Computer Infected, System files corrupted

Discussion in 'Malware Help (A Specialist Will Reply)' started by TeKn1qu3z, Apr 30, 2010.

  1. TeKn1qu3z

    TeKn1qu3z Private E-2

    I was infected by this file.
    http://www.virustotal.com/analisis/...96dc46a68d46b69923324cd773ad4c0fb4-1272676720
    It ran unknowingly to me. As soon as it ran I got a BSOD. I restarted and kept getting a BSOD. I am still getting this.
    I tried running in Safe Mod, Safe Mod Networking, Safe Mod Command Prompt, all 3 pause at "loading Mups.sys"

    I am also running Dual Boot on my laptop. I was infected on my XP side, I was able to boot up my 7 partition and run MBAM and clean my XP partition.

    Infected files were quarantined but I still cannot boot up XP, (BSOD and frozen at Mups.sys)
    My guess is my system files are corrupted. Is there any way to fix this so I can boot up XP. My CD Drive is broken so I cannot use my CD.

    This is my MBAM log.
    Code:
    Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

4/30/2010 9:56:57 PM
mbam-log-2010-04-30 (21-56-57).txt

Scan type: Full scan (D:\|)
Objects scanned: 202543
Time elapsed: 28 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files (x86)\AWS\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.
D:\$RECYCLE.BIN\S-1-5-21-1267294760-1216761272-471448178-1001\$RQDKE2C.45\update.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
D:\$RECYCLE.BIN\S-1-5-21-1267294760-1216761272-471448178-1001\$RQDKE2C.45\Keygen\mbam-keymaker.exe (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
D:\Documents and Settings\Jason\Desktop\3GP_Converter034\Setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Jason\Desktop\wtf\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
D:\Documents and Settings\Jason\Local Settings\Temp\0000774e (Rootkit.Dropper) -> Quarantined and deleted successfully.
D:\Documents and Settings\Jason\Local Settings\Temp\softplug.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\RECYCLER\S-1-5-21-1606980848-1993962763-1801674531-1004\Dc2275.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{117A0EAB-AD43-4CA2-A563-AC62AFA4C0A5}\RP38\A0019450.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{117A0EAB-AD43-4CA2-A563-AC62AFA4C0A5}\RP38\A0019518.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{117A0EAB-AD43-4CA2-A563-AC62AFA4C0A5}\RP51\A0021129.exe (Malware.Tool) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\spool\prtprocs\w32x86\b00006fb4.dll (Rootkit.Dropper) -> Quarantined and deleted successfully.
    Forgot to add, this was on XP Professional SP3.
    And I am currently using my Windows 7 to post this.
     
    TeKn1qu3z, Apr 30, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Major Geeks!

    Please read ALL of this message including the notes before doing anything.

    Pleases follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide


    and attach the requested logs when you finish these instructions.

    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.


    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:


    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this aother user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
    ​
     
    TimW, May 1, 2010
    #2
  3. TeKn1qu3z

    TeKn1qu3z Private E-2

    I can't scan my system because I cannot access it.

    I'm just wondering if I copy and paste the system files from another computer onto my infected partition, will it work?
     
    TeKn1qu3z, May 1, 2010
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Can you not then download SAS and the MGTools.exe to the win7 partition and transfer them to the xp partition? What system files are you saying are corrupt? If this is a virut type infection, you will not be able to copy ALL the system files that may be infected.
     
    TimW, May 1, 2010
    #4
  5. TeKn1qu3z

    TeKn1qu3z Private E-2

    I've scanned my XP partition from my 7 partition with MBAM and now SAS. The initial log from MBAM is posted in my original post. I will attach my SAS log to this post.

    I downloaded MGtools and put it in the root of my XP drive. There is a MGtools folder on my XP drive but no .zip file is created.
    There are no error messages I received and the cmd prompt closed on it's own.

    Also in the cmd prompt, the dialog shows "C:\" (My 7 partition) and not my "D:\" (XP). Again, the MGtools.exe is on my D:\

    I do not know which system files are corrupted but being that I've scanned my computer and cleaned it and still cannot boot up in Normal or Safe modes leaves me to believe my system files are the problem.

    Also another quick question, as stated previously my CD Drive is broken.
    Would it be possible to reformat my computer via an external CD drive?

    Thanks for the help.
     

    Attached Files:

    TeKn1qu3z, May 1, 2010
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You should be able to use an external CD to format and re-install your xp os. Since you have access to it through your win7 partition, you can transfer all your data and personal files to it ( I wouldn't recommend trying to transfer any exe files.) That may be your best solution.
     
    TimW, May 1, 2010
    #6
  7. TeKn1qu3z

    TeKn1qu3z Private E-2

    I'll be ordering an external hard drive and try to repair my system. I'd rather not go through the fuss of having to reinstall all my programs.

    Is there any solution you may suggest for the time being?

    Edit: Do you have any recommendations for external CD Drives? I am a bit worried about picking one and unable to install drivers for it.
     
    Last edited: May 1, 2010
    TeKn1qu3z, May 1, 2010
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    While you are waiting on the external drive, there won't be much you can do if you can't get into your recovery console. You might want to discuss this in the software forum. See if there are any ideas that others may have for you to try. After all, you are not certain what files are corrupt or missing. If you were able to get to the RC, you might have been able to do a system restore to an earlier point.

    I can't off hand recommend any particular CD drive.....but again, a good question for the software forum.
     
    TimW, May 1, 2010
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds