Malware Persisting after READ AND RUN ME process

jamesmmason · Feb 8, 2010

1 of 2

Hi, please can you help. I have followed the very helpful “READ AND RUN ME FIRST” thread http://forums.majorgeeks.com/showthread.php?t=35407 by Chaslang, and now have a number of logs for review.

In summary, I have been running a Windows XP Media Center laptop (Advent Intel Celeron M420 2.6 GHz) from home for a few years without any significant issues. Currently Windows SP3 is installed, and Windows Firewall is the one and only firewall. AVG free v.8.5 was the only anti-virus software (though it has since been removed, so none is currently installed). There is only one PC using the internet connection that I am aware of, which is provided in the UK by Sky Broadband. Though I do have wireless capability, I use a wired connection through the LAN. There is only one user account, “Catherine”, and the “Guest” account is switched off. There are a few individuals who periodically log on to the “Catherine” account within the house though.

Over a week ago, Google searches through my browser Firefox v.3.5.7, once I selected a link, started being re-directed to bizarre pages unrelated to my search, for example “China online”, and “triplexfeeds”.
I followed the “READ AND RUN ME FIRST” guidelines referenced above, and Trojan and Rootkit malware were identified. Following removal of all the malware, I upgraded by AVG free anti-virus from v.8.5 to v.9.0.

Over the last week everything appeared to be back to normal except that the PC was noticeably (20-50%) slower than before, and that when I logged on my PC the Windows Firewall was turned off, and even when I turned it back on, it would periodically turn itself off again (or something was turning it off!).
I searched the internet for some diagnosis of the Firewall problem, but before I could find a satisfactory answer, a new and more severe problem started occurring – a dialog box in the name of “NT AUTHORITY/SYSTEM” flashed up, and advised of system error 1073741819, which meant the PC would reboot in 60 seconds. Having done some testing, it appears that the message came up every session, within a few minutes of my internet connection being active. I uninstalled AVG free 9.0, to see if this had any impact, and it did solve the PC speed problem, the PC going back to it’s original speed of the last few years, but the automatic shut down problem persisted.
At this point, I again followed the “READ AND RUN ME FIRST” instructions, and the process did again uncover malware some of which may have persisted from the first batch of scanning a week earlier (eg I think 4DW4R3c.dll also featured in the original scans first time round).

Currently I have run all the steps, and the PC generally, and internet searches also, both appear fine, but I have not yet installed a replacement anti-virus package for the AVG free which I removed. Please could you help me to:

1) Confirm that based on the attached logs, I have done everything required to rid my PC of malware;
2) Suggest if possible a free anti-virus product that can reliably be used without significantly impairing my PC’s speed (AVG free 8.5 was fine for the last year or so, AVG free 9.0 appeared to slow the PC);
3) Advise if I should take any additional steps to safeguard my particular PC (I have already read the general advice given in the “READ AND RUN ME FIRST” guidelines).

Many thanks for taking the time to look into this and help me – it is much appreciated.
James.

jamesmmason · Feb 8, 2010

2 of 2

Following my post above, please find attached the 5th log file, for MG Tools.

Many thanks,
James.

TimW · Feb 9, 2010

Why am I not seeing any Anti-virus software on this system?

Do you know what this is for:
c:\windows\Setup1.exe ?? --> this could be either legit or malware. If you don't know, leave it in the below fix along with the other files listed. ( Do not include my red notes into the fix when you copy and paste).

The scans took care of most of it, but let's do this:

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
Code:
KILLALL::

File::
C:\WINDOWS\0.log
C:\WINDOWS\asym.ini
c:\windows\DUMP7eb5.tmp
c:\windows\system32\32D.tmp
c:\windows\Setup1.exe [COLOR=DarkRed]( remove it if you know what this is )[/COLOR]

Folder::
C:\Documents and Settings\Catherine\Local Settings\temp\MSOHTML1

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,"
* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe

* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

jamesmmason · Feb 9, 2010

Hi TimW,

Many thanks for the analysis and quick response. I'm attaching the two requested files after having followed your guidelines.

My PC is running as well as ever - in fact it is perhaps running faster than ever, since I uninstalled AVG 9.0 a few days ago. I realise I should have an anti-virus package - just not sure which one is best suited to my machine (ie does the job without slowing things down too much!).
I'll keep Super AntiSpyware and Malwarebytes AntiMalware on my machine, as well as Ad-Aware, so any anti-virus that you believe compliments these would be ideal. I've lost a little faith in AVG given that I had when I got the virus, and it only detected problems after the virus had taken root.

Many thanks for all help so far,
James.

TimW · Feb 11, 2010

Your logs are clean. I would suggest that you dump Ad-Aware as it is virtually worthless these days. Do read the last link I give you in the below final cleanup instructions.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures ian step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore ato create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

jamesmmason · Feb 11, 2010

Hello TimW,

Many, many thanks for all your help, and your excellent response times. My computer is now running better than ever, and I have taken on board the advice regarding anti-virus and other software, to hopefully ensure my computer does not have any problems in the future.

Much appreciated,
James.

TimW · Feb 11, 2010

You are most welcome....safe surfing.

Log in or Sign up

Malware Persisting after READ AND RUN ME process

jamesmmason Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 02-08-2010 - 18-12-20.log

mbam-log-2010-02-08 (18-29-58).txt

Combo Fix log.txt

RootRepealLog.txt

jamesmmason Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

jamesmmason Private E-2

Attached Files:

MGlogs.zip

ComboFix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

jamesmmason Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Malware Persisting after READ AND RUN ME process

jamesmmason Private E-2

Attached Files:

jamesmmason Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

jamesmmason Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

jamesmmason Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches