MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 12-17-10, 17:46
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Infected computer, w/ questions on XP cleaning

Hello,

I followed a link to an NSFW site the other day and soon afterwards got a popup notification along the lines of "Windows system inspection has found an error" and then my browser started randomly opening windows to "anti-virus" purchase sites and redirecting google links to them as well.

I've been running through the Windows XP cleaning procedure, but seem to have gotten stuck on running combofix. I think it's because I'm not properly disabling my AV, but here's what's happening, anyway: I run combofix, it says "McAfee VirusScan Enterprise is still active, disable it". I thought I had disabled it, so doubled-checked (and found on-access scanning, and all other 'disable'-able options set to "disabled") and clicked OK. Combofix runs until it gets to this screen: http://www.bleepstatic.com/combofix/en/autoscan.jpg and then just sits there for 30 minutes at which point I manually close it. I tried running MGtools, hoping it was just something with Combofix, but MGtools also froze after about a minute of scanning through my files.

Logs from Superantispyware and Malwarebytes' attached. Should I just uninstall McAfee at this point and start over, is there a better way to disable than described above, or something else? The "How to Disable your AV" section on MajorGeek doesn't seem to cover my version of AV.

Thanks for your help!
Reply With Quote
Sponsored links
  #2  
Old 12-17-10, 17:51
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,686
Thanks: 449
Thanked 4,645 Times in 4,385 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Yes, try uninstalling McAfee. Did you try running Combo and MGTools in safe mode? Have you tried renaming them?
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #3  
Old 12-17-10, 21:20
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,461
Thanks: 926
Thanked 3,623 Times in 3,529 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Also I think this might help you, give it a go.

Go to TDSSKiller and Download TDSSKiller.zip to your Desktop
  • Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
  • Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrartor.
  • Allow the application to run and a window will open showing that it is TDSSkiller from Kaspersky
  • Click Start scan
  • It will run rather quickly and will notify you of whether anything is found or not.
  • Follow the instructions to delete/quarantine if asks you what to do when if finds something.
Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #4  
Old 12-17-10, 21:44
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Thanks guys. I figured out how to disable my AV to the point where combofix doesn't complain about it running and Windows security center complains about it being turned off.

However, still haven't gotten combofix or MGtools to run successfully--same issue as earlier. I tried renaming it, running it in safe mode, and re-downloading it saved as a different name, with no effect. I didn't uninstall my AV because I thought that might not be the problem, although can if you still think it may be worth doing.

I did successfully run rootrepeal and TDSSKiller--logs attached. Thanks again for the help thus far, and let me know how'd you like me to proceed.
Attached Files
File Type: txt TDSSKiller.2.4.12.0_17.12.2010_19.34.47_log.txt (43.6 KB, 3 views)
File Type: txt rrepeal.txt (690 Bytes, 2 views)
Reply With Quote
  #5  
Old 12-17-10, 21:49
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,461
Thanks: 926
Thanked 3,623 Times in 3,529 Posts
Default Re: Infected computer, w/ questions on XP cleaning

We could still uninstall Mcafee and then try running Combofix /MGTools again, however TDSSKiller found something that should have solved your problem. Describe to us how things are running at this point please.

But we still need to see if any malware remains, so either uninstall Mcafee and run Combofix and MGTools... or...

Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Vista and Windows 7 users Right-click OTL and choose Run as Administrator)
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Attach both of these logs into your next reply.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
Sponsored links
  #6  
Old 12-17-10, 22:00
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Infected computer, w/ questions on XP cleaning

OTL run, logs attached.
Attached Files
File Type: txt OTL.Txt (72.9 KB, 1 views)
File Type: txt Extras.Txt (56.6 KB, 2 views)
Reply With Quote
  #7  
Old 12-17-10, 22:08
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,461
Thanks: 926
Thanked 3,623 Times in 3,529 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Download HostsXpert and then follow the below steps.
  • Unzip HostsXpert.zip
  • It will create a folder named HostsXpert in whatever folder you extract it to.
  • Run HostsXpert.exe by double clicking on it.
  • Click the Make Writeable? button. (if you only see a Make Read-Only selection, it is already writeable so skip this button).
  • Click Restore Microsoft's Hosts File and then click OK.
  • Click the X to exit the program

Now try and run Combofix and MGTools (without uninstalling mcafee) Any luck?
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #8  
Old 12-17-10, 22:24
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Infected computer, w/ questions on XP cleaning

DL and ran HostsXpert successfully, but still error on combofix.

Also, noticed that the clock on my computer freezes during combofix running along with all icons/start menu when I try to open task manager, or use other misc. windows things.
Reply With Quote
  #9  
Old 12-17-10, 22:32
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,461
Thanks: 926
Thanked 3,623 Times in 3,529 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Uninstall Mcafee and try again?
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #10  
Old 12-18-10, 11:22
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Uninstalled, but no change on combofix
Reply With Quote
Sponsored links
  #11  
Old 12-18-10, 11:26
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,461
Thanks: 926
Thanked 3,623 Times in 3,529 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Run OTL again as instructed in post #5 (no need to redownload of course)

Run this and attach the results.

Using ESET's Online Scanner

Tell me how things are running?
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #12  
Old 12-18-10, 13:02
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Things are running better--the computer was noticably slower before I started with a few of these scans, but now seems to be more on par with its usual speed. Haven't had the popup windows recently and a cursory google search/link clicking doesn't redirect me to "AV" sites. Of course, I've only been online for a few minutes since the scan finished.

Logs attached--ESET did find some stuff. OTL didn't produce an Extras.txt file this time--normal?
Attached Files
File Type: txt ESETScan.txt (541 Bytes, 2 views)
File Type: txt OTL.Txt (69.0 KB, 2 views)
Reply With Quote
  #13  
Old 12-18-10, 13:39
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,686
Thanks: 449
Thanked 4,645 Times in 4,385 Posts
Default Re: Infected computer, w/ questions on XP cleaning

OTL reports that MGTools did run so please attach this log:
C:\MGlogs.zip
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #14  
Old 12-18-10, 13:55
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,385
Thanks: 62
Thanked 7,659 Times in 4,129 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Quote:
Originally Posted by TimW View Post
OTL reports that MGTools did run
It also reports that the log will be incomplete. MGtools should be rerun since TDSSkiller likely fixed the reason why it could not run properly.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #15  
Old 12-18-10, 14:16
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Hmm. MGtools still seems to just sit there. Log attached in case it's at all useful.
Attached Files
File Type: zip MGlogs.zip (32.6 KB, 3 views)
Reply With Quote
Sponsored links
  #16  
Old 12-18-10, 14:19
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,686
Thanks: 449
Thanked 4,645 Times in 4,385 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Yes, it only had the one log. Let's see if we can get it to run properly:

Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #17  
Old 12-18-10, 14:33
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Ran GetRunKey command, and MGtools booted up, sat there and froze the computer as it's been doing previously.

Ran ShowNew, it ran seemingly ok with no error messages and left me at the C:\MGtools> prompt.
Reply With Quote
  #18  
Old 12-18-10, 14:34
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,385
Thanks: 62
Thanked 7,659 Times in 4,129 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Quote:
Originally Posted by ahurwich View Post
Hmm. MGtools still seems to just sit there.
Yes because you have no available free disk space. Your logs from OTL showed the below:
Code:
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 1.83 Gb Free Space | 4.91% Space Free | Partition Type: NTFS
Drive D: | 542.65 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
You have ZERO space on drive D and the 1.83 GB of space on drive C is too small for many things to run possibly including MGtools and even many things that Windows needs to do. You need to free up disk space.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter

Last edited by chaslang; 12-18-10 at 14:51.. Reason: typo
Reply With Quote
  #19  
Old 12-18-10, 14:35
ahurwich ahurwich is offline
Private E-2
 
Join Date: Feb 2009
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Infected computer, w/ questions on XP cleaning

I can do that--how much free space will it need to run successfully?
Reply With Quote
  #20  
Old 12-18-10, 14:36
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,385
Thanks: 62
Thanked 7,659 Times in 4,129 Posts
Default Re: Infected computer, w/ questions on XP cleaning

Quote:
Originally Posted by TimW View Post
Then it should have added the newfiles log to the C:\MGLogs.zip. Check to see if it is there and if so, attach the log.
Don't bother with any of this. The problem is free disk space as I mentioned below.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
Sponsored links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Computer Internal Cleaning Questions Harddriver Hardware 9 07-24-09 20:27
Still Infected after following cleaning steps nyt Malware Removal 4 04-02-09 12:39
Cleaning an infected Time PC desktop 3spirit Malware Removal 11 09-06-08 13:51
Water/Liquid cooling cleaning & other questions... sehana Hardware 0 01-09-08 19:39
After days of reading and cleaning I'm still infected tracy c Malware Removal 13 08-05-06 23:11


All times are GMT -5. The time now is 23:23.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger