Is the PC clean

Discussion in 'Malware Help (A Specialist Will Reply)' started by donxkey, Aug 18, 2009.

  1. donxkey

    donxkey Private E-2

    Hello

    I work for a small university bookshop, one of our work machines was infected with a virus. Unfortunatley my manager and one of the other chaps that works here is a fan of torrents. I think I have convinced them to quit using the work machine for this!!

    The virus changed the wallpaper to "Warning! Your're in danger etc..." I was not able to run anything including task manager, everytime I tried it threw up a false warning that the file was infected. I was also getting alerts from what I assume is a fake antivirus program called total security 2009.

    I followed the information in the read and run me first malware removal guide as closely as I could. I had to start the machine in safe mode in order to install and run the programs I was told to use.

    SUPERAntiSpyware would not run, unfortunatley I forgot to write the error down but I believe it was somethng like the windows administrator will not allow this. I renamed the file but it didnt make any difference.

    I skipped this and ran Malwarebytes in safe mode

    Then I started combofix in safe mode and when it rebooted the PC I let it boot normally. The background had changed to a generic windows one and I was able to run programs again. Combofix finished up and gave me a log

    I went on to run Root Repeal in normal mode and finally MGtools.

    Everything seems fine now but as I had to skip the step with SAS and as this is a work PC with severe consequences to the business if it fails, I would really appreciate it if someone could take a look at the logs.

    Thanks Clare
     

    Attached Files:

    donxkey, Aug 18, 2009
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi and welcome. I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Thanks for your patience during this time.

    Kes13!
     
    Kestrel13!, Aug 20, 2009
    #2
  3. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there. Not much remains to be done; the scans took care of most things, let's just do this:

    1. Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking Fix exit HJT.

    2. Now we need to use ComboFix to remove a bunch of malware files.

    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below code box into it
    (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::
 
Driver::
netskt
 
File::
c:\windows\system32\netskt.sys
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    3. Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Combofix.

    4. Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now.

    5. You need to ensure that once I have given you the final steps that you install some anti-virus and a third party firewall.
     
    Last edited by a moderator: Aug 23, 2009
    Kestrel13!, Aug 23, 2009
    #3
  4. donxkey

    donxkey Private E-2

    Thank you so much for the help.

    I have attatched those logs.

    What antivirus and firewall would you suggest?

    thanks again

    clare
     

    Attached Files:

    donxkey, Sep 4, 2009
    #4
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I am sorry for the slight delay.

    The fix I last gave you didn't work because a new version of combofix came out in the meantime and therefore requires an update before my script will become effective. Please right click the combofix.exe on your desktop and delete it.

    Next...
    Go to this link and download the new ComboFix.exe

    • Re-run the scipt that I gave you in my previous post with the new combofix.
    • Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Combofix.
    • Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now.

    Thanks
    Kes
     
    Kestrel13!, Sep 8, 2009
    #5

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds