cannot run malaware or anything else

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by lcerbone, Jan 5, 2011.

  1. lcerbone

    lcerbone Private E-2

    Ok so I have used malware bytes for a long time now but this is the first time I ever encountered this. PC works fine, internet works fine. I have a friends laptop and I noticed he had Antivirus 2010 on his laptop. I deleted it from programs, i tried downloading and running malware bytes and super anti malware and they install but will not run. Malware will come up and when I click perform quick scan , it shuts down. When I try to reload it " windows cannot acces specified path, youmay not have the approriate permissions to access". I opened I dos command giving permissions to everyone so I can try to reopen the program, it opens and then same thing happens( click quick scan it shuts dwn) I am at my wits end here what is my next step? (also he has mcafee virus protection which is disabled, system restore is off cannot turn it on)
     
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Welcome to Major Geeks!

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click and choose Run as Administrator

    You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
    1. Rkill.exe
    2. Rkill.com
    3. Rkill.scr
    4. Rkill.pif
    Once you've gotten one of them to run then try to immediately run the following.


    Download and save the below to your PC (save it anywhere you can find it. The Desktop is fine). Then double click on it to run it.

    AVPFind.bat

    It should take a couple minutes to run. You will see a black command prompt window while it is running and it should close when it is finished. Once it finishes, attach the c:\avplog.txt file that is will hopefully create as long as the malware does not block the batch file from running. (See: HOW TO: Attach Items To Your Post )


    Now download and Run exeHelper
    • Please download exeHelper to your desktop.
    • Double-click on exeHelper.com to run the fix.
    • A black window should pop up, press any key to close once the fix is completed.
    • A log file named log.txt will be created in the directory where you ran exeHelper.com
    • Attach the log.txt file to your next message.
    Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


    Also please try running the below online scan:

    http://www.superantispyware.com/onlinescan.html

    Reboot immediately after scanning if it finds and removes anything. Let me know if anything was found. See if you can save a log with it.


    Then try running these instructions: Using MGtools


    Attach the below logs when finished with all of the above:
    • C:\avplog.txt - from AVPfind
    • a log from online SAS scan if you could make one
    • log.txt - from exeHelper
    • C:\MGlogs.zip - from MGtools
    The C:\ assumes that drive C is you Windows boot drive. If you boot from another drive, then use the correct drive letter above.
     
  3. lcerbone

    lcerbone Private E-2

    ok everything ran ok including mgtools. The only zip i see in the root folder is zip.exe which i cannot attach. also the super anti virus was running but would shut down. here are the two
     

    Attached Files:

  4. lcerbone

    lcerbone Private E-2

    i ran the mgtools again, once again there is a zip file in there but it is zip.exe cannot send to you, it went thru the whole scan and said press any key to complete.
     
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Look for a C:\MGlogs.zip not an exe file
     
  6. lcerbone

    lcerbone Private E-2

    found it!!
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Run the C:\MGtools\FixACLS.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    After running the above, immediately check to see if you can run Malwarebytes and then after running Malwarebytes ( whether it runs or not ) see if you can run ComboFix Attach logs for anything that runs.
     
  8. lcerbone

    lcerbone Private E-2

    ran that then tried malware and combofix nothing. When i try to run malware its says "windows cannot access the specified device path or file, you may not have the approriate permissions to access the item"
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\Windows\Temp
    C:\Users\owner\AppData\Local\Temp

    Now right click on ComboFix and select Rename. Change the name to 123cf.com

    Now right click on 123cf.com and select Run As Administrator. If it runs, attach the log..


    No matter what happens above, see if the below will run.


    Download TDSSKiller from Kaspersky to your directly onto your Desktop
    • Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrartor. )
    • If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123tdk.com).
    • Allow the application to run if prompted by Windows or any security programs you have installed
    • It will start the scan and run rather quickly and will notify you of whether anything is found or not.
    • Follow the instructions to delete/quarantine if asks you what to do when if finds something.
    • Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )
     
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    After running TDSSkiller, please do the below.


    See if you can delete the below file:
    C:\ProgramData\.wtav




    Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.
    • Right click the Command Prompt entry and select Run As Administrator.
      • It is critical that you run it this way.
    • If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
    • Enter the below commands at the command prompt each followed by the enter key. Try each command!!!! The bold black are commands. The purple/brown is merely informational.
    del C:\Windows\assembly\GAC\__AssemblyInfo__.ini <-- there is a space after the del and there are two underscores before and after the AssemblyInfo name.
    dir C:\Windows\assembly\GAC\*.* >C:\flist.txt <-- there is a space after the dir


    Attach the C:\flist.txt file to your next message. DO NOT REBOOT YOUR PC after doing this, you need to keep your PC running until you hear from me again.
     
  11. lcerbone

    lcerbone Private E-2

    cannot run combofix, but was able to do other. attached is log text.
     

    Attached Files:

  12. lcerbone

    lcerbone Private E-2

    I have vista by the way, i tried that but nothin happened.
     
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay that find your problem and so did MGtools. The vbma92a1 driver is part of the infection. Why did you tell TDSSkiller to skip it???

    See my last instructions on deleting some files, and then run TDSSkiller and again and make sure you select Quarantine. Then allow TDSSkiller to reboot your PC immediately.


    After reboot run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below log:
    • C:\MGlogs.zip
     
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What do you mean by nothing happened? How far did you get? Did you get the command prompt to open? Did you run the commands given? Did you get any error messages?
     
  15. lcerbone

    lcerbone Private E-2

    ran both commands pressed enter and it just dropped back to
    C:\users\owners:
     
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes that's correct. You need to attach the C:\flist.txt file I asked for.
     
  17. lcerbone

    lcerbone Private E-2

    here is flist.txt.
     

    Attached Files:

  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Good now if you also made sure to delete the C:\ProgramData\.wtav file, then run my instructions in message # 13.
     
  19. lcerbone

    lcerbone Private E-2

    mglogs.zip
     

    Attached Files:

  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay the bad files all came back at reboot because the driver did not get disabled. Let's try this a different way.

    • Please download GMER and save it to your Desktop:
      • Unzip (extract) the gmer.exe file to your Desktop.
    • Make sure the executable file is named gmer.exe otherwise the instructions below will not work properly.
    • On you Desktop, click the Start button and select Run
    • Then in the Run box copy & paste the below exactly as written
      • "%userprofile%\desktop\gmer.exe" -protect
    • Then click OK.
    • You may have to do this more than once to get it to run properly due to the malware..
    • After you get GMER running from the above, GMER will hopefully show the rootkit. Select right click on the bad service and choose Disable Service on the content menu.
    • See the picture below which is just an example of an older TDL infection. The bad service you are seeing/looking form will vary based on the infection but you may see the vbma92a1.sys or vbma92a1 names. If you don't see it, stop here and tell me, if you did see it and Disabled it, just contine.
    http://forums.majorgeeks.com/chaslang/images/GMER/kungs_service_Select_Disable.png

    • If this works properly GMER will disable the service ok and you will get the below prompt telling you to reboot.
    http://forums.majorgeeks.com/chaslang/images/GMER/kungs_service_disabled.png
    • Click OK to reboot.
    • After your PC reboots, run TDSSkiller and if it delects the bad service that we are interested in. change the default action to delete at the top then click on Continue.
    • TDSSkiller may ask you to reboot the computer to complete the process. Click on Reboot Now.
    If the above is all successful, we may be able to run ComboFix now, but we will run it with the below instructions.
    • On you Desktop, click the Start button and select Run
    • Then in the run box copy & paste the below exactly as written
      • "%userprofile%\desktop\combofix.exe" /stepdel
    • Then click OK.
    • When finished, ComboFix should create a combofix.txt log for you to attach to your next reply.
     
    Last edited: Jan 11, 2011
  21. lcerbone

    lcerbone Private E-2

    here is combofix.
     

    Attached Files:

  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Excellent.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\MGlogs.zip
     
  23. lcerbone

    lcerbone Private E-2

    mglogs.zip attached
     

    Attached Files:

  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Now we need to use ComboFix again
    • Make sure that ComboFix.exe is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now rerun TDSSkiller one more time.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm heading off to bed now ( have an early day tomorrow) but it is looking like we may have it licked now.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds