1. Chippy569

    Chippy569 Private E-2

    I've been following this thread as my symptoms are identical: http://forums.majorgeeks.com/showthread.php?t=260732

    I tried TDSSKiller and ESETSirerefRemover but neither were able to complete as my computer would shut down with the 1 minute thing.

    I was able to boot into recovery mode and run FRST.exe as prompted in the thread above, ran "search" for services.exe (is in the thread above, the user was able to solve the shutting down issue after this) and have attached the results.

    Please help!
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Then you should have realized we also need the FRST log to continue.


    Please do the below so that we can boot to System Recovery Options to run a scan.

    For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)
     
  3. Chippy569

    Chippy569 Private E-2

    my bad, attached below. For future reference, this is a 32b system, and the USB drive defaults to F:.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I see both AVG and Microsoft Security Essentials installed. You need to uninstall both of these now. You should never install more than one antivirus protection program. Do this now while I work up a fix. After the fix, you will be able to reinstall one and only one AV program.
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Download this >> View attachment fixlist.txt


    Save fixlist.txt to your flash drive.
    • You should now have both fixlist.txt and FRST.exe on your flash drive.
    Now reboot back into the System Recovery Options as you did previously.
    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (See how to attach)

    Now boot into normal Windows can continue with the below.

    Attach the Fixlog.txt file.



    Now I suggest that you run MGtools as requested in the below link so that we can check for possible damage cause by this infection
    Attach the C:\MGlos.zip file.
     
  6. Chippy569

    Chippy569 Private E-2

    Ran the fix, which went very quickly. Went to restart and windows gave me "failed to restart, launch repair (recommended) or start normally" -- selected normally and the boot process hung before the progress bar would appear. I powered down, rebooted, got the same condition so decided to run repair, and it has been "attempting repairs" for about 10 minutes now. Will report back when it completes.

    edit: "windows cannot repair automatically" -- should I get out a win7 32b disc and run boot repair?
     

    Attached Files:

    Last edited: Jul 15, 2012
  7. Chippy569

    Chippy569 Private E-2

    waited too long (10 min edit limit), more info on failure. from the repair log:

    "Root cause found:
    Unspecified changes to system configuration might have caused the problem.
    Repair action: System files integrity check and repair
    Result: failed. error code = 0x490
    Time taken = 57817ms"


    [edit again]upon restarting again, it now seems to boot correctly. What a PITA. Currently running mgtools. Good news! no restart in one minute messages.
     
    Last edited: Jul 15, 2012
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes this may be due to the fact that the malware corrupted a system file and we replaced it with a backup. This is the first time I have seen this happen though with this infection.

    After I see the new MGlogs.zip we will continue..... but that will be tomorrow as I must get some sleep now. :zzz
     
  9. Chippy569

    Chippy569 Private E-2

    MGtools ran successfully I think, log below -- I did encounter an error when it tried to install/run HJT I think (i double-clicked Accept and then it asked to send an error report).
     

    Attached Files:

  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Back in message number 4, I asked you to uninstall AVG and Microsoft Security Essentials. But I still see the below in your your logs. You must uninstasll these. It messes up your PC when you install more than one AV and they all need to be removed in order to properly start over.
    AVG 2011
    Microsoft Security Client
    Microsoft Security Essentials

    You also need to uninstall the below.
    Java(TM) 6 Update 24 << very out dated and a security risk
    SmileBox EN Toolbar << a contributor to adware and other junk you don't want or need.

    You have corruption to Windows due to the malware and it has broken your Windows Firewall at a minimum and likley many other things.

    Be patient while doing the below. The fixes can take quite awhile to run. Especially the permissions repairs. It may be best to kick it off and goto bed or do something else. It is better not to run anything while the repairs are going on.


    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.
    Now make sure that you have all network cables plugged in so that we can properly assess your network connectivity.

    Now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    Last edited: Jul 15, 2012
  11. Chippy569

    Chippy569 Private E-2

    will move the computer back to its normal home next to test internet connectivity.

    did you need a log from windows repair, and if so where would I find it?

    mgtools log below
     

    Attached Files:

  12. Chippy569

    Chippy569 Private E-2

    [edit] internet connection appears to be working, IE functioning properly. Is there any specific test you want me to perform for this?

    i have just reinstalled MSE as it should also reset windows firewall, appears to be functioning.
     
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     
  14. Chippy569

    Chippy569 Private E-2

    Ran a full scan with MSE and with MWB and both came back clean -- go through steps 1 thru 7, I think we're done! Thank you!
     
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds