Registry Problem, Help please (asap if you can I have a ton of college work to do)

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by vizarati, Jul 23, 2011.

  1. vizarati

    vizarati Private E-2

    I accepted a file from one of my college classmates and it was a zip file. I didn't realize when I opened it that the document was a .exe and I double clicked it (it looked like an image). I found out from him that he has been having alot of computer problems lately and that this was an email he didn't send but some of the msn hacked emails. Well I noticed that after I clicked on the image it dissipated so I re unzipped it and noticed in winrar it said it was a .exe file. Stupid me. Anyways long story short I have followed all of the steps that are in the threads (been here a few times) but none of the programs works except for Mtools.

    Malware Bytes loads and runs for 3 seconds then it shuts down and I get a error saying I cant access that path. If I uninstall and reinstall I can run again and it does that again.

    Super-Spyware runs for about 40 seconds in quick scan, it finds two trojans in memory and then starts scanning registry then it crashes. I cant use the default despot icon to open it anymore or I get the same message as above. If I use the alternate start up link it start menu it does the same thing. If I run full scan it goes about 8 mins and crashes after it scans 5,800(ish) registry items. If I use custom scan I can use every option but registry and get a full scan, if I click the registry box it crashes after about 8 mins also.

    So I believe the file I open did something in the registry. I have my computer booted in safe mode. I can run it in in normal mode it seems fine, maybe runs a little sluggish.

    I use CA internet security suite provided my Mediacom Cable Company..

    If you need the MTools log please let me know, that was the only file I could get and I can also give you the MBam log that has the two trojans if you need it, thats all that is on the MBam logs.



    I in no way am begging but if there is anyway you can help me out ASAP I would be very grateful. I have alot of work that is due by July 25 @ 11pm est.


    THANKS!!


    Editing to let you know that I have tried registry booster and it doesn't load. I tried CCleaner registry cleaner and it crashed at 86% and I get the same message cant access path or don't have permission to access file.
     
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    Please ATTACH the C:\MGLogs.zip.
     
  3. vizarati

    vizarati Private E-2

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    Ok its attached.

    Heres the results for the SuperANITspyware minus the registry run

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 07/23/2011 at 01:44 PM

    Application Version : 4.55.1000

    Core Rules Database Version : 7450
    Trace Rules Database Version: 5262

    Scan type : Custom Scan
    Total Scan Time : 01:01:08

    Memory items scanned : 262
    Memory threats detected : 1
    Registry items scanned : 70
    Registry threats detected : 0
    File items scanned : 34535
    File threats detected : 3

    Trojan.Dropper/SVCHost-Fake
    \.\GLOBALROOT\DEVICE\SVCHOST.EXE\SVCHOST.EXE
    \.\GLOBALROOT\DEVICE\SVCHOST.EXE\SVCHOST.EXE

    Trojan.Agent/Gen-Kazy[Ico]
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{39C571A2-5C6A-433B-8AC6-DBD815F09639}\RP852\A0218316.SCR
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{39C571A2-5C6A-433B-8AC6-DBD815F09639}\RP852\A0218304.SCR



    ---------------------------

    Also I found this on gogle
    (http://forums.malwarebytes.org/index.php?showtopic=67147).

    I didn't do anything that the owner of that thread did but it sounds almost exactly like what I am going through minus the internet redirect. I use CA security suite and if I try to load any internet program it redirects me to a website saying that the KIDS function of the program has stopped working to reinstall the program.

    The computer is still in safe mode and I can transfer any program you need me to run via flash drive from my desktop.

    Thanks for the help Tim
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    You have what is called a "Global Root" infection. We could try to clean it, but you would never be able to fully trust your system again. Your best means of approach is to save all your data and personal files to a cd and do a clean install. :(
     
  5. vizarati

    vizarati Private E-2

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    I have a split hard drive made by partion magic, if I backup all of my files to it would I loose them doing a reinstall?

    Also can we attempt the cleaning procedure? I only need it to work for another 3-4 weeks. Im buying a new computer at the start of my next college semester (new grants and all).

    Is there anyway to backup programs? I am only worried about my JASC panintshop pro and Microsoft office 2005 and 2007. I lost both of the installation CD's in a fire, I do have the serials backedup on my flash drive.
     
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    No, you would not lose the files if you only reformat the C drive.
    Probably not enough to be able to fix the redirects. Plus your system would be vulnerable to additional malware.
    That would be best discussed in the software forum.
     
  7. vizarati

    vizarati Private E-2

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    OK. I have a gateway computer and I believe that it reinstallable as it is. I don't think it came with a CD but I will look just to make sure. How would I reinstall this computer if it already has it all on it?


    Hey Tim, Do you think that it would be ok to do my assignments on it that are due monday and then reformat? Its the only computer in the house that has the programs I need. Microsoft Word and PowerPoint. Would this make it harder to get rid of the infection when I do reformat?
     
    Last edited: Jul 23, 2011
  8. vizarati

    vizarati Private E-2

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    TIM... would this help? I back up my registry every three months I have it set on my phone to do it. The last time I backed it up was on May 17 2011. Could I use that to repair? I haven't added any new programs since last year.
     
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    It wouldn't be a problem to finish up your college work and then reformat. I believe you probably have a recovery partition, which would put the computer back to factory settings. You can check with the good people in the software forum for any issues with doing that.

    The other thing you might try is to call Microsoft, explain your situation with those programs, that you have the install keys but lost the disc in a fire. They might supply you with new cd's.
     
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    You could try doing that, but then you need to re-run C:\MGtools\GetLogs.bat file by double clicking on it and getting me the new logs so I can check for the infection.
     
  11. vizarati

    vizarati Private E-2

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    OK i'll do that now. What would be the best way to Import the backup registry? Should I delete anything first or just import it as is.

    Also when running SuperAnti Spyware it crashes after scanning 5920 registry items and the last item it scans before crashing is this:
    HKEY_LOCAL_MACHINE\Systems\ControlsSet001\Services\apsnet_state

    if that helps any...
     
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Re: Registry Problem, Help please (asap if you can I have a ton of college work to do

    Just import it as is. ;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds