Ain't I lucky?... I got MALWARE!! HELP!!

[danko26]

Hello there majorgeeks admins and general helpers. I am sitting here by my parents' computer and let me tell you, was I relieved to find a site that helps semi-pro geeks like me with their malware problems. This computer has been infected for almost three weeks now, 1.5 of them with a weird system error that didn't even allow windows to boot and kept restarting the computer.
Well, I finally found the time to come over and look at it properly, fixed the OS and then got stumped. Weird messages about the computer being infected with all sorts of things constantly popping up and directing me to spyware and anti-virus commercial sites, my IE home page hijacked without any hostage-taker demands to negotiate its safe return, and my mother's account desktop display showing a big red bio-hazard sign (with yet another automatic refferal to those damn sites), scaring her into not touching the computer or even entering the room it's in. So I started with some preventive
measures:
a) Ran a full system scan with my norton anti-virus.
b) Disabled my mother's administrative status (worst infected user).
c) Tried to hunt down the malware in the registry and deleting and removing any suspicious programs and files (while backing up in advance, of course).

These steps helped me fix the problem once before.
But not now.
So I Googled one of those damn program names and found you guys.
I'm not used to asking for help in these matters, so I read as much as I could and then went ahead and performed all the preliminary scans and got all the log-files ready for delivery. Took me all night and I simply went to sleep for a few hours somewhere in the middle of this.
This process did not seem to completely solve my problems. First, the main message that kept popping up during all the hasle popped up once more after rebooting(even if only once - that in itself is a blessing), then my norton keeps informing me, about every minute, that it's blocking a trojan horse (although I don't get how one of those could fit through the doorway, let alone the LAN cable ).
So now here I am, submitting this thread, asking for HELP!!
Some info: OS is WinXPpro, there are five users, Norton anti-virus installed and running. Oh, and I'm writing to you from Israel, so we may not be exactly in sinc concerning waking hours.
Anyway, this is it and I'm thanking all of those willing to help in advance. You are performing a great service, world-wide.

[danko26]

P.S. : I seem to have some extra trouble with my windows explorer. It closes any open directories every couple of minutes. Another symptom of "whatever", no doubt.

[danko26]

Second batch of scan-files.

[chaslang]

Welcome to Major Geeks!


Start by uninstalling the CounterSpy trial program now since we are finished with it. Then delete the below folders which may be left behind by the uninstall:
C:\Documents and Settings\Danny\Application Data\Sunbelt Software
C:\Documents and Settings\All Users.WINDOWS\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log ( C:\combofix.txt ) for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT
4. the ComboFix log

Make sure you tell me how things are working now!

[danko26]

Hi there.
This being Israel and all, our work-week starts at sunday, so I won't be near my parents' computer till "Erev Rosh Hashana" (Jewish New Year's Eve).
...
...
Which will be on Wednesday!!!
So I'll post you then.
Thank you very much and HAPPY NEW YEAR!!

[chaslang]

You're welcome. Just post when you can and enjoy the new year.

[danko26]

Hello again!
I did as asked, that is I removed CounterSpy and ran the ComboFix.
So far, it seems that the fix worked and that my parents' computer is clean once more. Here are the logs.
'Shana Tova' and thanks again!

[danko26]

And here are the rest:

[chaslang]

You are basically clean. We just have something to fix with HJT and then on to my final steps.
Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

After clicking Fix, exit HJT.


If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, and the C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
7. If we had you run Avenger, you can delete all files related to Avenger now.
8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
9. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
10. If you are running Windows XP or Windows ME, do the below:
    • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

[danko26]

Thank you, chaslang.
I have taken all appropriate steps to insure this will not happen again.
Everything seems to be O.K. now.
Allthough there seems to be one other problem: When I fixed the computer after the first infection and general meltdown I had to fix the Windows using the installation disk. Now I continually get a windows update icon that informs me that I need to install windows installer 3.1 .
I know for a fact that this is an important update, but it seems to be unable to install itself in this computer. Any thoughts?
And again, thank you for your help.

[chaslang]

You're welcome.

Originally Posted by danko26

Allthough there seems to be one other problem: When I fixed the computer after the first infection and general meltdown I had to fix the Windows using the installation disk. Now I continually get a windows update icon that informs me that I need to install windows installer 3.1 .
I know for a fact that this is an important update, but it seems to be unable to install itself in this computer. Any thoughts?

You could try downloading and manually installing from the below link:

http://www.microsoft.com/downloads/d...displaylang=en


If that does not help, you will have to post in the Software Forum. Note using your Windows Installation disk to repair Windows puts everything back to the date of the files on your Windows CD. Thus you may need a lot of other updates. Make sure you have checked.