Online Guard virus

Can you eleborate on this please? You need to tell me what you have tried and what has not worked exactly.

 

You made no mention of MGTools or Rootrepeal, did you try these too? We also request that you attach logs as part of the R&R.

 

Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode

DAEMON Tools Lite is still running at start up, you need to disable this whilst we are fixing.

Uninstall the below outdated Java if possible.

• Java(TM) 6 Update 23
• Java(TM) 6 Update 7

The log from running SAS is located here: C:\Users\George\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\SUPERAntiSpyware Scan Log - 10-09-2011 - 17-41-33.log Please attach it.


Download and run Win32kDiag per the below instructions:

• Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
• Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log

C:\win32kdiag.exe -f -r


Now we need to scan the system with this special tool.

• Please download Junction.zip and save it to your root folder (C:\Junction.zip)
• Unzip it and put junction.exe in the root folder (C:\junction.exe)
• Now click Start => Run... => Copy and paste the following command in the run box and click OK:
  
  cmd /c junction -s c:\ >C:\log.txt
  ​
• A command prompt window opens and also a license agreement from SysInternals will appear.
• Accept the license agreement and the scan will begin.
• Wait until a log file opens. Attach this C:\log.txt when it finishes (the command prompt window will close when it finishes). (How to attach items to your post)
• NOTE: It scans your whole hard disk so if can take a long time. Be patient and don't do anything else while it is scanning.

Now we need to use ComboFix by sUBs

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

Code:

KILLALL::

File::
c:\users\George\AppData\Roaming\ldr.ini
C:\Users\George\AppData\Local\1q3w02a0081j0itg2kw0cccblwwvqskv6d
c:\users\George\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crss.exe
c:\windows\system32\JLL88gRRZhYX.exe
C:\Users\George\AppData\Roaming\Microsoft\Windows\Templates\1q3w02a0081j0itg2kw0cccblwwvqskv6d
C:\Users\George\AppData\Roaming\Microsoft\Windows\Templates\43l045680n245135g2l1jetcg6r0ukq8

Folder::
c:\users\George\AppData\Roaming\GppnnG5aQH6dW7R
c:\users\George\AppData\Roaming\HNNyyxAA0uv2iF
c:\users\George\AppData\Roaming\yEEEL88gRZhYwkV
c:\users\George\AppData\Roaming\XiiivDD3on4am5W
c:\users\George\AppData\Roaming\d33oonFF4mH5WJd
c:\users\George\AppData\Roaming\B111uvvS2obFpm5
c:\users\George\AppData\Roaming\zwwjjUCCelBrz
c:\users\George\AppData\Roaming\ZG4aQH6sW7E9TqY
c:\users\George\AppData\Roaming\O0ucS1ibDoGaHsJ
c:\users\George\AppData\Roaming\xaaamHH6sWJfE8g
c:\users\George\AppData\Roaming\U11iibDD3on
c:\users\George\AppData\Roaming\wmmmH55sQJ7EKgR
c:\users\George\AppData\Roaming\lIBBttzPNycAuv2
c:\users\George\AppData\Roaming\WS2ibF3pn
c:\users\George\AppData\Roaming\aRL9hTXqCI
c:\users\George\AppData\Roaming\WS2ibF3pn
c:\windows\system32\QwkkVVelOBt
C:\Y55ssWJ7dEL8RZh
C:\WxxPP0yycS1vDon
c:\windows\system32\YQQQJ66dEK
C:\ScccA11uvDob4pG
C:\GELL8TTZqhYwkVr
c:\windows\system32\ROONNtxA02ibDp
C:\uYCCeekIr
C:\jffRRZ9hTw
c:\windows\system32\utttxPP0ucSib3n
C:\iZZqqjYCwkIVr
c:\programdata\WSTB
C:\UeellIBrzPNyx1v

Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{8214ADD5-AD05-4B67-BD93-C3BB6003BCCF}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8214ADD5-AD05-4B67-BD93-C3BB6003BCCF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GeeelOOBtzPyc1i8234A"=-

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
  
  
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.


And one more scanning tool I want to use to collect more information is OTL per the below.

Please download OTL by Old Timer to your desktop.
See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

1. Double-click OTL.exe to run (Vista and Win7 right click and select Run as Administrator)
2. When OTL opens, change the Output (at the top-right portion of the program) to Minimal Output.
3. Put check-marks in LOP Check and Purity Check.
4. Now click the http://img171.imageshack.us/img171/2405/runscanotl.png button.

• When the scan is complete, two logs entitled OTL.txt and Extras.txt will be created on your desktop.
• Attach both of these logs to your next message as well as any other requested logs.

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run


Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

 

Replace the Combofix step with this then:


Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe And select " Run as administrator " to run it.
• Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.

Code:

:reg
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{8214ADD5-AD05-4B67-BD93-C3BB6003BCCF}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8214ADD5-AD05-4B67-BD93-C3BB6003BCCF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GeeelOOBtzPyc1i8234A"=-

:files
c:\users\George\AppData\Roaming\ldr.ini
C:\Users\George\AppData\Local\1q3w02a0081j0itg2kw0cccblwwvqskv6d
c:\users\George\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crss.exe
c:\windows\system32\JLL88gRRZhYX.exe
C:\Users\George\AppData\Roaming\Microsoft\Windows\Templates\1q3w02a0081j0itg2kw0cccblwwvqskv6d
C:\Users\George\AppData\Roaming\Microsoft\Windows\Templates\43l045680n245135g2l1jetcg6r0ukq8
c:\users\George\AppData\Roaming\GppnnG5aQH6dW7R
c:\users\George\AppData\Roaming\HNNyyxAA0uv2iF
c:\users\George\AppData\Roaming\yEEEL88gRZhYwkV
c:\users\George\AppData\Roaming\XiiivDD3on4am5W
c:\users\George\AppData\Roaming\d33oonFF4mH5WJd
c:\users\George\AppData\Roaming\B111uvvS2obFpm5
c:\users\George\AppData\Roaming\zwwjjUCCelBrz
c:\users\George\AppData\Roaming\ZG4aQH6sW7E9TqY
c:\users\George\AppData\Roaming\O0ucS1ibDoGaHsJ
c:\users\George\AppData\Roaming\xaaamHH6sWJfE8g
c:\users\George\AppData\Roaming\U11iibDD3on
c:\users\George\AppData\Roaming\wmmmH55sQJ7EKgR
c:\users\George\AppData\Roaming\lIBBttzPNycAuv2
c:\users\George\AppData\Roaming\WS2ibF3pn
c:\users\George\AppData\Roaming\aRL9hTXqCI
c:\users\George\AppData\Roaming\WS2ibF3pn
c:\windows\system32\QwkkVVelOBt
C:\Y55ssWJ7dEL8RZh
C:\WxxPP0yycS1vDon
c:\windows\system32\YQQQJ66dEK
C:\ScccA11uvDob4pG
C:\GELL8TTZqhYwkVr
c:\windows\system32\ROONNtxA02ibDp
C:\uYCCeekIr
C:\jffRRZ9hTw
c:\windows\system32\utttxPP0ucSib3n
C:\iZZqqjYCwkIVr
c:\programdata\WSTB
C:\UeellIBrzPNyx1v

:Commands
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it into notepad, save it as something appropriate and attach it into your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.

 

If normal mode is working for you now then just keep continuing on with my steps. See how we go.

 

OK, good. Keep going.

 

And now I need the final log from running C:\MGtools\getlogs.bat ---> C:\MGlogs.zip

 

Download a new copy of Combofix and let it overwrite the old. But do not run it yet!

Your Master Boot Record looks to be infected also. Do you have your Vista boot CD? If not:

If you don't have your Vista disc, you can create a Recovery Environment disc for your system here:

32bit Vista Recovery Environment

64bit Vista Recovery Environment

You can use ImageBurn to create the disc.

Once the disc is created, boot into the bios and change the boot order to CD/DVD as first boot device. Put in the disc and reboot. Once in the RE, type this:

Note the space after the exe.

Exit out when done and boot back into normal mode. Re-run MBRCheck and attach the new log.



We need to run an OTL Fix

• Right-click OTL.exe And select " Run as administrator " to run it. If Windows UAC prompts you, please allow it.
• Copy and Paste the following code into the textbox. Do not include the word Code

Code:

Code:

:files
C:\Users\George\AppData\Roaming\z333ppnG4a
C:\Users\George\AppData\Roaming\DKKK7fEEL9gZqYC
C:\Users\George\AppData\Roaming\RhhTTXqqjUekIrz
C:\Users\George\AppData\Roaming\oyyxxA00uv2
C:\Users\George\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Guard Online
C:\Users\George\AppData\Roaming\sSSiib3nG4am6sJ
C:\Users\George\AppData\Roaming\m99ggZjYCwIVlNx
C:\Users\George\AppData\Roaming\z333ppnG4a
C:\Users\George\Desktop\Guard Online .lnk
C:\ProgramData\1q3w02a0081j0itg2kw0cccblwwvqskv6d
C:\Users\George\AppData\Local\43l045680n245135g2l1jetcg6r0ukq8
C:\ProgramData\43l045680n245135g2l1jetcg6r0ukq8
C:\Users\George\AppData\Roaming\GetValue.vbs
C:\Users\George\AppData\Roaming\SetValue.bat
C:\Program Files\Internet Explorer\202C.tmp
C:\Program Files\Internet Explorer\A84F.tmp
C:\Program Files\Internet Explorer\AF41.tmp
  
:commands
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]

• Then click the Run Fix button at the top.
• Click Image.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. ATTACH that report in your next reply.

Now make sure that combofix is on your desktop and run it now please.

Run OTL again like you did in post # 7. Attach the log from that.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

 

You're most welcome.