How can I see if I got rid off the volsnal virus?

Hello, guys! I can see you have a nice little community. I was trying to read you from my work computer. My home PC is in safe mode with networking right now because I still have BSOD once in a while being connected normal way.
A couple weeks ago I caught Windows XP restore fake antivirus, didn't proceed with scanning and "fixing" the problem. One of my friends told me to use SAS, I downloaded it from safer PC and ran it, also updated my malwarebytes version, they all found and removed stuff, that fake scareware in particular. And I thought my problem was solved but after using my PC a little I finally dared to connect it to internet again and I had BSOD everytime I spent like 5 minutes on it. And the error was saying someth like "STOP: 0x000000D1 (0xFE2F9020, 0x00000002, 0x00000000, 0x81A89360), I ran avast and it found volsnap, Win32 and some kind of Alureon virus. I still get messages about volsnap so I started my PC in safe mode, checked it all with malwarebytes updated, SAS (found 53 infected objects, removed). And now I am still afraid to go online not in safe mode and wondering if it was killed or not? I am a newbie in it and sorry for not such a clear explanation (plus English is not my native) but I will need to see if anyone has any suggestions about maybe me using different antivirus or anything else?
And another thing. When I killed that main fake antivirus, I had no icons on my desktop (Windows XP, pentium 4), and also in my star menu it was not programs but I used unhide (advised my that other friend) and it helped but if I go to Windows folder it was weird marked sections).
Anyway, I will highly appreciate your advice.

 

thank you very much for such a quick response! Sad part is - I downloaded TDSKiller (they even had it in my language but I have everything in English in order to avoid chaos on my PC) and I saved it on the desktop but it didn't want to run, so I renamed it according to the advice but it still doesn't run! I suspect it COULD be a solution, how can I make it run?

 

Another questions. When I will get to the part of scanning and posting my longs here, is it possible to not infect my other PC with any files transfering to post here?

 

OK, I was trying to download that stuff (MBRcheck) in normal but had a BSOD, then I moved to safe mode with networking and I managed to give it a try and so I am attaching my log from that. I am scanning my PC with SAS and I have also a weird question. I bought a malwarebytes last year and have on a CD but should I register to have most updated version of it before running it now or I should just run it as it is - from my PC? I am just not sure if it updates itself automatically. This PC I bought is not new already and I am still discovering stuff on it. Thank you very much for your kind and effecient help, Tim (the Jedi)!

 

little update. I ran SAS and it found 44 infected objects and I ran Malwarebytes right after that and am attaching the log but htere was no viruses. And when I try to run TDSkiller it says - impossible to run it in safe mode, so the only thing is left is to try to run it in normal? Wish me luck.

 

OK, I got another BSOD (STOP: 0x000000D1 (0xFE2A3628, 0x00000002, 0x000000000, 0x81A8C360) after I tried to run TDSkiller again and so here I am - back in safe mode with networking. I am just posting this to make sure I give all the information to knowledgeable people here. I have all the patience in the world to wait for any kind of solution/advice whenever you guys have time. Appreciate your answers.

 

I apologize for my blindness but I downloaded MGTools exe file and now I was searching for all the threads with ComboFix mentioned and I realized - I cannot find the right link to download it from, could you please, give it to me so I would begin the scanning and attaching the logs from those scans? Thanks a lot again!

 

ComboFix can be downloaded from here: download link

 

Thanks a lot for the link, Thisisu! I was being redirected to weird places while trying to find it but then I got to one of the websites mentioned on bleepingcomputer. Anyways, I will try to attach those logs for you to review. I believe there is some information in there from the years before I owned it but I hope it will help. I only scanned my PC with Combofix and Hijackthis (right in this very order) and Combofix notified me when it started that it needs updating (I let it) and that I don't have restoration points or something like this and it did it too, and I hope my logs will be readable. Thank you very much for your support, guys!

 

Forgive me my ignorance but I am pretty confused right now. When I go to MGtools and double click on that GetLogs.bat it flashes and I don't see it working (like a half of a moment) and I suspect I am doing it totally wrong. I realize that log file should be be a .zip. I have a whole thing of MGTools in C:\ (not on the desktop like Combofix). It kicks me out from this website so I keep coming back but I do close all browser session when trying to get those logs. Will appreciate explanation for dummies. Thank you.

Additional question: I also see the folder MGlogs with a little txt file - could that be relevant?

 

Re: How can I see if I got rid off the volsnap virus?

I do appreciate your patience with users like me, Chaslang. I found MGlogs.zip but its size confuses me - it is way too little. I will attach it here with your permission. Hopefully it is the log we need.
As for what website I am getting kicked out off - it is this forum and bleepingcomputer, it gives me error like message about flash player problem occuring. It happened first time when I tried to download Combofix but I managed to somehow do it.
Anyway, here is that tiny log file.

 

Oh, yes, I did downloaded Combofix and ran it earlier. I was just wondering why my MGtools zip file is so small in size and seems to be missing something. I hope I am not ruining anything with my actions. I actually read READ & RUN information and I unchecked "hide known file extensions" like it is said in Step 4 and I just hope that I did everything correctly. Do you want me to do everything again to create new logs or it is not going to be helpful? Thank you very much for answering!

 

Re: How can I see if I got rid off the volsnap virus?

OK, I am having a weird pop-up window when I am trying to download MGTools again for a new scan and log posting. It says: Add-on was running when this problem occured: Add-on name: Flash 106.ocx
And I get this message when going to READ & RUN article and Windows XP section (using MGTools), when I scroll down on that page and there is an url to youtube or some kind of tutorial (it's hard to tell in safe mode) and that is when it doesn't let me download MGTools again. It just shuts down my IE. But it lets me go to this page and post my reply. Possibly you guys be so kind and give me a direct link to MGTools, maybe that could work for me? Meanwhile, I am attaching a new Combofix log (I downloaded it just now, totally new like you advised me). I hope I am not destroying the whole situation completely.

 

Thank you very much, Tim (The Jedi) for that link - it helped me to download MGTools, I ran it (see the log attached), altghough close to the end of the process I had a pop-up error message: .NET Framework Initialization Error: C:\Windows\Microsoft.net\Framework\v1.1.4322\mscorwks.dll could not be loaded. Just if you need to see if you might use it somehow.
And another thing. When I was just loading my safe mode with networking this time it gave me choice (after choices for safe mode, safe mode with networking etc screen) - Microsoft Windows Recovery Console, then something like "don't select this (debugging enabled) and Windows XP (my usual choice, the only one before). So does it mean that Combofix restored Recovery Console or why? I hope I sounded clear, sorry, have 3 languages in my head. Appreciate your patience with me.

 

Thank you very much, Tim. I just have a couple questions. Just to make sure I do it right. Yes, I downloaded Combofix, I saved it on desktop like it was recommended. So the sequence of my actions would be. I work in safe mode with networking. I deactivate my Avast!, it is weirdly coming back active but I weill have to make sure of that. Then I open a Notepad and copy that text you gave (The code) but all I see is just these lines:
"KILLALL::

File::
C:\Documents and Settings\All Users\Application Data\16637732
C:\Documents and Settings\All Users\Application Data\~16637732
C:\Documents and Settings\All Users\Application Data\~16637732r" - those are ALL the lines? (because you said I should make sure I scrolll down to get all of them)
So then I copy them in Notepad, creating the recommended txt. file and saving it on the desktop, same as Combofix. And then follow the directions (dragging that file to Combofix and triggering it to start), that is correct?

A question about memory. I know I possibly have lots of crap eating it up, but should I just purchase some more RAM or it makes no sense for this PC?
Appreciate your detailed response and assistance. I will try to do everything tonight, still am at home.

P.S. A short question about MGTools. Do you want me to download it from scratch or just run the existing bat file?

 

OK, Tim (The Jedi), I scanned my PC, did Combofix like you recommended, in the process Avast popped up (disabled but weirdly working) saying that it sees suspicious rootkit infection (volsnap.sys), don't know what to think but I let it finish the scanning, as a result it restarted my PC, and then I did MGTool that getlongs.bat process and here I am attaching the logs.
Another questions - do you recommend me to run TDSKiller (which I absolutely could not before) or I should just wait for the results or review? Thanks again for such a significant assistance and patience! :wave

 

A little update to everything. I can run my PC in normal mode now, go online, see this website, but once in a while I have pop-ups (not full size window) about some kind of surveys, I close them of course. and all these days I really didn't pay attention to my sounds and yesterday I went online and even before loading any websites (with my browser open) I heard weird radio-like noises, in fact, it was some kind of broadcast and it would not stop, and also when I started bejewelled-type game it had no sound at all. I am not sure if it is another virus - I never ran any scans anymore, I was just waiting for the results from my logs. Something tells me that it would not be safe to use Skype to call overseas plus the audio problems. You guys have any clue what can that be? Appreciate your response. Thank you very much again!

 

Ok, I tried and tried, I renamed it like it was adviced but no success. I get message (when trying to run TDSkiller) : Only part of a ReadProcessMemory or WrtieProcessMemory request was completed. Knowing my memory issues I even freed some space on my disc by uninstalling Diablo (I got like 95 mb now) but still get same message. I wonder why TDSkiller cannot run...

 

Hello, Tim (The Jedi), I think you are right about memory lacking - but I wonder how much memory that program still needs to run? I freed some space since then though and it still doesn't want to run. Anyway, about Avast!. I am still learning it - I found the thing with log but how can I attach them here? And all it says - found volsnap.sys again (looking at its extension I started thinking that maybe it is a part of the system - like a hardmless part?) and I did boot-time scan this night (feels like I am married to this PC) and it still says I have Alureon virus... So I would like to attach them logs but how? I probably should try to find them in C:\ ?
And another question. I was wondering what was eating up my memory so suddenly? I know it is an old PC with now much memory already but I could run a couple programs same time, play online and it was not so slow... Weird.

 

Thank you, Tim (The Jedi), I did what you requested. Here is the log. Just wanted to also say that although Avast! keeps finding this volsnap and trying to delete it, new version of Malwarebytes didn't see it as any kind of infected file after the complete scan I had this morning. Weird.

 

I am sorry for asking this but damn avast! keeps on strating and interferring my Combofix so I could not get a log, I will try again but that is redicuolus - I wish I knew how to stop it from loading automatically - I thought I deactivated it for permanently or 1 hour but it keeps interprering with Combofix process. I am reconsidering using other antivirus, I used to have AVIRA. I just need to see how can I stop it from loadining on the startup and even though it is deactivated it still pops up with that volsnap.sys warning and also recommend to open Combofix in sandbox! Very frustrating.

 

Ok, that was weird and long but I might have the necessary logs and so far (Avast! is alive and kicking LOL) there are no pop-up windows saying that malicious link was blocked like it was before restarting and finishing Combofix and that MGlogs. Please, see the attached logs and thank you very much for your almost unlimited patience with me. :wave

 

I still have those weird audio broadcasts as soon as I connected to the internet, and I started scanning my C: with Avast! and it showed 1 infected file. I am not sure if it is still volsnap or Alureon but it is sure very stubborn indeed. I wonder what kind of virus make me hear all these radion broadcasts and commercials? :confused

 

P.S. Sorry to inform you but Avast scan just told me it is rootkit modification - volsnap.sys...

 

OK, I will do that. I want to see if it will work. So I will uninstall Avast! then run Combofix same way, create log, then run TDSkiller or try, right?

 

Well, here are the logs.... I still have no luck from TDskiller - it seems to not have enough memory or anything like that. I still get message: Only part of a ReadProcessMemory or WrtieProcessMemory request was completed. I am not sure what else I can do. Rkill worked, stopped no malware process, so I am not sure how to make that program (TDSkiller) run. It feels like it could be a key thing destroying that volsnap.

 

Ok, I ran Hitman (one-time scan only), it identified TDSkiller, Combofix and Explore.exe as trojans malware, but I set it to ignore that (since those are helpful programs), it also founds some tracking cookies and some of them were named like blogtalkradio or something like that, so far (I didn't restart my PC or go to another websites) I don't hear any radioblogs as background sound, so who knows - maybe that Hitman took care of it? What else do you recommend to check or attach as logs? Thank you very much for all your advise