime, boot back to the other account and get me a new MGLogs. so I can see what is corrupt in that account.

 

Both accounts have the same problem. Neither account will populate the newfiles log. Plus the same items are appearing in each that we have tried to remove before. We are thinking that there is some registry corruption that may be causing this, which may indicate that it would be best to consider doing a clean install.

 

You are most welcome. Yes, it is an issue within the windows system, so you can back up those files and personal info. Just make sure you scan your backup media before you transfer it all back.