Pc is infected

Discussion in 'Malware Help (A Specialist Will Reply)' started by Solutha, Nov 27, 2008.

  1. Solutha

    Solutha Private E-2

    OK, i went through the read and run me first list and my problem still persists. I was unable to install SUPERAntiSpyware, Spybot S&D, and Malwarebytes Anti-Malware. I was able to install and run the ComboFix.

    It stared yesterday when i downloaded some stuff that happened to be ridden with malware or something of the sort. My desktop background changed to a blue screen saying:

    Warning: Spyware threat has been detected on your Pc
    Your computer has several fatal errors due to spyware activity.
    It is strongly recommend to install an anitspyware software to close all security vulnerabilities
    Antispyware software helps protect your PC against spyware and other security threats.

    Also along with that i get an occasional icon that appers in the task bar that says i should install some kind of anitspyware software, along with a red message box claiming to be some kind of windows spyware detector. Also well searching the internet i am unable to access sites, such as this site w/o a proxy. I have also discovered i can no long open Task Manager with Crl + Alt + Del, and many other restrictions placed by an "administrator."

    When ever i search something using a site like Yahoo or Google i also seem to get a pop-up to something a bit related to what i searched or videos about cats on Funnyordie.
    Any help at all would be greatly appreciated.

    ~Solutha
     

    Attached Files:

    Last edited: Nov 27, 2008
    Solutha, Nov 27, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Okay then we need the log. ;) I'll start working up a fix based only on MGlogs.zip but we will need other scans to be run later.
     
    chaslang, Nov 27, 2008
    #2
  3. Solutha

    Solutha Private E-2

    Opps i meant to say i couldn't run that one either. I was only able to run the MG tools one.
     
    Solutha, Nov 27, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay you are very badly infected. One of the infections is an Alternate Data Stream infection that has infected one of your key Windows System file (the svchost.exe file). We will need to fix this some how. ComboFix may have worked. Let's begin with the below and see what happens.


    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101664&gct=&gc=1&q=
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101664&gct=&gc=1&q=
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\uesiuqcr.exe,
    O2 - BHO: (no name) - {49582D01-5592-4E9A-B672-FBABAB3B9A2C} - C:\WINDOWS\system32\efcAPGww.dll
    O2 - BHO: (no name) - {71CFEE8E-F819-43F3-94A2-FFE181333014} - C:\WINDOWS\system32\byXNheFu.dll
    O2 - BHO: C:\WINDOWS\system32\siejf93.dll - {C5AF42A3-94F3-42BD-F434-3604832C897D} - C:\WINDOWS\system32\siejf93.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [jsg8jfgfdfhfhf] C:\DOCUME~1\Terry\LOCALS~1\Temp\winlogun.exe
    O4 - HKLM\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\Terry\LOCALS~1\Temp\winlogin.exe
    O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
    O4 - HKLM\..\Run: [b458f43f] rundll32.exe "C:\WINDOWS\system32\cophyhxi.dll",b
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
    O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\Owner\LOCALS~1\Temp\csrssc.exe
    O4 - HKUS\S-1-5-18\..\Run: [Jnskdfmf9eldfd] C:\WINDOWS\TEMP\csrssc.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Jnskdfmf9eldfd] C:\WINDOWS\TEMP\csrssc.exe (User 'Default user')
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O20 - AppInit_DLLs: dkzxyx.dll
    O20 - Winlogon Notify: efcAPGww - C:\WINDOWS\SYSTEM32\efcAPGww.dll
    O20 - Winlogon Notify: zigqki - C:\WINDOWS\SYSTEM32\zigqki32.dll
    O21 - SSODL: WebProxy - {A744F16C-B2D5-4138-81A2-085CDFCDE83A} - sxmg4.dll (file missing)
    O22 - SharedTaskScheduler: lke3iemrl490kgfgdsfd - {C5AF42A3-94F3-42BD-F434-3604832C897D} - C:\WINDOWS\system32\siejf93.dll
    O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsne87fidgf.dll
    O23 - Service: bEvtService - Unknown owner - C:\WINDOWS\System32\bEvtService.exe
    O23 - Service: CbEvtSvc - Unknown owner - C:\WINDOWS\System32\CbEvtSvc.exe
    O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
    O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe

    NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.
    After clicking Fix, exit HJT.



    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Nov 27, 2008
    #4
  5. Solutha

    Solutha Private E-2

    Ok, here are the logs
     

    Attached Files:

    Solutha, Nov 27, 2008
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You forgot to tell me how things are working!


    Click Start, Run, and enter sfc /scannow and click OK. There is a space after the sfc. This runs System Rile Checker which looks for missing or corrupted system files and attempts to replace/repair them from files on your hard disk or from the CD if necessary. So it will ask for the Windows CD if it needs it. Tell me if it asks for your CD.


    Please put a copy of the below file into a ZIP file and attach it to your next message.
    Code:
    "C:\WINDOWS\system32\drivers\"
ati6jtxx.sys  Nov 27 2008       32768  "ati6jtxx.sys"
    Uninstall the below old versions of software:
    Java(TM) 6 Update 7
    Viewpoint Media Player <-- should have been uninstalled in step 1 of the READ ME

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {49582D01-5592-4E9A-B672-FBABAB3B9A2C} - C:\WINDOWS\system32\efcAPGww.dll (file missing)
    O2 - BHO: (no name) - {C96E2835-D520-4770-BD6F-9E07D8FFDBF2} - C:\WINDOWS\system32\byXNheFu.dll (file missing)
    O4 - HKUS\S-1-5-18\..\Run: [Jnskdfmf9eldfd] C:\WINDOWS\TEMP\csrssc.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Jnskdfmf9eldfd] C:\WINDOWS\TEMP\csrssc.exe (User 'Default user')
    O20 - Winlogon Notify: efcAPGww - efcAPGww.dll (file missing)

    After clicking Fix, exit HJT.

    Now run this procedure Using SDFix I will ask for the log later.

    Now run this: Running GMER to detect rootkits I will ask for the log later.

    Now reboot your PC.

    After reboot delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\Owner\Local Settings\Temp

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • the log from SDFix
    • the GMER log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Nov 28, 2008
    #6
  7. Solutha

    Solutha Private E-2

    Oops sorry, so the background thing is no longer appearing, also the icon in the task bar no longer shows up. I can access the task manager along with the other stuff that had been restricted by an "administrator"

    I am still having browser problems though. I still can't access sites such as this one w/o a proxy. There is also a problem when i click links from search engines still, it rarely ever takes to the proper place, usually to another search engine then or a completely worthless site (as in not related to my search). Also i'm not sure if this could be affected but there is also no sound in Firefox or Internet Explorer.

    Now for what you asked me to do. When i ran sfc /scannow it constantly asked me for the Professional XP cd and SP3 cd. Unfortunately i couldn't run either of those two programs SDfix, and GMER. When i try to run the .exe on SDFix the security warning appears and when i click run nothing happens. With GMER when i double-click it nothing happens also.

    So here is the MGTools log and i couldn't find the file ati6jtxx.sys. It wasn't in C:\WINDOWS\system32\drivers\.
     

    Attached Files:

    Solutha, Nov 29, 2008
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you give sfc the Windows CD and the Windows SP3 CD where it requested? Did you have both or did you have it skip various files?

    Do you have your installation CD or file for McAfee?
     
    chaslang, Nov 29, 2008
    #8
  9. Solutha

    Solutha Private E-2

    I don't have either of the Windows XP disc, and i got McAfee from their site, so no CD for the either.
     
    Solutha, Nov 29, 2008
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If your system is asking for the CD when you run sfc then you need to get a CD. Your system cannot be fixed without the CD. Your only other choice is to use a recovery CD or recovery partition (if your PC came with one) and restore to the original way it was shipped. You will have to backup all of your data before doing this.

    But do you still have the installation program.

    The ati6jtxx.sys file still shows in your logs so it is still on your hard disk. I'm not sure why you cannot find it.
     
    chaslang, Nov 29, 2008
    #10
  11. Solutha

    Solutha Private E-2

    Well good news i guess i found ati6jtxx.sys, but i can't get it into a .zip file, i know how to do it with other stuff, but it says that access is denied if i try to use WinRar and Warning: could not open for reading: C:\WINDOWS\system32\drivers\ati6jtxx.sys when i try to use WinZip.

    Im still looking to see if i have a Windows xp disc so fingers crossed eh?
     
    Solutha, Nov 29, 2008
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try it in safe mode. Also try making a copy of the file somewhere else and then see if the copy can be put into a ZIP file.
     
    chaslang, Dec 1, 2008
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds