W32/Ramnit.a

Welcome to Major Geeks!

You are way out of date with your version of SUPERAntiSpyware.

• Please uninstall your current version (this is necessary).
• Then download this SUPERAntiSpyware
• Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.
• After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.
• Now run a new full scan of your system. And attach this new log.

Now boot your PC in NORMAL BOOT MODE, and complete the below.

Run a new full scan with ESET Online Scanner.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• the new SUPERAntiSpyware log
• the new ESET log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

What is in the below folder?
C:\Users\Ben\AppData\Local\{F4111F7C-3664-4955-81DF-07EF3BA4661F}

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - .DEFAULT User Startup: cenace.exe (User 'Default user')
O4 - .DEFAULT User Startup: says.exe (User 'Default user')
O4 - Startup: iweg.exe

After clicking Fix, exit HJT.

Now download OTL by Old Timer and save it to your Desktop.

• Double-click OTL.exe to start the program.
• Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code
  
  Code:

  :processes
  :otl
  :files
  C:\Users\Ben\AppData\Local\Xrewuzeqijiwawan.bin
  C:\Users\Ben\Local Settings\TEMP\3361.tmp
  C:\Users\Ben\Local Settings\TEMP\A5D0.tmp
  C:\Users\Ben\Local Settings\TEMP\bnywg5hk.0.cs
  C:\Users\Ben\Local Settings\TEMP\bnywg5hk.cmdline
  C:\Users\Ben\Local Settings\TEMP\bnywg5hk.dll
  C:\Users\Ben\Local Settings\TEMP\bnywg5hk.err
  C:\Users\Ben\Local Settings\TEMP\bnywg5hk.out
  C:\Users\Ben\Local Settings\TEMP\bnywg5hk.tmp
  C:\Users\Ben\Local Settings\TEMP\C7EF.tmp
  C:\Users\Ben\Local Settings\TEMP\Cab5BB6.tmp
  C:\Users\Ben\Local Settings\TEMP\CSC186.tmp
  C:\Users\Ben\Local Settings\TEMP\NODE7B.tmp
  C:\Users\Ben\Local Settings\TEMP\pxifraov.0.cs
  C:\Users\Ben\Local Settings\TEMP\pxifraov.cmdline
  C:\Users\Ben\Local Settings\TEMP\pxifraov.dll
  C:\Users\Ben\Local Settings\TEMP\pxifraov.err
  C:\Users\Ben\Local Settings\TEMP\pxifraov.out
  C:\Users\Ben\Local Settings\TEMP\pxifraov.tmp
  C:\Users\Ben\Local Settings\TEMP\RES187.tmp
  C:\Users\Ben\Local Settings\TEMP\si966B.tmp
  C:\Users\Ben\Local Settings\TEMP\SUPERSetup
  C:\Users\Ben\Local Settings\TEMP\TFR6099.tmp
  C:\Users\Ben\Local Settings\TEMP\TFR67BB.tmp
  C:\Users\Ben\Local Settings\TEMP\TFRB57C.tmp
  C:\Users\Ben\Local Settings\TEMP\TFRFAF5.tmp
  C:\Users\Ben\Local Settings\TEMP\_rfgjc09.0.cs
  C:\Users\Ben\Local Settings\TEMP\_rfgjc09.cmdline
  C:\Users\Ben\Local Settings\TEMP\_rfgjc09.dll
  C:\Users\Ben\Local Settings\TEMP\_rfgjc09.err
  C:\Users\Ben\Local Settings\TEMP\_rfgjc09.out
  C:\Users\Ben\Local Settings\TEMP\_rfgjc09.tmp
  C:\Users\Ben\Local Settings\TEMP\{8C49856A-4BF1-4146-A63D-1E9D2B38D09B}
  C:\Users\Ben\Local Settings\TEMP\{FD813F7C-4695-4A5C-B296-02FD730CEC84}
  C:\Users\Ben\Local Settings\TEMP\~DF0F381F6861A43C20.TMP
  C:\Users\Ben\Local Settings\TEMP\~DF1358B7AD9D564269.TMP
  C:\Users\Ben\Local Settings\TEMP\~DF5178D411CBB2A41C.TMP
  C:\Users\Ben\Local Settings\TEMP\~DFC1C67A5ED3D710F8.TMP
  C:\Users\Ben\Local Settings\TEMP\~DFE1F7BF9738C4A944.TMP
  :commands
  [PURITY]
  [EMPTYTEMP]
  [RESETHOSTS]
  [CREATERESTOREPOINT]
  [CLEARALLRESTOREPOINTS
  [REBOOT]
  

• Then click the Run Fix button at the top.
• Click the OK button.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

 

Okay let's just do 2 more follow up scans to be safe. Seems you caught the Ramnit infection early enough before it spread too much or caused too much damage. Many times Ramnit infections will require a reinstall to properly fix.

Please run a full scan with ESET Online again and attach the new log.

Also, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Which browser? And what is the exact word for word message on the BSOD?

 

Unless you are a developer or beta tester for Microsoft, you should not run Beta programs. They are not stable. The error message you are getting may not have anything to do with malware. Or it could be that due to the Ramnit infection, many important files were deleted because they were infected, Ramnit frequently requires a reinstall.

I suggest that you uninstall it. You could also try to use Firefox for the scan.

 

GetLogs.bat must be run from normal boot mode to allow us to properly diagnose your PC. Otherwise we will only see what happens in safe mode and not in normal mode.

 

Note that based on your ESET log, other user accounts on this PC were/still are infected. Notice things being removed from different accounts ( the restricted user accounts ) than what you posted your logs from!

 

When you say Explorer, I assume you mean Windows Explorer?? Try not opening Windows Explorer nor your browser. Just try pasting C:\MGtools\GetLogs.bat into the run box or into a command prompt Window. Does that work?

When you get the error message, you need to give me the exact ( not approximate ) and complete word for word error message on the BSOD. Do not paraphrase.

There are two other user accounts.

Code:

d-----w          0 2010-11-06 09:37:04  C:\Users\Kezia
d-----w          0 2010-10-29 22:09:06  C:\Users\Mcx1-BEN-PC

You should run scans with ESET, SUPERAntiSpyware and Malwarebytes on them too.

 

It is very possible that the Ramnit infection you had has cause too many problems to your Windows Operating System to recovery from. Typically people have to reinstall to resolve problems due to Ramnit. And this may be what you will have to do too; however, try running the below which has to be run in normal boot mode.

Click Start, Run, and enter sfc /scannow and click OK. There is a space after the sfc. This runs System File Checker which looks for missing or corrupted system files and attempts to replace/repair them from files on your hard disk or from the CD if necessary. So it will ask for the Windows CD if it needs it.


If you cannot run the above, see if you can run System Restore to go back to a restore point from before your problems began.