Maleware - Stuck at Safe Mode

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Mailman66, Dec 21, 2011.

  1. Mailman66

    Mailman66 Private E-2

    About 7:30 PM tonight I discovered that my computer must be infected with “Vista AntiVirus 2012” due to popup windows with that name and taskmanager not responding when right-clicking the task bar. Ran full scan using AVAST (free version which had automatically updated definitions earlier that evening) and went for dinner. Returning after scan was completed, no infections were found.

    Rebooted computer and immediately got to taskmanager, noting that a new-to-me file “RSR.EXE” was running. Searched internet from another computer and discovered I should get rid of this file. Restart infected computer and was able to get taskmanager to stop the “RSR.EXE” program. Then ran a search for that file. As search was progressing, first hit was at C:\windows\prefetch as rsr.exe(some other characters).pf and at C:\Users\J\AppData\Local as RSR.EXE Using Windows Explorer (as the search continued) I was able to delete the .pf file but I could not delete the EXE file in the Local directory (got message to Try Again) as the Search continued. I was able to rename it to xxxxxxxx.exe. As the Search continued, it was also found in Recyclebin so I emptied that. Rebooted computer again and noted that AVAST had not automatically started. Tried to manually start AVAST through START button, but a window opened asking what program I should use to run the program. Similar window opened when I went to my Windows Explorer shortcut. Activity light was active on the computer so I shut down. I did note that the time stamp for the pf file was 11:30 PM while the time stamp for the EXE file was around 7 PM.

    Searched on this site from another computer. Restarted my computer in Safe Mode using F8, but unable to run any programs or access drives (through Windows Explorer desktop icon) as I continue to get the window asking what program to run the requested application file from.

    Stuck at this point. Running VISTA 32-bit machine
     
    Mailman66, Dec 21, 2011
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    TimW, Dec 21, 2011
    #2
  3. Mailman66

    Mailman66 Private E-2

    That link got me started and I then continued to perform the tests.
    Don't recall if I saved SuperAntiSpyware log before or after the found issues were deleted, but they were deleted.
    Only had problem with RootRepeal (details in the log file written by me). Basically it did NOT run.
    Very quick check of the computer does not show any issues (other than RootRepeal issue above).
    Attached 5 logs

    Problem - only 4 attachments allowed, MGlogs.zip will follow in separate reply
    Thank you for your help & guidance
     

    Attached Files:

    Mailman66, Dec 22, 2011
    #3
  4. Mailman66

    Mailman66 Private E-2

    MGlogs.zip file missing from previous reply is attached
     

    Attached Files:

    Mailman66, Dec 22, 2011
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Now download The Avenger by Swandog46 to your Desktop.

    See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
    Extract avenger.exe from the Zip file and save it to your desktop.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):


    1. Run avenger.exe by double-clicking on it.
    2. Click OK at the warning to continue to use The Avenger
    3. Do not change any of the check box options!
    4. Shut down your protection software now to avoid possible conflicts.
    5. Copy everything in the Quote box below, and paste it into the Input script here: part of The Avenger
    6. Now click the http://img33.imageshack.us/img33/9159/executeavenger.jpg button
    7. Click Yes to the prompt to confirm you want to execute.
    8. Click Yes to the Reboot now? question that will appear when The Avenger finishes running.
    9. Your PC should reboot, if not, reboot it yourself.
    10. A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.
    11. Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below log:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Dec 23, 2011
    #5
  6. Mailman66

    Mailman66 Private E-2

    Here are the requested logs

    System took a long time following rebbot with open window 'system information' stating
    refreshing system information
     

    Attached Files:

    Mailman66, Dec 25, 2011
    #6
  7. Mailman66

    Mailman66 Private E-2

    To answer your last question - the computer seems to be running OK. I have not run across any issues yet. I have tried to run RootRepeal once again, but still encounter error window when starting the program. Each line is followed by the time stamp:
    FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000d8)
    DeviceIoControl Error! Error Code = 0x1e7
    FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended info (0x000000d8)

    I then OK that window and hit Scan only to get another RootRepeal Error window stating the following line 4 times:
    DeviceIoControl Error! Error Code = 0x0 10:56:56

    Otherwise all is Good
    Thank you for your continuing help
     
    Mailman66, Dec 26, 2011
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Just one item left to remove, so use windows explorer to find and delete:
    C:\ProgramData\2nnh335sngpnwyhf4yxju323lu7t5

    Let me know if you can remove it.

    Then tell me how things are running. ;)
     
    TimW, Dec 26, 2011
    #8
  9. Mailman66

    Mailman66 Private E-2

    I was able to remove that file without incident last night. Emptied Recycle Bin & rebooted.
    Internet access OK, tried some programs and found computer to be operating VERY slowly with much HD activity for a while. Took note of TaskManager while only app running was Photoshop Elements and indicated 7% CPU usage, 46% Physical memory, 49 Process active and about 51 process listed as stopped. Screen shots too large to attach.

    Returned today and note some normal (?) HD activity while i am inactive at computer - think it's indexing? Otherwise now seems good following yesterday's initial slowdown.
    Are the large number of stopped services normal?

    Once again, many thanks for your dedicated help
     
    Mailman66, Dec 27, 2011
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    What services are stopped?
     
    TimW, Dec 28, 2011
    #10
  11. Mailman66

    Mailman66 Private E-2

    Screenshots of stopped services attached

    New Issue developed with Taskbar across bottom of screen. Originally only '1 space' high with START icon, 4 selected quick start icons, blank space and then some icons on right side + the clock across the bottom - Normal operation. Some time ago it changed to '2 spaces' high and would cover the bottom portion of open programs. Could not reduce the height of Taskbar with the mouse and was thus loosing lower portion of maximized windows. I ended up hiding TaskBar until mouse was brought to bottom portion of screen - then it would appear. Today it is still similar with the exception that any mazimized program must be 'restore Down' to uncover bottom of desktop before moving the mouse to bottom of screen will allow Task Bar to appear - If window is covering bottom of desktop the Taskbar will not appear. Rebooted and problem persists.

    Above screen shots captured after this problem appeared.

    FWIW attached Running programs as well. As limit is 4 attachments, the balance of Running programs were: Windows Audio (Audiosrv),
    Windows Audio Endpoint Builder (AudioEndpointBuilder) (both LocalServiceNetworkRestricted),
    Application Experience (AeLookupSvc) (netsvcs),
    Adobe Active File Monitor V9 (N/A), and
    SAS Core Service (N/A).

    Haven't noticed any sluggishness once the computer is turned on and opening screen has appeared for approx. 30-40 seconds.
     

    Attached Files:

    Mailman66, Dec 29, 2011
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    @ TimW, You can see all the services and drivers that are stopped in miscinfo.txt ;) You just need to know or compare to what should be running.

    NOTE: An outdated version of MGtools is being used. The new version should be used to see additional logs.
     
    chaslang, Dec 29, 2011
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Many of those services do not need to be running, but if you want to pursue this, please post in the software forum for additional assistance.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Dec 29, 2011
    #13
  14. Mailman66

    Mailman66 Private E-2

    Thank you for all your insight and help Tim.
    Will pursue the software issues shortly

    In the meantime wishing you a Healthy, Happy New Year
     
    Mailman66, Dec 30, 2011
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     
    TimW, Dec 30, 2011
    #15

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds