Rogue-MSantispyware 2009 can't be quarantined

Every time I run SAS it finds and quarantines this same malware all over again. The quarantine log shows repeated instances of Rogue-MSAntispyware 2009 being quarantined, but it still keeps running apparently, only to be found and quarantined again. Does anyone have a clue how to kill this beast?

 

http://www.majorgeeks.com/images/grenade.gifWelcome! to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif

Please follow the instructions in the READ & RUN ME FIRST link given further down and attach the requested logs when you finish these instructions.

• If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.
  • TDSSserv Non-Plug & Play Driver Disable
• If something does not run, write down the info to explain to us later but keep on going.
• Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide


Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in Safe Mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. To avoid additional delay in getting a response, it is advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!
4. Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

 

Attached are the logs. Note that on the combo log it announces that Explorer is infected, SVCHOST, etc.

Many thanks for your help so far.

Shayne

 

Do you have your WinXP SP2 disc?

 

No. My computer, a Fujitsu Siemens SCALEO H tower, came with a Recover Disk for Windows XP Home, but I have lost the serial number so I can't use it. I have gone to the Fujitsu site to try to get help from Fujitsu to replace it but can't find any way there to download this item again.

Shayne22

 

Alleluia!

After running all five of the programs you suggested, last evening, my PC has been running nicely for 18 hours without any error messages and without and crashes.

I wish to thank you profusely for the help. Without it, I'd still be pulling out my hair.

I noticed that one of the logs shows that my explorer.exe and svchost.exe both are corrupted, but the PC is running fine so far. Can I continue to cruise on the current configuration, or do I have to go after fixing explorer and svchost?

I'm having a friend bring me Service Pack 3 for XP home in ISO format. If I run this, will it clean up the corrupted files?

 

No, you have one of the newer more advanced infections. Just because you are not having any obvious problems does not mean you are clean. This particiular infection infects your system files making them system untrustworthy especially if you do online banking and such.

 

Once you get the SP3 disc, install Service Pack 3, and then run my initial post again and attach new logs so we can see what is leftover.

 

Installed Service Pack Three yesterday and the PC now no longer boots except in safe mode. Normal mode it crashes after showing an addressing error. I seem to have found a fix on the Web (renaming a certain dll) and will try it. intel???.dll

 

No, you need to stop doing things on your own so we can attempt to fix your system. With you doing things to it, it makes it harder for me because things are changing and I don't know what you're doing.

If you can get into Safe Mode, run the initial scan again and attach the logs so we can see what is remaining.

Also, can you give more information about the error on startup in normal mode?

 

Things go from bad to worse here. Now my PC won't boot, even in safe mode. I ran three of the five diagnostic programs again, in safe mode, to get the reports to post, was about to try combofix.exe, then the whole system shut down and won't reboot, even in safe mode. I get the error message:

STOP c000021a {irreparable system error) The process system session manager initialization stopped unexpectedly in state 0xc00003a

 

This is why I said you must stop doing things on your own and let one person help you. Doing multiple things with multiple people makes it difficult to address the real problem.

At this point, since your system isn't even booting and the infection you have I would recommend a format/reinstall. Even if we ge it clean, the nature of this virus is to infect system files making the system untrustworthy even if cleaned thoroughly. It's up to you but I would recommend the format/reinstall.