Malware

Glamis77 · Feb 6, 2009

I could tell by the feel of things something was awry. CPU would spike steadily for a few minutes after boot up. Couldn't update AVG. Then, computer locked up, and, upon reboot, couldn't connect to the internet. W2K no longer recognized or responded to the Linksys network adapter and consequently there was no LAN.

Ran through the Read and Rum me first tasks. Malwarebytes, SuperAntiSpyWare, and Spybot found nothing. Combofix, however, appears to have found some things. I can not connect to the internet.

One note -- Combofix didn't seem to complete it cycles. When it stopped, it produced a log, but there was nothing but blue screen. Had to reboot manually. (I didn't re-run Combofix. Please advise if I should.)

Logs are attached as required.

As always, appreciate the support of Majorgeeks!!!!!!!!! :major

Glamis77 · Feb 6, 2009

1234

TimW · Feb 8, 2009

You have little room left on that hard drive. Your logs are clean. So I suggest that you post in either hardware or networking as this sounds like it is just a matter of your network adapter.
You need to tell them if you are on a router or just a modem...if you are wired or wireless.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Glamis77 · Feb 9, 2009

Tim,

I was able to get online long enough last Friday to post the logs. Soon after, however, I got the blue with an error code, I rebooted, and within seconds of getting back online I would get another blue screen. Within five minutes I was back to where I had started before I performed the Read and Rum Me First tasks -- computer didn't recognize Linksys notebook adapter, under Device Manager I receive Error Code 12 (Device cannot find enough free resources that it can use).

I am far, far from being an expert, and although I do not have XP, I suspect some sort of AntiVirus rootkit that attacks the drivers.

If I am not infected, why would Combofix put files into quarantine?

TimW · Feb 10, 2009

You had some infections that the scans took care of. Your BSOD issues need to be addressed in the software forum. I would take particular note of the message that you do not have sufficient resources.

Glamis77 · Feb 10, 2009

Thanks for the help, Tim!!! :major:major

As always, I appreciate the support!!!

TimW · Feb 12, 2009

No problem...hope you get it sorted out.

Log in or Sign up

Malware

Glamis77 Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 02-05-2009 - 01-58-44.log

mbam-log-2009-02-04 (22-23-25).txt

ComboFix.txt

Glamis77 Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Glamis77 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Glamis77 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member