smitfraud c generic again

Hmm! It appears that you go the pihar infection back again. Your TDSSKiller logs showed the below again:

Code:

19:24:40.0570 5596  \Device\Harddisk1\DR1\# - copied to quarantine
19:24:40.0591 5596  \Device\Harddisk1\DR1 - copied to quarantine
19:24:40.0979 5596  \Device\Harddisk1\DR1\TDLFS\cmd.dll - copied to quarantine
19:24:40.0981 5596  \Device\Harddisk1\DR1\TDLFS\cmd64.dll - copied to quarantine
19:24:40.0990 5596  \Device\Harddisk1\DR1\TDLFS\drv32 - copied to quarantine
19:24:40.0996 5596  \Device\Harddisk1\DR1\TDLFS\drv64 - copied to quarantine
19:24:40.0998 5596  \Device\Harddisk1\DR1\TDLFS\servers.dat - copied to quarantine
19:24:40.0999 5596  \Device\Harddisk1\DR1\TDLFS\config.ini - copied to quarantine
19:24:41.0000 5596  \Device\Harddisk1\DR1\TDLFS\ldr16 - copied to quarantine
19:24:41.0196 5596  \Device\Harddisk1\DR1\TDLFS\ldr32 - copied to quarantine
19:24:41.0200 5596  \Device\Harddisk1\DR1\TDLFS\ldr64 - copied to quarantine
19:24:41.0212 5596  \Device\Harddisk1\DR1\TDLFS\s - copied to quarantine
19:24:41.0221 5596  \Device\Harddisk1\DR1\TDLFS\ldrm - copied to quarantine
19:24:41.0266 5596  \Device\Harddisk1\DR1 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot
19:24:41.0267 5596  \Device\Harddisk1\DR1 - ok
19:24:46.0816 5596  \Device\Harddisk1\DR1 ( Rootkit.Boot.Pihar.c ) - User select action: Cure 

Rerun a new scan with TDSSKiller. Be sure to redownload the most recent version just to make sure you have the current one. Then attach the new log.

Yes the C:\Windows\svchost.exe file is back too. I want to see the results of the new TDSSKiller scan before continuing to try and fix this. Also do the below.

Please download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
• Click the Scan button to start the scan
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

 

Once you have used the trial on any given PC, the trial is over. If you want to have active antimalware protection from it, you will have to buy it.



Uninstall the below old versions of software:
Java(TM) 6 Update 31

Please download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe and select Run as administrator to run it.
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe
 
:Files
C:\TDSSKiller_Quarantine
C:\Users\Epiyon\AppData\Local\Temp\7994481B-E832-4F7A-8CD4-491B3BA6370B.exe
C:\Users\Epiyon\AppData\Local\Temp\Low
C:\Users\Epiyon\AppData\Local\Temp\REG9C8E.tmp
C:\Users\Epiyon\AppData\Local\Temp\REGA0D2.tmp
C:\Users\Epiyon\AppData\Local\Temp\tmp5EC2.tmp
C:\Users\Epiyon\AppData\Local\Temp\tmp5EC2.xml
C:\Users\Epiyon\AppData\Local\Temp\tmp5EC3.tmp
C:\Users\Epiyon\AppData\Local\Temp\~DFF51BFFF50F7C955D.TMP
C:\Windows\svchost.exe
 
:Reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
:Commands
[purity]
 
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.


After reboot, run a new scan with RogueKiller and save a log as in original instructions and attach the new log.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• the C:\_OTM\MovedFiles log
• the new RogueKiller log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You're right. It is incomplete. Let's try again with a newer version. After downloading it, be sure to shutdown you protection software before running it.
Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


Now attach the below log:

• C:\MGlogs.zip

You did not tell me how things are working.

People get it any number of ways. Many times it is thru some form of torrent downloading, sometime playing at online gaming sites which are not necessarily very secure, access sites of questionable nature, opening emails with attachments ( Even if from a friend! They may never have checked it to make sure it is clean. ), not keeping your PC updated, not keeping your PC properly protected.......etc.


