Malware problem workstation

mongooseba · Oct 9, 2012

Dear All Experts,

I'm having problems with my workstation that had Windows 7 Pro installed. The following are some of my issues.

. My desktop has changed to a default "black" screen
. Cannot change the desktop from Control Panel
. Cannot use any of the programs
. Administrator account does not allow deleting other user accounts
. Restore points are missing
. Could not run CCleaner unless it was in Safe Mode

Basically the whole system is messed up.

I could not even access the internet unit l ran the CCleaner in Safe Mode. All other programs were tested under "Safe Mode." MGTools failed to initialized and the following error message appeared a number of times when the latter was used.

C:\windows\system32\cmd.exe
c:\windows\system32\config\system ~\AppData\Local\Temp
A temp file needed for installation could not be created or could not be written to ...

I made sure my AntiVirus was off in the "normal mode" as well in "Safe Mode." The User Account Control was also disabled. Please help and thanks in advanced.

Sincerely,
Mongooseba
:-o

Kestrel13! · Oct 10, 2012

Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Vista and Windows 7 users Right-click OTL and choose Run as Administrator)

When the window appears, underneath Output at the top change it to Minimal Output.

Check the boxes beside LOP Check and Purity Check.

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Attach both of these logs into your next reply.

mongooseba · Oct 10, 2012

Hi Kestrel13!,

Thank you so much for your speedy reply. Enclosed are the files that you need. Just wish to inform you that when the administrator account was logged on, my secondary account(adminstrator ac as well) reverted to having the same problems - no programs can be activated e.t.c. I had to run OTL under "Safe Mode."

Look forward to your expertise.

Sincerely,
Mongooseba

Kestrel13! · Oct 11, 2012

I am not seeing any malware.

For the black desktop, see: How to Remove Background Images to have Only Solid Colors in Windows 7 Let me know if it helps.

mongooseba · Oct 11, 2012

Hi Kestrel 13,

Thanks for looking at my logs. There are a few problems that still exist. During normal boot-up my background is totally black and am unable to change it to any other theme except for solid colors. My other concern is that none of the programs will work e.g. Word or Internet.

What should I do next?

Sincerely,
Mongooseba :-o

Kestrel13! · Oct 11, 2012

My other concern is that none of the programs will work e.g. Word or Internet.
Click to expand...

Do you receieve an error when you try? If so explain what. I may have to send you to the software forum regarding all this as I am not seeing malware.

mongooseba · Oct 12, 2012

Hi Kestrel113!,

When I log into the workstation I get a black background with the following pop-up message on the lower right corner-

"User Profile Service"
You have been logged on with the default profile for the system. Please see the event logfor details or contact your administrator.

Is there some thing that is causing a failed logon error? The "main" black background cannot be change with another theme. However, you can see the lower taskbar has been changed with a new theme. Should I bounce this off to another forum since you've verified that it has nothing to do with a virus? Thanks again and look forward to more help.

* Is there something wrong with the computer when MGTools cannot be activated? What is happening when the program states that there is not enough space for the TEMP file?

Sincerely,
Mongooseba

Kestrel13! · Oct 12, 2012

Yes, I think there are problems, but not of the malware nature. Please do post in software and explain your issues.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

mongooseba · Oct 13, 2012

Hi Kestrel13!,

Thanks for all your help and for your time in reveiwing my logs. Will address my problems on the software forum.

Sincerely,
Mongooseba

Kestrel13! · Oct 14, 2012

Most welcome. Best of luck!

Log in or Sign up

Malware problem workstation

mongooseba Corporal

Attached Files:

HitmanPro_20121009_1609.log

mbam-log-2012-10-09 (14-44-54).txt

RKreport[1].txt

TDSSKiller.2.8.10.0_09.10.2012_15.41.26_log.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

mongooseba Corporal

Attached Files:

OTL.Txt

Extras.Txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

mongooseba Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

mongooseba Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

mongooseba Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member