Antivirus Vista 2010

Discussion in 'Malware Help (A Specialist Will Reply)' started by Darlie, Mar 4, 2010.

  1. Darlie

    Darlie Private E-2

    Hello to you all,
    This time I am here with a problem and decided to post it so as to hopefully be of help to others who will run into this pesky rodent I am now dealing with.
    My daughter was searching for a movie I have wanted for a long time and can't find the dvd at a reasonable price. She decided bit torrents might help and she downloaded and opened a program. What she got was the antivirus vista 2010 bugger. I am using another laptop to post this with as the infected computer is rendered useless meaning the program won't allow access to the web, access to the registry, access to virus, malware or spyware scans. The same applies when booted in safe mode. I can't even load my saved malware removal files from a cd. As I type this the infected computer is running Avira antivir rescue system. It is presently showing 4 records 0 suspect files and 5 warnings. Most of those are coming from my security programs as they have been hijacked. The scan has a long way to go before it's done. Many websites seem to think you can download removal tools as well as access your registry and I don't know what that is about but I am telling you that you can't. Not with the one I have. I thought having this folder would be most helpful to others who will encounter this problem.
    Please advise from here. The operating system on the infected computer is Windows Vista home basic. Also, Antivir rescue system doesn't make logs at this time so if you want to know something specific from the scan logs I can see ask me and I will type it out for you. Thank you for your time and consideration.
     
    Darlie, Mar 4, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please try to do as much of the following as possible. You should be able to run some of the tools in safe mode or by changing their names or extensions. You can change an .exe file to a .com file and it should run. We need as much info as you can provide.

    You may need to download to a different computer and try to transfer via cd or thumb drive:

    Download and save the below to your PC (save it anywhere you can find it. The Desktop is fine). Then double click on it to run it.

    AVPFind.bat

    It should take a couple minutes to run. You will see a black command prompt window while it is running and it should close when it is finished. Once it finishes, attach the avplog.txt file that is will hopefully be created on your Desktop as long as the malware does not block the batch file from running. (See: HOW TO: Attach Items To Your Post)

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click and choose Run as Administrator


    You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    1. Rkill.exe
    2. Rkill.com
    3. Rkill.scr
    4. Rkill.pif


    * Double-click on the Rkill desktop icon to run the tool.
    * If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    * A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    * If not, delete the file, then download and use the one provided in Link 2.
    * If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    * Do not reboot until instructed.
    * If the tool does not run from any of the links provided, please let me know.
    Once you've gotten one of them to run then try to immediately run the following.

    Now download and Run exeHelper from Raktor

    • Please download exeHelper to your desktop.
    • Double-click on exeHelper.com to run the fix.
    • A black window should pop up, press any key to close once the fix is completed.
    • A log file named log.txt will be created in the directory where you ran exeHelper.com
    • Attach the log.txt file to your next message.

    Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

    If you already have them installed, be sure to update Malwarebytes and SUPERAntiSpyware before the scan!

    Now run this: Using Malwarebytes Anti-Malware

    Now run this: SUPERAntiSpyware - running & getting a log

    Now run this: Using MGtools


    Now you need to attach (See: HOW TO: Attach Items To Your Post ) the below logs created while running the above scans

    • exeHelper log
    • Malwarebytes Anti-Malware log
    • MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.
     
    TimW, Mar 5, 2010
    #2
  3. Darlie

    Darlie Private E-2

    Hi Tim and thank you, I was able to use a thumb drive to load malwarebytes the night of the infection. This allowed me to be able to use the computer. I am still not running as I did before the infection. I am running the programs you have asked me to run, now.

    ******************************************************************************
    * AVPFind.bat - (c) 09/01/2009 By Chaslang *
    * *
    * Helps to identify potential AntiVirus Pro infected system DLL files and *
    * possible replacement files to use during cleanup. *
    * Mod: 11/25/2009- Use Desktop instead of root folder for log *
    ******************************************************************************

    Windows OS is

    Microsoft Windows [Version 6.0.6002]

    ============= Finding copies of cngaudit.dll =================================
    "C:\Windows\ERDNT\cache\cngaudit.dll" 11776 11/02/2006 04:46 AM
    "C:\Windows\System32\cngaudit.dll" 11776 11/02/2006 04:46 AM
    "C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll" 11776 11/02/2006 04:46 AM

    ============= Finding copies of netlogon.dll =================================
    "C:\Windows\ERDNT\cache\netlogon.dll" 592896 04/11/2009 01:28 AM
    "C:\Windows\System32\netlogon.dll" 592896 04/11/2009 01:28 AM
    "C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll" 559616 11/02/2006 04:46 AM
    "C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll" 592384 01/18/2008 10:35 PM
    "C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll" 592896 04/11/2009 01:28 AM

    ============= Finding copies of scecli.dll =================================
    "C:\Windows\ERDNT\cache\scecli.dll" 177152 04/11/2009 01:28 AM
    "C:\Windows\System32\scecli.dll" 177152 04/11/2009 01:28 AM
    "C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll" 176640 11/02/2006 04:46 AM
    "C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll" 177152 01/18/2008 10:36 PM
    "C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll" 177152 04/11/2009 01:28 AM

    ******************************************************************************

    This log file is located at C:\rkill.log.
    Please post this only if requested to by the person helping you.
    Otherwise you can close this log when you wish.
    Ran as DPB on 03/06/2010 at 10:48:39.


    Processes terminated by Rkill or while it was running:


    C:\Users\DPB\Downloads\rkill.exe


    Rkill completed on 03/06/2010 at 10:48:50.


    exeHelper by Raktor
    Build 20091220
    Run at 10:50:07 on 03/06/10
    Now searching...
    Checking for numerical processes...
    Checking for sysguard processes...
    Checking for bad processes...
    Checking for bad files...
    Checking for bad registry entries...
    Resetting filetype association for .exe
    Resetting filetype association for .com
    Resetting userinit and shell values...
    Resetting policies...
    --Finished--
     
    Darlie, Mar 6, 2010
    #3
  4. Darlie

    Darlie Private E-2

    Here are my first two MWB scan logs from the night of the infection:
    Malwarebytes' Anti-Malware 1.43
    Database version: 3458
    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18882

    3/5/2010 3:51:49 AM
    mbam-log-2010-03-05 (03-51-49).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 277859
    Time elapsed: 44 minute(s), 5 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 1
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\gvtl (Malware.Trace) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Program Files\Gamevance (Adware.Gamevance) -> Quarantined and deleted successfully.

    Files Infected:
    (No malicious items detected)

    Malwarebytes' Anti-Malware 1.44
    Database version: 3825
    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18882

    3/5/2010 5:09:25 AM
    mbam-log-2010-03-05 (05-09-25).txt

    Scan type: Quick Scan
    Objects scanned: 113135
    Time elapsed: 8 minute(s), 22 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 2

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Users\DPB\AppData\Local\av.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.
    C:\Users\DPB\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> Quarantined and deleted successfully.
     
    Darlie, Mar 6, 2010
    #4
  5. Darlie

    Darlie Private E-2

    Most recent MWB scan: Malwarebytes' Anti-Malware 1.44
    Database version: 3825
    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18882

    3/6/2010 11:10:20 AM
    mbam-log-2010-03-06 (11-10-20).txt

    Scan type: Quick Scan
    Objects scanned: 107572
    Time elapsed: 5 minute(s), 0 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    Darlie, Mar 6, 2010
    #5
  6. Darlie

    Darlie Private E-2

    Hopefully the mgtools.zip file attached.
     

    Attached Files:

    Darlie, Mar 6, 2010
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please read this:
    How to attach items to your post.

    Please put ComboFix directly on your desktop, not here:
    Running from: c:\users\DPB\Downloads\ComboFix.exe

    I am not seeing much, but we can remove a few things.

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

File::
C:\Users\DPB\AppData\Local\04lb
C:\WINDOWS\temp\av9938.tmp
C:\WINDOWS\temp\iswift.dat
C:\WINDOWS\temp\sdk8
C:\WINDOWS\temp\sfdb.dat
C:\WINDOWS\temp\TMP0000004FFED787FCD2AAD914
C:\Users\DPB\AppData\Local\temp\1E98.tmp
C:\Users\DPB\AppData\Local\temp\8A84.tmp

Folder::
C:\Users\DPB\AppData\Local\04lb
C:\WINDOWS\temp\TMP0000004FFED787FCD2AAD914
C:\WINDOWS\temp\sdk8
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Mar 7, 2010
    #7
  8. Darlie

    Darlie Private E-2

    Thank you!!!!!!!!!!!!!!!
    I ran combofix from my desktop and the computer rebooted. Combofix was preparing the log file when windows was loaded. It said not to run any programs but everything that loads when windows loads was loading by default and I had no idea the computer was going to reboot or I would have changed what loads at startup. I hope this didn't hinder anything.
    I have a java problem and something wants to load a paperport at startup and asks for the disk to install it. I believe this is the result of registry files being corrupted, renamed or removed.
     

    Attached Files:

    Darlie, Mar 12, 2010
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks good. :)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    TimW, Mar 12, 2010
    #9
  10. Darlie

    Darlie Private E-2

    Thank you Tim... Aside from the problems I already mentioned that are the result of the virus. All is good but not done. I understand you are busy and I appreciate your time and effort and am sorry for taking up your time. I did note that you have dismissed me. Last night 3 Win32/Agent trojans were removed as I ran an online virus scan that didn't require java to run. I had said I was having problems running java.....
     
    Darlie, Mar 13, 2010
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    What exactly is the nature of your Java problem, as you never specified what was wrong?

    This could be just a problem with the installation files. Please do this:

    * Download the Microsoft Installer Clean Up utility file and save it on your desktop
    * Double click on executable file. The installation process will start. Follow the instructions accordingly
    * Once installation process is over, go to Start -> All Programs -> Run Windows Install Clean Up utility
    * This will launch the Windows Installer Clean Up utility dialog box
    * Under the Installed products list, select the desired JRE version that you want to remove
    * Click Remove and Exit

    Now see if you can uninstall them and install:
    Java Runtime 6



    The "generic" names of virus files does me no good. I would need the full path of the file.

    If you are still having malware issues, you should re-run SAS, MBAM, as well as COmboFix and get me a new MGLogs.zip.
     
    TimW, Mar 13, 2010
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds