Trying to remove particularly nasty malware

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by NukeRiskGuy, Aug 19, 2011.

  1. NukeRiskGuy

    NukeRiskGuy Private E-2

    Per the instructions posted in this forum, I have started the process of trying to remove a malware infection. Note that I am using Google Chrome.

    First, to fix Google redirection problem:
    Step 1:
    a) Java version was old and there was no 'General Tab'
    b) Firefox not installed
    c) IE files deleted
    d) DNS cache flushed

    Step 2:
    Not a hardware / router issue

    Step 3:
    No Firefox installed

    Step 4:
    a) TDSKiller self-terminated after approximately one second
    b) renamed TDSKiller.exe to booger.com and it also self-terminated after approximately one second

    Step 5:
    Ran MBRCheck and an abnormality was found.

    Attached are the log files from the above steps. I will continue with the Malware Removal guide and provide updates in this thread as I go.

    Thanks in advance,
    NukeRiskGuy
     

    Attached Files:

  2. NukeRiskGuy

    NukeRiskGuy Private E-2

    Background information:
    The infected PC is my sister-in-law's; earlier this week, I tried some various tools to try and fix the computer (including some of the tools that this forum had me use). From what she tells me, the problem occurred on August 6 when she clicked on a link found in an e-mail. She was not more specific and I will note that she still uses Outlook Express which I imagine is not very secure. I have convinced her and her husband to use web-based e-mail and not to click on "weird" links in e-mail messages regardless of whom the message appears to be from. Initial symptoms were the XP Antivirus 2012 pop-ups (which I were able to remove) and "Zentom System Guard" which I at least partially removed.

    I performed all steps under Windows XP Malware Removal Guide:

    a) SuperAntiSpyware installed and updated itself, after running for a few minutes it self-terminated before it was done. It had found a few things, but I did not note what they were and then I could not re-run the program. So, I ran a portable version from my USB drive and with the help of my cellphone camera, found the following items before self-terminating again:
    - Disabled.SecurityCenterOption [2 items]
    - Trojan.Agent/Gen [7 items]
    - Adware.MyWebSearch/FunWeb/Products [127 items]

    b) MalwareBytes started to run and terminated itself after a few seconds

    c) ComboFix would not run

    d) RootRepeal would not run

    e) MGTools ran with one error message (below) and MGLogs.zip is attached:
    "nslookup.exe - Ordinal Not Found
    The ordinal 1108 could not be located in the dynamic link library WSOCK32.DLL"

    One other thing: even after deleting them, the following two files re-create themselves in the Windows root directory:

    >> 2706881411 (with no file extension)
    >> 0.log

    They are each zero bytes and have the same date/time stamp.

    Thanks in advance for your help,
    NukeRiskGuy
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    There is a strong possibility that MBRcheck is showing you have a Master Boot Record infection.
    • Does this PC have an non-standard partitions or multi-boot setups for different OS'?
    • Do you have important data backed up?
    • Do you have your Windows XP boot CD so that it can be used to boot to the Recovery Console to repair the MBR?
     
  4. NukeRiskGuy

    NukeRiskGuy Private E-2

    This is a Dell computer and it has some sort of hidden partition for a system restore or something. I don't care about the data on that partition.

    Have not yet backed up important data - as I stated, this is my sister-in-law's computer but I did bring it over to my house so backing up the data will not be a big deal.

    For the Recovery Console, can it be any XP CD? If so, I have one here at the house. If not, I can get the one I need tomorrow.

    Thanks,
    NukeRiskGuy
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes you should be able to boot from any Windows XP boot CD to do this. And yes Dell does install a special partition containing a Factory Recovery image which could be messed up when we repair the MBR to be a standard Windows MBR. You don't have much of a choice though since you are still having problems with redirection. You can either restore to the factory ship state and lose everything installed and configured since that date, or you can try fixing the MBR and see what happens.

    Try booting the CD to get into the Recovery Console.

    See the How to use the Recovery Console section in the below link if you are not sure how to do this:

    http://support.microsoft.com/kb/307654


    Once you are at the command prompt type the below command and hit enter:

    fixmbr

    It will likely warn you about your non-standard MBR from Dell. Just continue anyway. Then type exit to reboot. Remove the CD and boot normally.

    Then rerun MBRcheck and attach a new log.

    Then also tell me whether you are still having any problems.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds