virus.dos.gueara.1918

Complete what you can of the below in safe mode.

Welcome to Major Geeks!

Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide


and attach the requested logs when you finish these instructions.

• **** If something does not run, write down the info to explain to us later but keep on going. ****
• Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

• After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
​

 

Kes still needs the C:\MGLog.zip.

You did not attach the ComboFix log. It would be here> C:\Combofix.txt. I don't know what you attached.

Did you save the MBAM log before you had it fix what it found?

 

J2SE Runtime Environment 5.0 Update 4 <--- Uninstall this.

The MBAM log shows you took no action. Did you indeed fix what it found afterwards or not??

Go to TDSSKiller and Download TDSSKiller.zip to your Desktop

• Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
• Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrartor.
• Allow the application to run and a window will open showing that it is TDSSkiller from Kaspersky
• Click Start scan
• It will run rather quickly and will notify you of whether anything is found or not.
• Follow the instructions to delete/quarantine if asks you what to do when if finds something.

Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )


Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some data on it
• Right click on the screen and select > Select All
• Press Control+C
• Open a notepad and press Control+V
• now please ATTACH that report to this thread

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

Code:

KILLALL::

Folder::
C:\32788R22FWJFW.0.tmp
c:\documents and settings\All Users\Application Data\Viewpoint
c:\documents and settings\owner\Application Data\Ofedf
c:\documents and settings\LocalService\Local Settings\Application Data\ICS
c:\documents and settings\owner\Local Settings\Application Data\ICS

File::
C:\Documents and Settings\owner\exe.js

FileLook::
c:\documents and settings\owner\Application Data\lakerda1967.sys

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
  
  
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

Be sure to let me know how things are running now, answer any questions I may have asked and attach all of those requested logs.

 

I don't quite know what you mean here. When you "hold" down your mouse? Elaborate on that, please.


You neglected to address my question:

Yes, re-reun MBRCheck and take a screenshot of all of the results. Attach that. Then again there are logs showing here on your desktop:

• "MBRCheck_09.23.10_19.54.09.txt"
• "MBRCheck_09.23.10_19.55.28.txt"
• "MBRCheck_09.23.10_19.58.48.txt"

Could you please get this: lakerda1967.sys into a zipped file and attach it for me in your next post? To do this, see the below:

Please go to start > Run and paste in the following:

log retrievable @ C:\collect.zip


c:\documents and settings\owner\Application Data\lakerda1967.sys <--- Go to http://www.virustotal.com/ and upload the following file for analysis. Let me know the results.

 

So this is happening in Google Chrome? What about IE? Same happening with that?

I will have you do this and check new logs:

Run this:

Running Kaspersky Online Scanner

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

 

You could instead run:

eSet Online Scan.

If it finds anything, run it again. Keep running it until it comes back clean. Attach the logs.

 

Hmm I don't know what to suggest. I see you are using IE7, can you upgrade to Version 8 and tell me if that makes a difference

Also seeing fresh logs wouldn't hurt, so:

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

 

Kaspersky online scanner does not fix anything. It is just a scanner. The items found are not problems anyway since they were already quarantined by ComboFix. And the detection of MGtools.exe is a false detection.

 

Uninstall Spy Sweeper and then reboot.

After reboot, delete the below file:
C:\WINDOWS\system32\Drivers\SSHRMD.SYS

Then rerun TDSSKiller and attach a new log.

Do you have any Disk Emulation software like Daemon Tools or similar installed??? I see filedisk.sys for FileDisk Virtual Disk Driver ( see: http://www.msfn.org/board/topic/38118-filedisk-virtual-disk-driver-for-windows-nt2kx/) This may be the cause of why your logs think there is a master boot record infection.

Also, please run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).





Then attach the below logs:

• C:\MGlogs.zip

 

What about the fiedisk.sys file and disk drive emulation????

Okay then this may be the problem since you say Spy Sweeper is not installed and it does show in your logs as running. I suggest that you double check one more time and also look under Webroot Spy Sweeper as the proper thing to do is uninstall it before we forcefully delete it.

In fact if you still cannot find it, try using the below to find and uninstall it:


Revo Uninstaller

 

I think I see why you cannot see it installed and I can. Your registry for Add/Remove Programs probably shows it as the below which you must have downloaded and installed:

MSXML 4.0 SP2 and SOAP Toolkit 3.0

Uninstall the above.

Also I see: Spy Sweeper Core which should be uninstalled.

 

The below is one item not two.

MSXML 4.0 SP2 and SOAP Toolkit 3.0

Look in your C:\MGtools folder and load the newfiles.txt log into notepad. And toward the end you will see the above listed under the heading titled Dumping HKLM Uninstall Programs list

You will also see Spy Sweeper Core listed

If you also look at the GetUnKey.txt log in C:\MGtools you will see all the details about these two installed programs.

Try using Revo Uninstall to uninstall both of the below.
MSXML 4.0 SP2 and SOAP Toolkit 3.0
Spy Sweeper Core

Note these are the only names I want you to try uninstalling. DO NOT uninstall any of the below:
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)


Also use Revo to uninstall the below if still installed:
J2SE Runtime Environment 5.0 Update 4

And as far as the filedisk.sys file ( I had a type in my last message) I want you to answer my question about it from back in message # 19.

 

I see Spyware Doctor with AntiVirus8.0 showed up in your logs on 9/23/2010. Did you just install this while we were working on your PC? If so, please uninstall this immediately and only do what we ask you to do.

Looks like the filedisk.sys file may be related to Protector Suite QL ( a finger print readed ) which you may have on your laptop.

Please uninstall SUPERAntiSpyware. Some how you managed to get part of it installed to your Desktop and it should not be there. It looks fishy and I will be removing any leftovers from SUPERAntiSpyware along with manual removal of Spy Sweeper below.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O20 - Winlogon Notify: TSigNP - TSigNP.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Documents and Settings\Administrator\Desktop\SASWINLO.DLL
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe

After clicking Fix, exit HJT.

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now rerun TDSSkiller like you did previously.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• the new TDSSkiller log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Okay that looks better and it removed the signs of a possible MBR infection too.

Please be specific. I don't know what error you are referring to. Give the exact word for word error and exactly when does it occur.


There are a few more things from SUPERAntiSpyware and Spyware Doctor to cleanup so let's do this now.


Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

This is for your Sigmatel sound card. Is your sound working okay. Try the below to see if it removes the error.


Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Most of what is on your Desktop are things you put there, like all the .doc files. My final instructions below will cleanup what we have done and also they explain what you need to keep and do to protect your PC properly.

Yes that was in step 3 of the READ & RUN ME.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Okay but you did not answer my questions. Is your sound working okay and did this patch remove the error at startup?

Yes base on your logs, it appears your installer service is missing. Try the fix in the below link:

http://support.microsoft.com/kb/315353

 

You did not respond at to what I posted in msg # 32.

The new error messages you posted would seem to point towards problems with Windows itself which you should address in the Software Forum.

If you can not send emails after installing a firewall then you likely did not allow something to pass thru the firewall that you should have.

 

Okay then if you are still issues like the ones last mentioned, I suggest that you post in the Software Forum for continued support with non-malware issues.