BSOD after removing System Check Malware and signs Of No Access Root Kit

kbro12 · Jan 20, 2012

Hi
Yesterday morning my computer was infected with the System Check Malware. I removed it using TDSS Killer, Malbytes Anti-Malware,and etc. After doing that I continued to get a BSOD after every reboot. It would go into a continuous loop of reaching the desktop and then crashing. I cannot run chkdsk r or f, and every time I do I get the message that it cannot look this drive and will run chkdsk on next reboot, but it never does. I also noticed that none of the changes i make in properties is saving. Also when I start in Safe-Mode for some reason System Properties pops up. The Blue Screen on displays for a second and then the loop starts, leaving me no time to read the errors. Also there are no .dmp files in the folder that they should be found in. I ran all of the steps outlined in this forum and they still show signs of spyware and malware. I could not run combo fix. It said that my system had the no access root kit and it restarted. I tried to run it again and got the same message.

Thanks.

System:
Compaq Pesario
Windows Vista SP2
160GB HD

TimW · Jan 20, 2012

Did you create this partition:
Code:
Partition    Disk #0, Partition #1    
Partition Size    10.34 GB (11,105,468,416 bytes)
Check in computer management and get me a screen shot of the partitions.

Now download The Avenger by Swandog46 to your Desktop.

See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
Extract avenger.exe from the Zip file and save it to your desktop.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run avenger.exe by double-clicking on it.

Click OK at the warning to continue to use The Avenger

Do not change any of the check box options!

Shut down your protection software now to avoid possible conflicts.

Copy everything in the Quote box below, and paste it into the Input script here: part of The Avenger

Drivers to delete:
mtnmp
rnqjeei
Files to delete:
C:\Users\Keith\AppData\Local\1r81037631qks236
C:\Users\Keith\AppData\Roaming\Microsoft\Windows\Templates\1r81037631qks236
C:\Users\Keith\AppData\Local\1r81037631qks236
C:\ProgramData\1r81037631qks236
C:\ProgramData\hEfrGIqJqgDZfh
C:\ProgramData\OMY7p2yLw0136r
C:\ProgramData\~hEfrGIqJqgDZfh
C:\ProgramData\~hEfrGIqJqgDZfhr
C:\Windows\System32\drivers\mtnmp.sys
C:\Windows\System32\drivers\rnqjeei.sys
C:\Windows\Temp\GUR45D5.tmp
C:\Windows\Temp\GURA488.exe
C:\Windows\Temp\GURA488.tmp
C:\Windows\Temp\GURB2F9.tmp
C:\Windows\Temp\tue0.0997472294242413.exe
C:\Windows\Temp\tue0.4257932886872723.exe
C:\Windows\Temp\tue0.4829347660857032.exe
C:\Windows\Temp\tue0.9194873996044385.exe
C:\Users\Keith\AppData\Local\Temp\295543.od
C:\TEMP\MSI160f7.LOG
C:\TEMP\MSI160f8.LOG
C:\TEMP\MSI19244.LOG
C:\TEMP\MSI19245.LOG
C:\TEMP\MSI1a6ae.LOG
C:\TEMP\MSI1a6af.LOG
C:\TEMP\MSI1c48a.LOG
C:\TEMP\MSI1c48b.LOG
C:\TEMP\MSI28a96.LOG
C:\TEMP\MSI28a97.LOG
C:\TEMP\MSI2fcaa.LOG
C:\TEMP\MSI2fcab.LOG
C:\ProgramData\UIWWFDnoJEOaR.exe
Registry values to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run | UIWWFDnoJEOaR.exe
Click to expand...

Now click the http://img33.imageshack.us/img33/9159/executeavenger.jpg button

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when The Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.

Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\MGlogs.zip

Make sure you tell me how things are working now!

kbro12 · Jan 20, 2012

Thank You for the reply.
I attempted to run avenger.exe and it said that it completed the first part and would finish after it rebooted my system. I let it reboot and once it did it crashed with the same bsod. I tried it once again, and rebooted in safe mode, but avenger never activated.

The partition drive came with this computer when I bought it. I think it is backed up files. I have attached screen shots of it.

TimW · Jan 21, 2012

Please run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:

C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

BSOD after removing System Check Malware and signs Of No Access Root Kit

kbro12 Private E-2

Attached Files:

rr1.txt

SUPERAntiSpyware Scan Log - 01-20-2012 - 04-37-35.log

mbam-log-2012-01-20 (04-56-59).txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

kbro12 Private E-2

Attached Files:

partrition1.jpg

printscreen2.jpg

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

BSOD after removing System Check Malware and signs Of No Access Root Kit

kbro12 Private E-2

Attached Files:

rr1.txt

SUPERAntiSpyware Scan Log - 01-20-2012 - 04-37-35.log

mbam-log-2012-01-20 (04-56-59).txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

kbro12 Private E-2

Attached Files:

partrition1.jpg

printscreen2.jpg

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches