Still can't get rid of virus

confusedashell · Jan 1, 2010

I've trawled through the list of instructions, scans etc but i'm still having trouble. I've attached my logs to the post. In advance, I hope you can help.

Here is a brief outline.

My laptop became infected with what i think was a win.32 trojan around 36 hours ago. The virus popped up a message on my taskbar saying i needed to buy new anti virus software (obviously bogus) then proceeded to flash this warning up once every ten seconds.

It also blocked my access to the internet, prevented me from accessing all my anti virus software and blocked system restore. It also causes intermittent problems with the log in to my computer and is causing several freezes.

I ran a scan using malwarebytes and combofix prior to being aware of these forums. Malware did and found nothing while combo appeared to do nothing but did stop the flash warning i.e the warning that i needed to buy some kind of software. I also changed the file names of my anti virus scans to allow me to run them

I then found major geeks and ran all the checks with a few things to note.

My computer won't let me complete the super anti spyware scan so there is no log attached. It just keeps freezing. It gets a certain amount of the way in and stops- the amount varies each time but it has never found any infected files by the time it does stop.

I've attached the malware and combofix logs. Both seemed to find nothing.

I attach the root repeal log. This does seem to have something to report but i can't make any sense of it and therefore have no idea of what if any action to take.

I couldn't get MG Tools to work despite following the instructions on the forums.

I also ran the "FixIEDef" scan which had been suggested on these forums for this type of virus. This seemed to yield no results but i've attached the log anyway.

Thanks for looking over this and I hope someone can get back to me.

chaslang · Jan 3, 2010

Welcome to Major Geeks!

Please double-click the RootRepeal.exe previously downloaded.

Select File then Scan

On the Select Drives form select drive C by "ticking" the box for drive C and click OK

When the scan is complete - highlight each of the following file(s) (one at a time if more then one is listed) by left clicking it. Then use right mouse click and select the Wipe File option only for each file.

C:\WINDOWS\system32\H8SRTeulvvuuyod.dat

C:\WINDOWS\system32\H8SRTntpvaivkbo.dll

C:\WINDOWS\system32\H8SRTodqoyxwgjw.dll

C:\WINDOWS\system32\H8SRTowpvbkytcg.dll

C:\WINDOWS\system32\drivers\H8SRTecwynamvjp.sys

C:\Documents and Settings\richard.taylor\Local Settings\Temp\H8SRT91b9.tmp

After Wiping all files, immediately reboot your pc!

Now download The Avenger by Swandog46, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.

Do not change any check box options!!

Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Drivers to delete:
H8SRTd.sys

Files to delete:
c:\windows\system32\drivers\H8SRTecwynamvjp.sys
C:\Documents and Settings\richard.taylor\Local Settings\Temp\RGIA.tmp
C:\Documents and Settings\richard.taylor\Local Settings\Temp\H8SRT91b9.tmp
c:\windows\system32\H8SRTeulvvuuyod.dat
c:\windows\system32\H8SRTntpvaivkbo.dll
c:\windows\system32\H8SRTodqoyxwgjw.dll
c:\windows\system32\H8SRTowpvbkytcg.dll
Registry keys to delete:
HKEY_LOCAL_MACHINE\System\ControlSet004\Services\H8SRTd.sys
Click to expand...

Now click the Execute button.

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot from running Avenger, download/install/update Malwarebyes, you are way out of date and did not update. Run a new scan and attach the log.

Also you are a few months out of date with ComboFix. You must not keep old versions of ComboFix since they expire like your did. Download the version gioev to you in the READ & RUN ME and run it as requested. Do not rename it!!! Also attach the log from ComboFix.

Now make sure you have the current version of SUPERAntiSpyware installed and updated. Run a scan and attach the log.

Also run MGtools now.

You should be attaching the below logs now:

the c:\avenger.txt log

new Malwarebytes log

new ComboFix log

SUPERAntiSpyware log

C:\MGlogs.zip file from running MGtools

Log in or Sign up

Still can't get rid of virus

confusedashell Private E-2

Attached Files:

rrootlog.txt

mbam-log-2010-01-01 (14-24-34).txt

combo fix log.txt

FixIEDef.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member