I am afraid I need help this time....

Discussion in 'Malware Help (A Specialist Will Reply)' started by Navarro, Apr 21, 2009.

  1. Navarro

    Navarro Private E-2

    I generally consider myself fairly experienced in reading logs and removing various malware, as a matter of fact it used to be my job for a while. However, I'm afraid I'm unable to tackle this one:

    Generally I check my PC (windows XP SP2) with Spybot SD and MalwareBytes every week and my comp has stayed clean until around a week ago. The first symptom was countless popups (I use Firefox 3.0.1) I ran the MalwareBytes' scan and saw several infections (7 or 8) 4 of them were identified as vundo, and 2 as win32.agent.?? I decided to run ComboFix that usually saved me when I caught vundo in the past. After running the fix (It deleted a lot of files) My system started behaving erratically (constant memory protection errors, both browsers crashing every 30 (!) seconds, I had to literally, open the browser and read the page for 30 seconds before it crashed and needed restarting. Most programs were failing to start (including media player classic, utorrent, irotate, print spooler service.) and throwing "illegal operation" errors. Sore errors were even coming up while I was still on the login screen. Also I discovered I was not able to get into regedit or get into folder options, as all my hidden files became hidden again. Regedit was giving me an error "registry editing was disabled by the administrator". In desperate attempt to get my system running again, I booted from the Window PE CD. and deleted all files that were created in the last month. That seemed to stabilize the computer somewhat, browser no longer crashed but errors were still abundant. Even when I right click a file I get a "Program performed illegal operation and will be shut down" followed by the crash of windows explorer. I attempted several more scans with several programs according to what I was able to find on other forums and on google, with no luck. I finally found this forum and decided to ask for help. I have performed all the steps in READ & RUN ME FIRST with a small hitch. I ran the first 2 programs in the list with no problems, combofix would not run, I would get a message that this file has been compromised possibly by a VIRUT virus. After searching some more I downloaded and ran rmvirut.exe from http://www.avg.com/virus-removal.ndi-67762 it ran all night and said I had a virus in almost every executable on my system, after this fix I was able to run the other 2 programs. I am attaching all logs as requested. Current symptoms: Folder options still not available, no sound (!), most services do not start automatically, media player classic crashes on start, random memory access errors when browsing files. System is somewhat stable.

    I have done my best describing the problem and providing all available logs. Please help, this is a very important computer and having to reload the OS would be disastrous.
     

    Attached Files:

    Navarro, Apr 21, 2009
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yup....its a right mess. Why do I not see a firewall installed?
    Your MGLog was missing the RegKey log.

    Let's start with this:
    Please use add/remove programs to uninstall:
    Java(TM) 6 Update 3"
    Java(TM) 6 Update 4"
    Java(TM) 6 Update 5"
    Java(TM) 6 Update 7"

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now
    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    o If it is not on your Desktop, the below will not work.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

FCopy::
C:\MGtools\temp\userinit.exemg|C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\userinit.exe
C:\MGtools\temp\userinit.exemg|C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\userinit.exe 
C:\MGtools\temp\userinit.exemg|C:\WINDOWS\system32\userinit.exe
C:\MGtools\temp\userinit.exemg|C:\WINDOWS\system32\dllcache\userinit.exe
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Since combo didnt remove some items:
    Now download The Avenger by Swandog469, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:


    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now download and install:
    Java Runtime 6

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger and Combo.
     
    TimW, Apr 24, 2009
    #2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds