conduit.com nightmare

My son has a Samsung laptop running Windows 7. I'm not sure what he was doing to get to the problems we are having. So, here are the problems.
- The only browser that works is IE9, however, only if we run through a conduit.com window.
- Chrome comes up, but displays not text and does not allow any text entry into dialog boxes.
- Other programs, like Word, come up, but then the system locks up
- If you try to change fonts in Control Panel, you get a BOD.
- The wireless connection has been removed. I can only connect via a hard wired connection

We removed the toolbars, but this did not help.

Here are the logs I have. I could not run malwarebytes because I cannot see any text on the windows that come up. Combofix starts, updates, and then just shuts down.

I would appreciate the help.

Dave

 

One more file...

 

http://img38.imageshack.us/img38/7284/yse.gif Run C:\MGtools\analyse.exe by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Shut down your protection software now to avoid possible conflicts.
Note: This is actually Trend Micro HiJackThis - v2.0.4
Choose Do a system scan only and select the following lines but do not click fix until you exit all explorer windows and all browser sessions including the one you are reading in right now:

After clicking Fix, exit out of Trend Micro HiJackThis - v2.0.4

http://dus.x10.mx/canned/otlicon.gifPlease download OTL by Old Timer to your desktop.

• See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
• Double-click OTL.exe to run (Vista and Win7 right-click and select Run as administrator)
• When OTL opens, copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.
  
  Code:

  [COLOR="DarkRed"]:processes[/COLOR]
  killallprocesses
  [COLOR="DarkRed"]:otl[/COLOR]
  [COLOR="DarkRed"]:services [/COLOR]
  [COLOR="DarkRed"]:files[/COLOR]
  C:\Users\Voldemort\Local Settings\TEMP\uttADFA.tmp.bat
  C:\Users\Voldemort\Local Settings\TEMP\{AC16BD8D-A07A-4174-92FC-C3FB3A7CD1D6}
  xcopy %Temp%\smtmp\1 "%allusersprofile%\Start Menu" /H /I /S /Y /C
  xcopy %Temp%\smtmp\2 "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
  xcopy %Temp%\smtmp\3 "%appdata%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
  xcopy %Temp%\smtmp\4 "%allusersprofile%\Desktop" /H /I /S /Y /C
  ipconfig /flushdns /c
  dir c:\windows\minidump\ /c
  [COLOR="DarkRed"]:reg[/COLOR]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
  [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
  [COLOR="DarkRed"]:commands[/COLOR]
  [purity]
  [emptytemp]
  [emptyflash]
  

• Now click the http://img3.imageshack.us/img3/407/otlrunfix.png button.
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• When complete, Notepad will open.
• Close Notepad.
• A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
• Attach this log to your next message. (How to attach items to your post)

• Now open OTL again and click the http://img683.imageshack.us/img683/4483/quickscanotl.png button
  Note: This automatically updates the OTL.txt log on your desktop.
• Attach OTL.txt to your next message. (How to attach items to your post)

http://img822.imageshack.us/img822/6835/baticon.gif Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

• This will automatically update all the logs inside MGlogs.zip
• Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

Can you also attach the log from running MBRCheck?
It's at: C:\Users\Voldemort\Desktop\MBRCheck_09.25.11_22.27.23.txt

LET ME KNOW HOW THE PC IS RUNNING AFTER YOU HAVE COMPLETED THESE STEPS​

 

Thanks for the very quick response.

I am having trouble following your instructions.

When I run analyse.exe, I can see the boxes to select the lines, but I cannot see the text. This means I do not know which boxes to choose.

When I run OTL, I get the code box, but there is no run/fix button.

Can you help this computer illiterate?

Thanks,
Dave

 

I just loaded OTL on another computer to see what it looks like. The only thing that displays on the infected computer is the code box. I don't see all of the buttons and selections in the top 75% of the OTL window.

Dave

 

What resolution is the infected computer running in? Are you running any of these tools from Safe Mode?

 

The screen resolution is 1366 x 768.

I am running in normal mode for Windows.

Dave

 

While I think of what may cause the issue you're having. I want you to perform the following steps to fix your Master Boot Record (MBR).

_________________________________________________________________​

WARNING​

MBR infections are only worsening and sometimes (rarely) make the computer unbootable after attempting to correct it. We recommend that you back up your data before hand. Then continue with the below if you wish to attempt to remove this infection:
_________________________________________________________________​

Do you have your Windows 7 DVD? We need it to restore a clean MBR.

If you do not have your Windows 7 DVD, you can create one with the Recovery Console (which is really all we need), here: Download Windows 7 64-Bit (x64) Recovery Disc

1. Insert the CD/DVD
2. Reboot your computer
3. At the Samsung splash screen, press Esc
4. This takes you to the Boot Menu
5. Select CD/DVD Rom from the selection by using the Down / up arrows (Note: It will probably be TSSTcorp CDDVDW TS-U633J or something similar [according to your logs])
6. Press ENTER after you have selected the CD/DVD Rom drive.
7. You'll hear the DVD spinning up, be ready to press ANY key when you see the following message:

http://www.bleepstatic.com/tutorials/vista-repair-options/boot-from-cd-prompt.jpg

• This takes a while to load (30-45 seconds)
• When the below screen appears:

http://www.sevenforums.com/attachments/tutorials/25672d1251414873-mbr-restore-windows-7-master-boot-record-mbr_02.png

• Select your language and click Next.

http://www.sevenforums.com/attachments/tutorials/25673d1251414836-mbr-restore-windows-7-master-boot-record-mbr_03.png

• Click the button for "Use recovery tools".

http://www.sevenforums.com/attachments/tutorials/25674d1251414836-mbr-restore-windows-7-master-boot-record-mbr_04.png

• Then select "Command Prompt".

http://www.sevenforums.com/attachments/tutorials/25675d1251414836-mbr-restore-windows-7-master-boot-record-mbr_05.png

• When open, the command prompt will look like this:

http://www.sevenforums.com/attachments/tutorials/53598d1251414836-mbr-restore-windows-7-master-boot-record-mbr_16.png

• Type in bootrec /fixmbr and press ENTER
  Note: There is only a SPACE after bootrec
• You should see:

http://img19.imageshack.us/img19/4114/operationcompletedsucce.png

• Type exit and press ENTER
• Now restart your computer WITHOUT booting off the DVD again (don't press a key when it says... "press any key to boot from cd/dvd...")

Now rerun MBRCheck and attach its latest log. (How to attach items to your post)

 

ok, who would think it would be so hard to find a DVD.

Here's the new MBR log.

I look forward to hearing your next ideas! Thanks for the help. Your time is much appreciated.

 

Are you able to take a screenshot of what is preventing you from running the fixes?
See: Learn how to take a screenshot if you need help on how to do this.

If you are able to, then attach the picture to your next post.

Also can you let me know if you have the same problems while attempting to run the fixes in Safe Mode? Starting your computer in Safe mode

You can run both HiJackThis and OTL from Safe Mode if you need to.

But run the GetLogs.bat from Normal Mode.

By the way, the MBR is now clean. Good job

 

Unfortunately, I get the same result in safe mode.

I had to attach the screenshots of the windows because I couldn't paste directly into this post.

 

May have to send you over to the Software forum to get this sorted out.

Here is something I'd like you to try:
Boot your system into Safe Mode with Command prompt

The black box that appears is called the command prompt
Type in the following command:

sfc /scannow

Note: there is only one space after sfc

Now press ENTER

http://maxcdn.liewcf.com/blog/wp-content/uploads/wfp_purge.jpg
You should see the above
Be patient while this task is working.

 

Ok, we are making some progress now. I am able to read the text in the windows that open up. I was also able to run the analyse and OTL. The logs are attached.

The computer is working much better now, but there are still some issues. I had to use another computer because I could not upload these log files on the infected on. In the process, I got a BOD. Finally, the wireless network adapter is not working.

What do you think?

 

These logs look good as I'm not finding any malware in them.

Have you looked in the device manager to see if there are any conflicts in there? To do this:

• Press and hold the http://img849.imageshack.us/img849/4325/windowkey.gif Windows key on your keyboard, then press the letter r on your keyboard.
• This opens the Run dialog box.
• Then copy the below bold text and paste it into the Open: text-field and press ENTER.
  devmgmt.msc
  
  
• This opens the Device Manager.
• Are there any devices with a yellow exclamation mark next to them?
• How about after you click View > Show Hidden Devices ?

Can you take a picture of your Device Manager and attach it to your next post?
Can you also .zip up the files inside C:\Windows\Minidump and attach them to your next post?
These are the logs created from when you received a BSOD.
There should be 6 of them according to your logs.

• 092511-38345-01.dmp
• 092511-44647-01.dmp
• 092511-64553-01.dmp
• 092611-40451-01.dmp
• 092611-40638-01.dmp
• 092611-44585-01.dmp

 

The wireless adapter was not working properly in the device manager. I fixed that by uninstalling the driver, downloading an updated driver, and then installing the that. The wireless is now up and running. Thanks!

I attached the dump files and had no problem with the "infected machine".

Let me know if you think we have anything left to do.

 

I can't make much out of these BSOD logs as I'm not too familiar with the error code you received. If you continue to have trouble you can have someone from Software analyze them for you.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Hey thisisu, thanks for all your help! My son's computer is back in business.

I think it's time they declared you a Master Malware Fighter! :-D

All the best!

 

Glad to hear that and thank you for your kind words. Perhaps someday :-D