Computer Infected, Crashes to blue screen when running virus scans

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Haigen, Feb 7, 2009.

  1. Haigen

    Haigen Private E-2

    Well my mothers computer is infected and it has multiple priblems. Ill list the problems from minor annoyances to big issues.

    Well i ran the Read and run first; however I cannot scan my computer for viruses because when i scans and finds a certain virus the computer goes to a blue screen. I ran combofix.exe, buy it could not create a log for the scan; however i did copy down a few files it got rid of.

    Rootkit files combofix got rid of -
    C:\WINDOWS\system32\Drivers\senekalfrqtmdb.sys
    C:\WINDOWS\system32\senekagixdltkk.dll
    C:\WINDOWS\system32\senekavmyvkrhd.dat
    C:\WINDOWS\system32\senekahldanmxm.dll
    C:\WINDOWS\system32\senekaqrisyxui.dll
    C:\WINDOWS\system32\senekayuonspal.dat

    In addition, Mozilla firefox will close as soon as i type in a url and press enter.
    IE7 does the same thing.

    The only logs i could get were from mgtools. Any time i run a virus scan my computer would crash and goto a blue screen.

    I am using Windows XP Home Edition

    Well i attached the MGtools logs as that is the only thing i could get.

    Help would be appreciated if you need anymore information please do tell i will attempt to be as helpful as you always are.
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please follow the below instructions to help you attempt to properly run the READ & RUN ME. We need all of the scans to run and we need the logs from them. A log from MGtools alone will not be adequate as it is not a removal tool. It is primarily an information collector. Note the instructions for using SUPERAntiSpyware give you suggestions on what to do if a crash occurs.



    Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.
    • If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.
    • If something does not run, write down the info to explain to us later but keep on going.
    • Do not assume that because one step does not work that they all will not.
    READ & RUN ME FIRST. Malware Removal Guide
    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:


    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
     
  3. Haigen

    Haigen Private E-2

    Ok I ran the scans in safemode, thanks for reminding me of that. I got all of the logs now :D I am attaching them now.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    PLase do the below from Normal boot mode if possible.

    Uninstall the below old versions of software:
    Java(TM) 6 Update 11
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3
    Java(TM) 6 Update 7

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {43A03871-181F-4954-929E-8FF71E69C470} - (no file)
    O2 - BHO: (no name) - {54C668FE-54F0-4F9C-8DE2-EF46EF10D828} - (no file)
    O2 - BHO: (no name) - {76FA234D-C471-4A90-B2EE-4315D6E78286} - (no file)
    O2 - BHO: (no name) - {7F56A0EE-31CE-4CBE-B23B-3A6A2AE7C930} - C:\WINDOWS\system32\awtsSmNh.dll (file missing)
    O2 - BHO: (no name) - {86B303B2-E903-4483-8913-5A2506A942CB} - (no file)
    O2 - BHO: (no name) - {86CC9137-8DF5-422F-8C1A-59A49F7F5093} - (no file)
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} -
    O20 - Winlogon Notify: cbXOFvVO - cbXOFvVO.dll (file missing)
    O20 - Winlogon Notify: fccbBTLb - fccbBTLb.dll (file missing)

    After clicking Fix, exit HJT.

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run SUPERAntiSpyware and first Update it to the current database as you were way out of date. Then run a new scan and fix all that it finds.

    Now run Ccleaner!

    Now goto this link Using MGtools and download the new version of MGtools.exe from the black bold print link in the first sentence. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe then attach the below logs:
    • C:\ComboFix.txt
    • the new SUPERAntiSpyware log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds