Undetectable Malware?

Sprinter · Mar 24, 2010

Hi folks,

would appreciate some advise as it seems that my system is slowly grinding to death and I need some answers quick! (please)

I noticed a few months ago a blue screen when I loaded up Windows and thought nothing of it but shortly afterwards weird things began to happen. Couldnt get access to the Registry for example. Theres also a file in My Computer that sits above the C: drive level called 0ac5b13d80b which will not let me delete it, ever, even in safe mode. Also I cant access Command prompt even in safe mode.

I downloaded and ran CCleaner to see if I could access the registry that way and it helped as I can get into Regedit now but the other problems arent fixed.

Now my pc is starting to sound like its constantly running a marathon - its getting slower and the processes are starting to pile up.

I have run every virus scanner under the sun and they show nothing but that cant be right can it? I recently downloaded NETSCAN Pro and it shows 10 established connections and 68 opened ports?!

i would really appreciate getting this beast off my system as soon as possible. Is it possible that it has created its own disc partition where it is lurking out of the scan line of virus scanners?

I really dont know what Im on about.

Help please

TimW · Mar 24, 2010

Welcome to Major Geeks!

Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****

Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this aother user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

Sprinter · Mar 26, 2010

Hi,

I tried all the steps and not much result.

1) no add/remove files found that matched the descriptions though I do have my suspicions regarding the sheer number of updates for certain files

2) Sun Java updates did not appear in the add/remove programs though I know it is on my system...which was weird

3) My Super Anit Spyware Log is clean::
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/26/2010 at 08:56 PM

Application Version : 4.34.1000

Core Rules Database Version : 4731
Trace Rules Database Version: 2543

Scan type : Complete Scan
Total Scan Time : 00:34:24

Memory items scanned : 430
Memory threats detected : 0
Registry items scanned : 6472
Registry threats detected : 0
File items scanned : 13734
File threats detected : 0

4) Malwarebytes Log is clean::
Malwarebytes' Anti-Malware 1.44
Database version: 3919
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26-3-2010 22:28:38
mbam-log-2010-03-26 (22-28-38).txt

Scan type: Full Scan (C:\|)
Objects scanned: 187401
Time elapsed: 1 hour(s), 9 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

5) ComboFix seems to start and then nothing happens...

6) RootRepeal file scan found nothing

7)MGTools also wont run.

For the record I have tried to run both in normal and safe mode.

I have a couple of things I would like to draw your attention to:

In the Windows root drive there are two suspicious folders

one called:
0ac5b13d80b which contains two subfolders I believe these are printer driver orientated though I have no printer

a second called:
9b842c876b2224dcc44cdd49 which contains a load of internet explorer files;
winfxdocobj.exe, iexplorer.exe, install.ins, iepeers.dll, ieudinit.exe, icrav03.rar are some examples

a third called:
32788R22FWJFW - which has some files one of which called ERUNT.cfxxe, mtee.cfxxe and a load of Bootfixes, regscans and so on - This to me seems rogue.

In my Add/Remove folders there are a large number of Compatability Pack for MSOffice updates, a large number of Microsoft.Net Framework service packs but no other suspicious looking files...

system is still acting up ; when windows starts up GData (my security system) does not automatically operate, internet connection does not appear on the toolbar for some time though I can log straight on the the internet and as I mentioned there are a huge number of open ports and connections. I cannot run Command prompt.

Help?

TimW · Mar 27, 2010

Please read this:
HOW TO: Attach Items To Your Post

What happens when you try to run MGTools? Try doing this:

Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The red is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.

Log in or Sign up

Undetectable Malware?

Sprinter Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Sprinter Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member