I find that Internet Explorer is more secure than Chrome or Firefox. We have more issues here with those browsers than we do with IE.

 

Try disabling or uninstalling Norton or download MGtools using another PC and then copy to this PC so that you can run it.

If you continue to have problems with Norton not running then you definitely need to uninstall it.

 

It probably would have been better to uninstall Norton and leave it uninstalled until we are finished. It may be getting in the way of cleanup. I still see the C:\Windows\svchost.exe infection that OTM tried to remove and Norton could have prevented the removal.

Let's get a new version of TDSSKiller downloaded and run a new scan. Attach the log here.

Then continue on with the below.

• Make sure that Norton is either fully disabled or uninstalled.

• Right-click OTM.exe and select Run as administrator to run it.
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe
:Files
C:\MGtools_exe.43fexcj.partial
C:\MGtools_exe.cawr2bb.partial
C:\MGtools_exe.ke1bfpn.partial
C:\MGtools_exe.v3jkrll.partial
C:\MGtools_exe.vskug21.partial
C:\Windows\svchost.exe
:Commands
[purity]
[EmptyTemp]
[start explorer]

[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.


Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• the new TDSSKiller log
• the C:\_OTM\MovedFiles log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Don't change anything right now.

Yes both ways.

Right now the C:\Windows\svchost.exe file is gone. The new TDSSKiller showed that the below was detected again and was removed

Code:

00:18:53.0908 4020  \Device\Harddisk1\DR1\# - copied to quarantine
00:18:53.0908 4020  \Device\Harddisk1\DR1 - copied to quarantine
00:18:53.0938 4020  \Device\Harddisk1\DR1\TDLFS\cmd.dll - copied to quarantine
00:18:53.0938 4020  \Device\Harddisk1\DR1\TDLFS\cmd64.dll - copied to quarantine
00:18:53.0948 4020  \Device\Harddisk1\DR1\TDLFS\drv32 - copied to quarantine
00:18:53.0948 4020  \Device\Harddisk1\DR1\TDLFS\drv64 - copied to quarantine
00:18:53.0948 4020  \Device\Harddisk1\DR1\TDLFS\servers.dat - copied to quarantine
00:18:53.0948 4020  \Device\Harddisk1\DR1\TDLFS\config.ini - copied to quarantine
00:18:53.0948 4020  \Device\Harddisk1\DR1\TDLFS\ldr16 - copied to quarantine
00:18:53.0958 4020  \Device\Harddisk1\DR1\TDLFS\ldr32 - copied to quarantine
00:18:53.0958 4020  \Device\Harddisk1\DR1\TDLFS\ldr64 - copied to quarantine
00:18:53.0958 4020  \Device\Harddisk1\DR1\TDLFS\s - copied to quarantine
00:18:53.0988 4020  \Device\Harddisk1\DR1\TDLFS\ldrm - copied to quarantine
00:18:53.0988 4020  \Device\Harddisk1\DR1\TDLFS\u - copied to quarantine
00:18:53.0988 4020  \Device\Harddisk1\DR1 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot
00:18:53.0988 4020  \Device\Harddisk1\DR1 - ok
00:18:59.0518 4020  \Device\Harddisk1\DR1 ( Rootkit.Boot.Pihar.c ) - User select action: Cure 

If you run TDSSKiller again, does the above show up still or is it clean now?

 

Good.

It would not hurt to run a few things after booting from the Windows XP paritition. Download and save MGtools.exe, TDSSKiller and RogueKiller to the Desktop of the WinXP user account that you use and then run new scans. Attach the new logs.

 

Yes looks good. Yes you need yo get properly protected. That is included in the below which you need to run on both the Win XP and Win 7 boot partitions. Make sure you complete ALL steps and get old restore points removed where stated.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
3. Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!