Am I virus free?

Discussion in 'Malware Help (A Specialist Will Reply)' started by lrohner, Sep 6, 2007.

  1. lrohner

    lrohner Private E-2

    No idea how, but last weekend got infected with Bancban-CT (yes, I have changed all of my banking info and shut down online banking for now), Xorpix-A, Stration-C and a host of other ills. Spent my $100+ with Geek Squad, might as well have just burned the money. I finally found you guys. THANK YOU for all of the info you have posted on here!

    I wasn't able to boot into normal mode for a long time, Internet kept getting hijacked and was excruciatingly slow, etc. Found out that my trojans/worms/viruses had put in exceptions for themselves in my firewall. My ISP has shut off my email until I am virus free, so I need to be sure I am.

    Weird stuff. I can have SpySweeper guard my machine, but if I try to run the scan, it gets almost done and then reboots. I've tried a host of other virus scans (AVG, Avast, etc.), and most of them either reboot near completion or just disappear at some point with no logs or messages. Spy Bot runs perfectly fine and just gave the following results:

    DoubleClick
    Advertising.com
    MediaPlex
    Microsoft.Windows.ActiveDesktop
    Microsoft.Windows.AppFirewallBypass
    Stration.C
    WildTangent

    Stration.C says Autorun settings (MSConfig)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig

    Spybot is good at removing the stuff, but not keeping it off. It seems like everytime I reboot, this stuff comes back.

    Can anyone help me?
     
    lrohner, Sep 6, 2007
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Majorgeeks!

    To start ....find and delete this:
    C:\Documents and Settings\HP_Owner\Desktop\Logs\aswclnr.exe

    Then:
    Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.
    • Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    • Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
    • After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
    Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.​
    • When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
      • CounterSpy
      • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
      • Bitdefender - from step 6
      • Panda Scan - from step 6
      • runkeys.txt - the log from GetRunKey.bat
      • newfiles.txt - the log from ShowNew.bat
      • HijackThis ---> The last scan to run, properly installed and renaming as instructed.
    NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
     
    TimW, Sep 6, 2007
    #2
  3. lrohner

    lrohner Private E-2

    Thank you very much for replying. I had had gone through the READ ME FIRST previously (as much as my PC would allow), but decided to run through it again based on your reply.

    I got through all steps UNTIL I had to run Counterspy or AVG. When I try to run Counterspy (which the GeekSquad had run previously on my system), I get a message that says "The service controller returned No Service. You may be running a scheduled update."

    I wen ahead and uninstalled CounterSpy and tried to run AVG. When trying to start it up, I get the message "Connection to service failed. Please reinstall AVG Anti-Spyware 7.5". So I reinstalled it and got the same message. I then tried to uninstall it via Add/Remove Programs, and it will not uninstall. I hit the remove button and nothing happens.

    Any suggestions on what I should do now? I am attaching latest HJT log (I hope)!
     

    Attached Files:

    lrohner, Sep 6, 2007
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to re-read the instructions for downloading and installing HJT...this is exactly where we tell you not to install it (plus it is not renamed to analyses):
    C:\Documents and Settings\HP_Owner\Desktop\Geeksquad tools\HijackThis.exe

    You need to uninstall and reinstall it.

    We also need logs from:
    ShowNew
    GetRun
    BitDefender online scan

    You will not be able to run Counterspy if it was previously installed and the trial period is over.
     
    TimW, Sep 6, 2007
    #4
  5. lrohner

    lrohner Private E-2

    I have run through the steps as outlined with the following exceptions:

    1) I went into Safe Mode with Networking initially but physically unplugged my modem/router.

    2) Could not run Counterspy or AVG and so ran SuperAntiSpyware instead.

    3) BitDefender and Panda had to be run in Normal mode.

    Attached are BD and Panda Logs. More to follow.
     
    lrohner, Sep 7, 2007
    #5
  6. lrohner

    lrohner Private E-2

    Looks like the files didn't attach. Let's try again!
     

    Attached Files:

    lrohner, Sep 7, 2007
    #6
  7. lrohner

    lrohner Private E-2

    NewFiles and RunKeys attached.
     

    Attached Files:

    lrohner, Sep 7, 2007
    #7
  8. lrohner

    lrohner Private E-2

    After finishing all of the steps that were outlined and attaching the requested files, I decided to run Spybot again for hoots and giggles.

    Stration appears to have disappeared for now, but I still have the following that all appear to be little more than tracking cookies:

    DoubleClick
    Advertising.com
    MediaPlex
    Microsoft.Windows.ActiveDesktop

    So how do I know if I'm virus free?
     
    lrohner, Sep 7, 2007
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes...most of that is just cookies.

    Please use add/remove programs to uninstall:
    Viewpoint Manager (Remove Only)
    Viewpoint Media Player

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking Fix, exit HJT.

    Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Now download The Avenger by Swandog469, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Check the 'Input script manually' box.
    * Click on the magnifying glass icon.
    * Copy everything in the Quote box below, and paste it in the box that opens:

    * Now click the 'Done' button.
    * Click on the traffic light icon and OK the prompt.
    * You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt

    Please attach new logs for:
    ShowNew
    GetRun
    HJT
    Avenger
     
    TimW, Sep 7, 2007
    #9
  10. lrohner

    lrohner Private E-2

    Tim,

    Thanks for all of your help so far!

    I started to run through the last set of steps that you outlined. I ran Avenger with the script you indicated. It did reboot, but upon reboot I get a c:/windows/system32.cmd.exe box that says:

    The system cannot find the file specified.
    Could not Find C:\avenger\*.reg
    1 file(s) copied.
    zip warning: C:/backup.zip not found or empty
    adding: avenger/143727~1.dll (188 bytes security) (deflated 74%)
    adding: avenger/144032~1.dll (188 bytes security) (deflated 74%)
    adding: avenger/144032~2.dll (188 bytes security) (deflated 74%)
    adding: avenger/ALCMTR.EXE (148 bytes security) (deflated 70%)
    adding: avenger/avenger.txt (188 bytes security) (deflated 87%)
    adding: avenger/backup.reg (188 bytes security) (stored 0%)
    adding: avenger/cbbdcc~1.dll (188 bytes security) (stored 0%)
    adding: avenger/msdnc3.exe (184 bytes security) (deflated 19%)

    And then a box labeled "Windows - No Disk" pops up that says:

    Exception Processing Message c0000013 Parameters 75b6bf9c 4 75b6bf9c 75b6bf9c

    The buttons available are Cancel, Try Again and Continue. No matter which button I click, I can't get it to get past it. What do I do now?
     
    lrohner, Sep 7, 2007
    #10
  11. lrohner

    lrohner Private E-2

    I just kept clicking "continue" and the boxes finally went away.

    Here are the Avenger and HJT logs.
     

    Attached Files:

    lrohner, Sep 7, 2007
    #11
  12. lrohner

    lrohner Private E-2

    GetNew and ShowRun logs attached.
     

    Attached Files:

    lrohner, Sep 7, 2007
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    My bad......
    Run avenger.exe by double-clicking on it.
    * Check the 'Input script manually' box.
    * Click on the magnifying glass icon.
    * Copy everything in the Quote box below, and paste it in the box that opens:
    * Now click the 'Done' button.
    * Click on the traffic light icon and OK the prompt.
    * You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt

    Tell me how things are running.
     
    TimW, Sep 7, 2007
    #13
  14. lrohner

    lrohner Private E-2

    I ran Avenger with the new script that you provided. The command window got a lot further this time, but stopped after this line:

    Adding: avenger/LMIA.TMP/unicows.dll (188 byes security)(deflated 55%)

    And the error message in the Windows-No Disk box was:

    Exception Processing Message c0000013 Parameters 75b6bf9c 4 75 b6bf9c 75b6bf9c

    Avenger log file attached.
     

    Attached Files:

    lrohner, Sep 7, 2007
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It ran and did what we needed it to do .....are you having any malware issues now?
     
    TimW, Sep 7, 2007
    #15
  16. lrohner

    lrohner Private E-2

    Tim,

    I do appreciate all of your valuable time and assistance. Thank you so VERY, VERY much!

    The only issue that remains is that SpySweeper still will not let me complete a scan. It gets all the way to the end of the file scanning and then reboots my system. This worries me because earlier in the process, the reboot thingee was happening with HJT, AVG and a few other scans as well.

    How can I be certain that it's not some lingering virus doing that? And can I be sure that the doc files on my PC are not infected?
     
    lrohner, Sep 7, 2007
    #16
  17. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Try uninstalling and re-installing ....make sure you have uninstalled Counterspy first!
     
    TimW, Sep 7, 2007
    #17
  18. lrohner

    lrohner Private E-2

    I did uninstall Counterspy and then uninstalled and re-installed Spysweeper -- twice. The same thing happens. It gets near the end of scanning and reboots my pc. At the beginning of this whole virus thing, the same was happening with several other scanning programs, including HJT, Counterspy and AVG.

    The only other weird issues I have is that my IE has sporadic issues (no popups for hours and then 20 in just a few seconds) and sluggishness and my printer connection was lost during the process and no amount of downloading and reinstalling drivers helps (HP PSC 2170).

    I did talk to Webroot Tech Support and they had no solution to the problem. And the Geek Squad uses some type of Webroot program as well that they were unable to run because the system would reboot when it neared the end of the scan.

    Any suggestions?

    Also, if you would be so kind as to point me towards any documentation on here as to the best programs and setup to use to protect my PC going forward would be much appreciated.
     
    lrohner, Sep 8, 2007
    #18
  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    How to Protect yourself from malware!

    Although I'm leaning toward a hardware issue, please do the following:

    Download the following two files, create a folder on your desktop, call it TSC. Save these 2 files there.

    Note: They must be in the same directory for it to work properly!

    Sysclean Package

    Pattern.zip

    After you complete the above, locate the file ZIP file, "Pattern File", right click to extract the contents to the same directory.

    Once you complete the steps above, REBOOT INTO SAFE MODE!

    Once in Safe Mode double click the file sysclean.com. When the system cleaner loads, click SCAN to start the scanner. After you complete the scan reboot and attach a fresh HJT log along with the Trend SysClean Log.
     
    TimW, Sep 9, 2007
    #19

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds