cannot run malaware or anything else

Welcome to Major Geeks!

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Administrator

You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

1. Rkill.exe
2. Rkill.com
3. Rkill.scr
4. Rkill.pif

Once you've gotten one of them to run then try to immediately run the following.


Download and save the below to your PC (save it anywhere you can find it. The Desktop is fine). Then double click on it to run it.

AVPFind.bat

It should take a couple minutes to run. You will see a black command prompt window while it is running and it should close when it is finished. Once it finishes, attach the c:\avplog.txt file that is will hopefully create as long as the malware does not block the batch file from running. (See: HOW TO: Attach Items To Your Post )


Now download and Run exeHelper

• Please download exeHelper to your desktop.
• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• A log file named log.txt will be created in the directory where you ran exeHelper.com
• Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


Also please try running the below online scan:

http://www.superantispyware.com/onlinescan.html

Reboot immediately after scanning if it finds and removes anything. Let me know if anything was found. See if you can save a log with it.


Then try running these instructions: Using MGtools


Attach the below logs when finished with all of the above:

• C:\avplog.txt - from AVPfind
• a log from online SAS scan if you could make one
• log.txt - from exeHelper
• C:\MGlogs.zip - from MGtools

The C:\ assumes that drive C is you Windows boot drive. If you boot from another drive, then use the correct drive letter above.

 

Look for a C:\MGlogs.zip not an exe file

 

Run the C:\MGtools\FixACLS.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

After running the above, immediately check to see if you can run Malwarebytes and then after running Malwarebytes ( whether it runs or not ) see if you can run ComboFix Attach logs for anything that runs.

 

Delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\Windows\Temp
C:\Users\owner\AppData\Local\Temp

Now right click on ComboFix and select Rename. Change the name to 123cf.com

Now right click on 123cf.com and select Run As Administrator. If it runs, attach the log..


No matter what happens above, see if the below will run.


Download TDSSKiller from Kaspersky to your directly onto your Desktop

• Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrartor. )
• If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123tdk.com).
  • If you do not see the file extension, please refer to: How to view hidden, system files & folders!
• Allow the application to run if prompted by Windows or any security programs you have installed
• It will start the scan and run rather quickly and will notify you of whether anything is found or not.
• Follow the instructions to delete/quarantine if asks you what to do when if finds something.
• Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )

 

After running TDSSkiller, please do the below.


See if you can delete the below file:
C:\ProgramData\.wtav




Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.

• Right click the Command Prompt entry and select Run As Administrator.
  • It is critical that you run it this way.
• If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
• Enter the below commands at the command prompt each followed by the enter key. Try each command!!!! The bold black are commands. The purple/brown is merely informational.

del C:\Windows\assembly\GAC\__AssemblyInfo__.ini <-- there is a space after the del and there are two underscores before and after the AssemblyInfo name.
dir C:\Windows\assembly\GAC\*.* >C:\flist.txt <-- there is a space after the dir


Attach the C:\flist.txt file to your next message. DO NOT REBOOT YOUR PC after doing this, you need to keep your PC running until you hear from me again.

 

Okay that find your problem and so did MGtools. The vbma92a1 driver is part of the infection. Why did you tell TDSSkiller to skip it???

See my last instructions on deleting some files, and then run TDSSkiller and again and make sure you select Quarantine. Then allow TDSSkiller to reboot your PC immediately.


After reboot run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below log:

• C:\MGlogs.zip

 

What do you mean by nothing happened? How far did you get? Did you get the command prompt to open? Did you run the commands given? Did you get any error messages?

 

Yes that's correct. You need to attach the C:\flist.txt file I asked for.

 

Good now if you also made sure to delete the C:\ProgramData\.wtav file, then run my instructions in message # 13.

 

Okay the bad files all came back at reboot because the driver did not get disabled. Let's try this a different way.

• Please download GMER and save it to your Desktop:
  • Unzip (extract) the gmer.exe file to your Desktop.
• Make sure the executable file is named gmer.exe otherwise the instructions below will not work properly.
• On you Desktop, click the Start button and select Run
• Then in the Run box copy & paste the below exactly as written
  • "%userprofile%\desktop\gmer.exe" -protect
• Then click OK.
• You may have to do this more than once to get it to run properly due to the malware..
• After you get GMER running from the above, GMER will hopefully show the rootkit. Select right click on the bad service and choose Disable Service on the content menu.
• See the picture below which is just an example of an older TDL infection. The bad service you are seeing/looking form will vary based on the infection but you may see the vbma92a1.sys or vbma92a1 names. If you don't see it, stop here and tell me, if you did see it and Disabled it, just contine.

http://forums.majorgeeks.com/chaslang/images/GMER/kungs_service_Select_Disable.png

• If this works properly GMER will disable the service ok and you will get the below prompt telling you to reboot.

http://forums.majorgeeks.com/chaslang/images/GMER/kungs_service_disabled.png

• Click OK to reboot.
• After your PC reboots, run TDSSkiller and if it delects the bad service that we are interested in. change the default action to delete at the top then click on Continue.
• TDSSkiller may ask you to reboot the computer to complete the process. Click on Reboot Now.

If the above is all successful, we may be able to run ComboFix now, but we will run it with the below instructions.

• On you Desktop, click the Start button and select Run
• Then in the run box copy & paste the below exactly as written
  • "%userprofile%\desktop\combofix.exe" /stepdel
• Then click OK.
• When finished, ComboFix should create a combofix.txt log for you to attach to your next reply.

 

Excellent.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

 

Now we need to use ComboFix again

• Make sure that ComboFix.exe is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now rerun TDSSkiller one more time.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

I'm heading off to bed now ( have an early day tomorrow) but it is looking like we may have it licked now.