Malware - Please help

Hey I have malware on my computer and cannot get it off. Please help. :-(

I ran through your read me first file completely and am still having problems. I definitely still have malware on my computer.

Here goes with a brief runthrough.

Superantispyware worked fine; I uploaded the log

Malwarebytes worked fine; I uploaded the log

Combofix started, popped up with a window warning me of a rootkit and then wanted to reboot. After rebooting it started again, got to about Stage_3 and then up came the blue screen of death. I noticed on the blue screen it said

IRQL_NOT_LESS_OR_EQUAL as well as a bunch of other stuff. No log.

RootRepeal Ran fine; I have uploaded the log

MGtools didn't seem to work properly - I can't remember if I saw the blue screen or the system just reset but I've uploaded the zip anyway.

I still had problems so I continued along through your readme post. I ran GMER and it hung and showed me the blue screen of death.

I ran Rootkitbuster - it worked - and will include a log if I can work out how to include more than four.

Sanity Check appeared to find something and then crashed with the blue screen, again.

Bitdefender didn't work.

Trend Housecall didn't work.

I'm at my wits end, particularly since I've actually put my system into recovery mode during this process and tried to reformat. I just want a working system, my data on this machine is worth nothing to me. I went through the procedure with my ASUS system cd's and reinstalled Windows Vista....AND THE MALWARE SURVIVED! Unbelievable. I even overlayed Service Pack 2 to no avail.

Any ideas?

I uploaded a little thing last week to another site: I'll include it here if it adds any value. Apologies for the length.

I have an ASUS laptop that is definitely infected with malware. I have tried a few things get rid of it but at the moment I am beaten.

I would describe myself as having a 'medium' level of computer ability.

I'm going to write down all I can to help anybody who thinks they might be able to help me - sorry if it's longwinded but we just want our problems fixed.

THE PROBLEM

I think it started when we downloaded a video from the internet (it was NOT porn!) that wouldn't play unless we downloaded an addon for our videoplayer (we were using winamp at the time). Being a little naive we clicked yes, something downloaded to our computer and the problems began from there. (The video still didn't play!)

We run our internet browser and every now and again we'll click a link and we'll be pulled to a completely different website in a classic malware kind of way. It seems to happen more when we click links after performing a search but this is not exclusive. Newspaper websites and html email accounts seem to always work. It gets worse as time goes by - the first ten minutes after a system restart are fine if we log into our browser straight away and use it but after about this period of time the frustration starts. The malware always opens in a new tab, not a completely new browser window and happens regardless of whether we are using iexplorer, chrome or firefox.

Having some knowledge of what this was we started to attempt to clean our computer. We are running a version of Nortons (we weren't at the time of the original infection for some reason) but it didn't seem to find anything on our hard drive. After switching it on we didn't see much of an improvement but quite often a "phishing attempt" warning will pop up in our browser window. When we click on it it'll come up with a report that says

An intrusion attempt by ringo-r0ads was blocked

also giving time and details. The attempts are always by different websites (lingvo0barcode, or some other random bunch of names/websites) but its always classed by nortons as a 'tidserv activity'.

After running a full scan etc etc we tried downloading a few anti malware programs. It was very difficult to get any of these programs to run as the malware seems to block them. We tried a lot of things that were suggested - renaming files, creating new users, running direct from a usb, an html based scanner and ended up getting most programs to run. Malwarebytes found a few infections and performed a clean as did a few others - but none of them worked to the point where the malware is gone. It was bringing up a fake Windows Security Window and giving me the opportunity to buy some type of program fix at first but one of the malware flushers got rid of that and we haven't seen that aspect of it since.

At this point we made the decision to format the computer and reinstall windows. This notebook is communal and it's data isn't as important to us as it's functionality. We have two cd's with the notebook - an ASUS driver and utility cd and an ASUSTEK Windows Vista recovery CD. We ran the cd in from the start that began the 'recovery' process and reinstalled windows and our drivers. It should be noted at this point that the process offered us three option in regards to partitioning the drive but only the option "no partitioning" made the process actually work. This seemed strange, which is why I mention it.

After going through this process - and not entering any possibly infected usb stick into the computer - we ended up with a fresh version of vista. All of our data expunged.......YET STILL WITH MALWARE ON IT! I am smart enough to know that however this process works we didn't format the thing completely or properly but I am still pretty impressed with this malware that it can survive that process. None of our saved data did.

Running programs can be difficult but seems to work best if you run or install whatever the program is immediately after restart. This malware seems smart enough to kill anything off that looks like it's going to attack it. For instance, at the moment when I try run Malwarebytes it returns a "Runtime Error 0" message.

Lastly, we keep getting the following message after a five or ten minute period after startup. The malware is still there before and after it pops up but definitely gets worse after it does pop up:

HOST PROCESS FOR WINDOWS SERVICES STOPPED WORKING AND WAS CLOSED

A PROBLEM CAUSED THE APPLICATION TO STOP WORKING CORRECTLY.

WINDOWS WILL NOTIFY YOU IF A SOLUTION IS AVAILABLE.

 

Tim

Thankyou for the quick reply. I think my mglog.zip file is corrupted because the program isn't running properly. I ran it again (after first unchecking the UAC box) and kept a close eye on exactly when it hung. Periodically as the program ran the following message was printed in the text box:

Zip Error! Zip file structure invalid (c:/mglogs.zip)

The program seems to run until just past the part where it looks for a Google Ping or Url. I think it hung at precisely the point where it is "Getting partition info" from Win.ini although that second little snippet is uncertain as the blue screen of death was pretty quick to come up.

This would make sense though - pretty much any program I'm running to do with rootkits is bringing up the blue screen of death, combo fix included. Even when I put my recovery Cd in and attempted to reformat the entire drive the process kept hitting a blue screen if I selected two partitions instead of one.

I downloaded hijack this and ran it as a seperate process; I have uploaded the logfile in this reply. As well, I have uploaded the new Mglog.zip file but am pretty certain that it'll still be corrupted.

Please help me! ;-)

P.s It won't let me upload my mglog.zip file as it seems to think I already have. Is this only running a quick name check or are the two files exactly the same?

 

Ok

All except AVPFIND ran - this program terminated at a line on the screen that said something like

windows\system32\cmd.exe

finding copies of scecli.dll

I obviously haven't put up that log. Combo fix finally ran all the way through, I've included it's log as well.

Regards

 

No further issues.

Cheers