trojan dns changer Vista Cleaning Procedure, Malwarebytes Anti-Malware

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by arnie4, Jun 2, 2009.

  1. arnie4

    arnie4 Private First Class

    Hello there on major geeks, firstly thanks for reading this, also thanks for all the help you have given me in the past, as its work for me.

    I am following the instructions on how to Vista Cleaning Procedure, for the virus called Trojan dns changer, i have managed to run the SUPERAntiSpyware, and it did find a few things, but now i cannot load Malwarebytes Anti-Malware, i have managed to install it, after re naming it following the instructions Rename the downloaded mbam-setup.exe file to mb.exe to help work around certain malware that will block it from being run.
    It will not run a scan at all, it just will not load, up it doesn't even say anything , like there is a problem loading it doesn't even come on the screen loading and say there is a problem loading.
    I am novice but i do follow the instructions, i even printed all the pages off this site to follow the instruction on how to remove malware.
    this Trojan is really bad , its taken my windows explorer over, seem to have better run of it for the moment, on Mozilla , as for anything else nothing. i will not let me open spybot-sd either.
    It is also telling me,the dns is wrong. I know whats causing the problem,its just that i really am stuck, when the things i need to use to remove the problem,will not load.
    hope you understand what i have written, and thanks for any help you mite have for me. Arnie
     
  2. arnie4

    arnie4 Private First Class

     
    Last edited: Jun 2, 2009
  3. arnie4

    arnie4 Private First Class

    here is the log file from superantispyware
     

    Attached Files:

  4. arnie4

    arnie4 Private First Class

     
  5. arnie4

    arnie4 Private First Class

     
  6. arnie4

    arnie4 Private First Class

    ]here is the log file from superantispyware, and 3 others that i have managed to"
     

    Attached Files:

  7. arnie4

    arnie4 Private First Class

    there is the log file from superantispyware, other things

    i cannot do are, use Internet Explorer.
    when i do use it, i get directed to other web sites

    I have only just in the last few hours been able to use Mozilla firefox.
    it keeps trying to stop me from scanning saying things like, this program has failed,
    it did try to do that as i am scanning with trend micro , it say java script has failed!
    every time i got to a site which is anti spyware, it sends me to a different site!
    thats has much as i can think of
    thank you for taking the time to help me! :)

    quick up date !!!
    every Alternative Scans i have tried to use, has crashed or froze on my screen, most of the root kits have also said cannot run on this computer!
    when i go in to (system configuration) the boot mode, i cannot tick any of these boxes, as you say you need all the info!

    1)safe boot mode
    2)minimal
    3)alternate shell
    4)active directory
    5)network)
    6)no gui boot
    7)boot log
    8)blase video
    9)os boot imformation
    10)make all boot settings permanent.
    the only reason i have posted it and found this out, is because i tried to reboot in safe mode, so i just tried to see if any boxes would tick , as you can see they do not!
    cheers again .
     
  8. arnie4

    arnie4 Private First Class

     
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You will never get an answer if you keep bumping your thread, double posting and not following these instructions:

    Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

    • If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First. If TDSSserv is not found, just continue on with the READ & RUN ME.
    READ & RUN ME FIRST. Malware Removal Guide

    • If something does not run, write down the info to explain to us later but keep on going.
    • Do not assume that because one step does not work that they all will not.
    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
     
  10. arnie4

    arnie4 Private First Class

    i was told to add what was happening to my computer, to my threads, that is why i have put it on there, Ive been told on here to try and tell them as much as possible, some of these problems i am getting are only happening when and as i use the computer each day, as for the run and read me i have tried to do, how can i do the run and read me ? ive told you why and what is happening when i do, i cannot run malwarebytes, or other scanners , i cannot even load malwarebytes , ive tried all this! so you telling me to do it all again when every day for the last 3 days i have tried everything what has been asked of me. nobody as told me why things won't load why i cannot use malwarebytes or other scanners, so please tell me how i can do all this??
    also i have copied pasted and printer every page of the run and read me first!does the instructions for the TDSSserv Non-Plug & Play Driver Disable work on the windows vista??. as it says xp on the page where the instructions are. and if it does not work, then the run and read me still won't work as i have already done all of that and yes of course i have done the things on every single on of the scanners , they don't load or just freeze on me!
    also you tell me to post whats going wrong, then you tell me not to be bumping the the it as thread. so what am i supposed to do when you tell me that??

    thanks for what ever your doing!
     
    Last edited: Jun 3, 2009
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    What happens when you run the MGTools.exe?
    Have you reset your router to factory settings?
     
  12. arnie4

    arnie4 Private First Class

    nothing happens when i try and open the mgtools, i click on it and nothing. also i cannot find TDSSserv.sys, could there be any other name for it??,
    am not sure why you keep saying i have a router, i have a cable modem , not a router and i wouldn't know who to reset to factory settings.
    thank you
     
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Now download The Avenger by Swandog469, and save it to your Desktop.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    * Extract+ avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * -Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:


    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
    -
    Now run Ccleaner to clean out only temp files and nothing else!

    If you are able to do the above, then:
    GMER's MBR.exe

    • Double click on the MBR.exe file to run it.
    • A log will be produced & saved to the desktop, called MBR.log.
    • Attach this log to your next message.


    Now delete the current mbr.log file and then run the below instructions.
    Click Start > Run and copy & paste the following text in the code box into the Run box and then click OK. You must copy and paste or type in this exactly. The quotes must be exactly as shown and there is a space before the -f
    Code:
    
         "%userprofile%\desktop\mbr.exe" -f
    
    Now double click on the mbr.exe file and attach the new mbr.log

    Then see if you can run the scans.
     
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Don't recall if that will work in vista....so if not:

    Download Pocket KillBox

    Now run Pocket Killbox by doubleclicking on killbox.exe
    Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    Then after it deletes the files click the Exit (Save Settings) button.
    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

    Select:

    * Delete on Reboot
    * then Click on the All Files button.*(or on the folders option)*
    * Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
    * Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    * Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

    If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

    If Killbox does not reboot just reboot your PC yourself.
     
  15. arnie4

    arnie4 Private First Class

    thnaks for this , i will have to do it tomorrow now as i am very tired, ive been on here to long, so i will post when i have done these other things you have done for me. thanks again for taking the time to help me! :)
     
    Last edited by a moderator: Jun 4, 2009
  16. arnie4

    arnie4 Private First Class

    Hello Tim

    i have managed to run the mgtools program, so here is the zip file you asked me for!
    one other thing this came up in my note pad
    >>>[.ShellClassInfo]
    LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21786 <<<<
    have you any idea what this mean please??.

    I thank you again for any help. 4 days with this blinking problem, i could of just formatted my hard drive, i just cannot lose my pictures of my daughter. so please bare with doing this with you. thanks!!
     

    Attached Files:

    Last edited by a moderator: Jun 4, 2009
  17. arnie4

    arnie4 Private First Class

    i cannot turn my antivirus back on now, the trojan is preventing me from doing so. also is the mbr supposed to scan?? as it keep saying and i "quote" mbr.exe has stopped working , a problem caused the program to stop working correctly Windows will close the program and notify if you if a solution is available.
    my anti virus cannot be turned on, it keeps bloocking me from doing so. any ideas??
     

    Attached Files:

    • mbr.log
      File size:
      195 bytes
      Views:
      1
    Last edited by a moderator: Jun 4, 2009
  18. arnie4

    arnie4 Private First Class

    when i get down to this part of what your asking me to do.
    i have copied it as you said and type it in also.
    the box comes up saying are you sure you won't to run this, so i say yes , then it just goes, it seems like there is a black box coming up , like the cmd box hope that made sense
    Click Start > Run and copy & paste the following text in the code box into the Run box and then click OK. You must copy and paste or type in this exactly. The quotes must be exactly as shown and there is a space before the -f
    "%userprofile%\desktop\mbr.exe" -f
    just not going to let me do that!! thanks again :)
     
  19. arnie4

    arnie4 Private First Class

    i have been able to run the malwarebytes and also just done the combi fix. so here are the logs to go with the others.
    thank you for you help and i hope this is a good sign as i found a few download dns trojans in malwarbytes
     

    Attached Files:

    Last edited by a moderator: Jun 4, 2009
  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Now that you got MBAM to run, I need you to get a new MGLogs....so run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    * C:\MGlogs.zip

    And please refrain from quoting each of my replies, as it just makes your post more difficult to deal with.
     
  21. arnie4

    arnie4 Private First Class

    ok Tim here is the mgtools what you asked for, thanks for the help!!
     

    Attached Files:

  22. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to run CCleaner and remove all the temps in these folders:
    C:\Windows\temp\
    C:\Users\arnie4\AppData\Local\temp\

    Then go to the folders and remove everything else other than files from today's date.

    Otherwise your logs are clean. I will have you run the MGLogs once more to be sure those folders are cleaned.
    run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\MGlogs.zip
     
  23. arnie4

    arnie4 Private First Class

    Thanks for your help, have done all that and here is the log you asked me for!
     

    Attached Files:

  24. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
  25. arnie4

    arnie4 Private First Class

    thanks for all your help , really do mean that!! :):):)
     
  26. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds