Please wait while connection is established-Virus

shahrutvik · Jun 3, 2012

Couple days ago when my dad was using the computer,he got this virus and now as mentioned in other threads,the computer is stuck at boot up.Following instructions from other thread,I have ran the FRST tool and here's the file.Hopefully somebody can help me.Thanks in Advance.

TimW · Jun 3, 2012

Download the Fixlist.txt.

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST.exe on your flash drive.

Now reboot back into the System Recovery Options as you did previously.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (See how to attach)

Now boot into normal Windows can continue with the below.

READ & RUN ME FIRST. Malware Removal Guide

shahrutvik · Jun 3, 2012

TimW,

Thanks for your reply

Unfortunately the fix didn't work.Attached is the fixlog when I ran the tool with the fix option.I also ran the recovery tool again for which also I am attaching the log.

chaslang · Jun 3, 2012

shahrutvik said: ↑

Unfortunately the fix didn't work.
Click to expand...

Yes and that is because you have not been running FSRT properly. You must run from the System Recovery Environment. You cannot boot Windows and then run it. See the below.

Please do the below so that we can boot to System Recovery Options to run a scan. There will be two options to choose from. One if you do not have your Windows 7 boot DVD and another when you have your DVD.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Option1: Enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

Option2: Enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)

shahrutvik · Jun 4, 2012

Oh my bad.I re-ran the FSRT tool and here's the new log.Hopefully this will be more clear in helping you providing the fix.

TimW · Jun 4, 2012

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST.exe on your flash drive.

Now reboot back into the System Recovery Options as you did previously.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (See how to attach)

Now boot into normal Windows can continue with the below.

READ & RUN ME FIRST. Malware Removal Guide

shahrutvik · Jun 4, 2012

Thanks TimW

I was able to boot now.I am now running the Malware bytes to see if there's anything else.

Attaches is the fixlog

TimW · Jun 5, 2012

Let me know.

shahrutvik · Jun 5, 2012

It found about 45 threats.Some of them were in C:\FSRT,which I guess was because that's where it was quarantined but there were other legitimate issues as well.For now I have removed them through MalwareBytes.

Thanks a lot for your help and time and an existence for such a forum.

TimW · Jun 6, 2012

Do you have any remaining issues?

shahrutvik · Jun 7, 2012

The bootup is fine now.However I ran the MBAM three days and each day it discovers infected files.Attached are the logs for each of three days.Can you please tell if I can do something else to ensure that MBAM reports clean results.

TimW · Jun 7, 2012

Please download MGtools to your root drive ( C:MGTools.exe) and run it. Attach the log which is at C:\MGLogs.zip.

shahrutvik · Jun 9, 2012

Hello TimW

Attached is the MGlogs.zip file

TimW · Jun 9, 2012

Now download The Avenger by Swandog46 to your Desktop.

See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

Run avenger.exe by double-clicking on it.

Click OK at the warning to continue to use The Avenger

Do not change any of the check box options!

Shut down your protection software now to avoid possible conflicts.

Copy everything in the Quote box below, and paste it into the Input script here: part of The Avenger

Files to delete:
C:\Users\Shrujal\AppData\Local\Temp\00009c5d.exe
C:\Users\Shrujal\AppData\Local\Temp\0000b450.exe
C:\Users\Shrujal\AppData\Local\Temp\00013957.exe
C:\Users\Shrujal\AppData\Local\Temp\0008a0a2.exe
C:\Users\Shrujal\AppData\Local\Temp\01441589.exe
C:\Users\Shrujal\AppData\Local\Temp\01720303.exe
C:\Users\Shrujal\AppData\Local\Temp\017221e9.exe
C:\Users\Shrujal\AppData\Local\Temp\35EE.tmp
C:\Users\Shrujal\AppData\Local\Temp\3E66.tmp
C:\Users\Shrujal\AppData\Local\Temp\5610.tmp
C:\Users\Shrujal\AppData\Local\Temp\5MnE5EtB.mp3.part
C:\Users\Shrujal\AppData\Local\Temp\61DD.tmp
C:\Users\Shrujal\AppData\Local\Temp\804B.tmp
C:\Users\Shrujal\AppData\Local\Temp\813W3Eot.htm.part
C:\Users\Shrujal\AppData\Local\Temp\87F8.tmp
C:\Users\Shrujal\AppData\Local\Temp\8D02.tmp
C:\Users\Shrujal\AppData\Local\Temp\905C.tmp
C:\Users\Shrujal\AppData\Local\Temp\96F5.tmp
C:\Users\Shrujal\AppData\Local\Temp\9B06.tmp
C:\Users\Shrujal\AppData\Local\Temp\9EFC.tmp
C:\Users\Shrujal\AppData\Local\Temp\A5E0.tmp
C:\Users\Shrujal\AppData\Local\Temp\AB4B.tmp
C:\Users\Shrujal\AppData\Local\Temp\AfJa3Z4b.mp3.part
C:\Users\Shrujal\AppData\Local\Temp\fla3877.tmp
C:\Users\Shrujal\AppData\Local\Temp\fla5EB1.tmp
C:\Users\Shrujal\AppData\Local\Temp\fla8B26.tmp
C:\Users\Shrujal\AppData\Local\Temp\flaC0B2.tmp
C:\Users\Shrujal\AppData\Local\Temp\flaE3F6.tmp
C:\Users\Shrujal\AppData\Local\Temp\flaF9F6.tmp
C:\Users\Shrujal\AppData\Local\Temp\tmp0142427a.bat
C:\Users\Shrujal\AppData\Local\Temp\tmp37caaff5.bat
C:\Users\Shrujal\AppData\Local\Temp\tmp899c21ce.bat
C:\Users\Shrujal\AppData\Local\Temp\tmpa3c4dde7.bat
C:\Users\Shrujal\AppData\Local\Temp\tmpdd163372.bat

Folders to delete:
C:\Users\Shrujal\AppData\Roaming\Caseiq
C:\Users\Shrujal\AppData\Roaming\Elycbe
C:\Users\Shrujal\AppData\Roaming\Evupnu
C:\Users\Shrujal\AppData\Roaming\Ixbono
C:\Users\Shrujal\AppData\Roaming\Kaalw
C:\Users\Shrujal\AppData\Roaming\Mimeap
C:\Users\Shrujal\AppData\Roaming\Ohcy
C:\Users\Shrujal\AppData\Roaming\Yfboe
C:\Users\Shrujal\AppData\Roaming\Zyriuk
C:\Users\Shrujal\AppData\Local\Temp\tmp02bc7783
C:\Users\Shrujal\AppData\Local\Temp\tmp0962ee01
C:\Users\Shrujal\AppData\Local\Temp\tmp2a30e3a2
C:\Users\Shrujal\AppData\Local\Temp\tmp554410d2
C:\Users\Shrujal\AppData\Local\Temp\tmp64f0e96d
C:\Users\Shrujal\AppData\Local\Temp\tmp657861f6
C:\Users\Shrujal\AppData\Local\Temp\tmp9f1628a9
C:\Users\Shrujal\AppData\Local\Temp\tmpb542cea5
C:\Users\Shrujal\AppData\Local\Temp\tmpd8d5fe15
C:\Users\Shrujal\AppData\Local\Temp\tmpda1dad3b
C:\Users\Shrujal\AppData\Local\Temp\tmpe24aedba
C:\Users\Shrujal\AppData\Local\Temp\tmpee5a65ed
C:\Users\Shrujal\AppData\Local\Temp\tmpf35190db
C:\Users\Shrujal\AppData\Local\Temp\tmpfcee0e0e
Click to expand...

Now click the http://img33.imageshack.us/img33/9159/executeavenger.jpg button

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when The Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.

Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

Please wait while connection is established-Virus

shahrutvik Private E-2

Attached Files:

FRST.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Attached Files:

Fixlist.txt

shahrutvik Private E-2

Attached Files:

Fixlog.txt

FRST.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

shahrutvik Private E-2

Attached Files:

FRST.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Attached Files:

Fixlist.txt

shahrutvik Private E-2

Attached Files:

Fixlog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

shahrutvik Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

shahrutvik Private E-2

Attached Files:

mbam-log-2012-06-04 (18-48-59).txt

mbam-log-2012-06-05 (19-11-47).txt

mbam-log-2012-06-06 (18-47-49).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

shahrutvik Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member