Performed "READ & RUN ME FIRST", further help needed

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by rossta86, Dec 6, 2011.

  1. rossta86

    rossta86 Private E-2

    Noticed computer was running slow and fake virus scan programs were coming up.

    Ran SAS and MBAM successfully

    Attempted to Run Combofix. Error box stating "The Recycle Bin on C:\ is corrupted. Do you want to empty the Recycle Bin For this drive?" clicked "No"

    Combofix then froze at:

    "Scanningfor infected files...
    This typically doesn't take more than 10 minutes
    However, scan time for badly infected machines may easily double"

    Stayed at this screen for several hours before exiting window. Closed with no errors or messages.

    Attempted to run RootRepeal. Program listed dozens of files before freezing on the directory C:\Windows\temp\ for several hours. Clicked stop scan. Frooze at this point also for several hours and would not allow me to click save log. Closed window with no errors or messages.

    Ran MGtools semi-successfully. Program froze when new window popped up and got stuck at

    "Refreshing System Information.....
    Windows Error Reporting"

    for several hours. Pressed cancel and program finished and provide logs.

    Obvious signs of malware (fake virus scans etc.) are gone, but when using Firefox i get redirects, popups, and extra tabs from trusted sites such as google. Homepage is set to google.com and doesn't have any other listed in the options menu. Also still see the error message "The Recycle Bin on C:\ is corrupted. Do you want to empty the Recycle Bin For this drive?"

    Thanks for the help
     

    Attached Files:

    rossta86, Dec 6, 2011
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Uninstall the below old versions of software:
    Java(TM) 6 Update 5

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    See the download links under this icon http://www.majorgeeks.com/images/dll.gif
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Dec 7, 2011
    #2
  3. rossta86

    rossta86 Private E-2

    Thank you for the reply and your help!

    Uninstalled Java 6 update 5 succesfully

    Successfully added the registry key

    installed avenger and ran the provided script succesfully

    Reinstalled Java succesfully

    Ran MGTools\Getlogs.bat. It completed but recieved and error with the heading "nslookup.exe - Ordinal Not Found" and message body "The ordinal 1108 could not be located in the dynamic link library WSOCK32.dll."

    Clicked ok and finished MG tools

    I am no longer getting redirects in Firefox.

    I am still receiving the message ""The Recycle Bin on C:\ is corrupted. Do you want to empty the Recycle Bin For this drive?"

    Thank you again for your help!

    Edit - As soon as i posted this i received a pop up (new tab) in Firefox
     

    Attached Files:

    rossta86, Dec 7, 2011
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Goto the below link and follow the instructions for running TDSSKiller from Kaspersky


    Now please also download MBRCheck to your desktop.

    See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )
    Also delete the copy of ComboFix that you currently have and download a new version from here >> combofix.exe

    See if you can run it now. If it runs then attach the c:\combofix.txt log.
     
    chaslang, Dec 7, 2011
    #4
  5. rossta86

    rossta86 Private E-2

    Ran TDSkiller succesfully

    Ran MBR Check Successfully

    Uninstalled combofix and downloaded new version.

    Attempted to run combofix. It again froze at:

    Scanningfor infected files...
    This typically doesn't take more than 10 minutes
    However, scan time for badly infected machines may easily double"It froze at

    Left it for 12+ hours before closing.

    Still getting the error message:

    "The Recycle Bin on C:\ is corrupted. Do you want to empty the Recycle Bin For this drive?" clicked "No"

    Thanks for the help!
     

    Attached Files:

    rossta86, Dec 8, 2011
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay, it attempted to fix a TDSS infection. Let's see if it really worked. Run a new scan and attach a new log.

    This may indicate problems with Windows itself. Have you tried running a disk error check? Also see the below:

    http://support.microsoft.com/kb/297760

    http://social.technet.microsoft.com/Forums/en-US/w7itprogeneral/thread/86bb50e1-321f-4a78-85ce-d31ed58080bf/
     
    chaslang, Dec 8, 2011
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Dec 8, 2011
    #7
  8. rossta86

    rossta86 Private E-2

    Thanks for your help. I am no longer getting redirects. I was also able to fix the recycle bin issue.

    Combofix will still not progress through its scan, but i have not left it to run for more than 12 hours. Maybe this is a moot point now.

    Thanks again.
     

    Attached Files:

    rossta86, Dec 9, 2011
    #8
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Chaslang has been very busy, so let's just have you do this and check for any remnants. You can also let me know how things are running.

    Let's also use the new version of MGtools to get a newer log.
    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


    Now attach the below log:
    • C:\MGlogs.zip
     
    Last edited by a moderator: Dec 15, 2011
    Kestrel13!, Dec 14, 2011
    #9
  10. rossta86

    rossta86 Private E-2

    Things have been running fine, except for a windows update error 80096001 that prevents me from installing vista updates.

    Thanks for the help.
     

    Attached Files:

    rossta86, Dec 20, 2011
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    See if Microsoft's FixIt tool helps. Make sure to run Microsoft FIX IT in the aggressive mode to reset the Windows update components.

    http://support.microsoft.com/kb/971058


    Also note, if you can install some updates, but not others, the below link ( which again does reference FixIt ) may be helpful:

    http://support.microsoft.com/kb/822798
     
    Last edited: Dec 21, 2011
    chaslang, Dec 21, 2011
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds