Windows Won't boot after Windows Defender removed Alureon

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Jmodel06, Jan 14, 2014.

  1. Jmodel06

    Jmodel06 Private E-2

    Hello, and thanks for the help.

    Running windows 7 64-bit

    Windows Malware thing recently Found an Alureon trojan and suggested I use windows defender to remove it (windows firewall hasn't worked for a while I figure this is probably why). I downloaded windows defender offline onto a DVD and booted up the computer and the defender ran as expected and removed (i think) the virus. However, upon startup after the ASUS mobo screen it says starting windows then crashes to a blue screen and says it had to shutdown to prevent hardware damage. When I press F8 on rebooting I have no safe mode or safe mode with networking option, I can only start windows normally and do a startup repair. I ran startup repair and it could not find the problem, and it suggested I do a system restore. I did a system restore to about 3 hours before when I used windows defender and I still had the same problem. I tried another system restore to 6 days before that, and the second system restore failed, saying it couldn't restore some file (probably shoulda have recorded what it was).

    I've googled and searched this forum and I see others have had the same/similar problem and have had good results. Any help would be much appreciated. I'm quite computer competent but not as much so with things like this. Any help would be GREATLY appreciated.

    Thanks for your time,
    -Jeff
     
    Jmodel06, Jan 14, 2014
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    http://img827.imageshack.us/img827/1263/frst.gif For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options.

    To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Choose your language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.

    To enter System Recovery Options by using Windows installation disc:

    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Choose your language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.
    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    • Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)
     
    Kestrel13!, Jan 15, 2014
    #2
  3. Jmodel06

    Jmodel06 Private E-2

    Hello Kestrel13! and thank you so much for your response.

    I ran the FRST64 scan and am attaching the txt file

    Quick note: when I pressed F8 after bios I actually had the safe mode/safe mode networking options that I never had before. Don't know if I did something different this time or not, or if this matters. Attached is the file!

    Thanks again!
     

    Attached Files:

    Jmodel06, Jan 15, 2014
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi,

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Attached is fixlist.txt
    • Save fixlist.txt to your flash drive.
    • You should now have both fixlist.txt and FRST64.exe on your flash drive.

    Now re-enter System Recovery Options.
    Run FRST64 and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (How to attach)

    ==========================

    Now continue on with these instructions please. :)

    READ & RUN ME FIRST - Malware Removal Guide
     

    Attached Files:

    Kestrel13!, Jan 16, 2014
    #4
  5. Jmodel06

    Jmodel06 Private E-2

    I followed the instructions and windows is now booting properly, thank you so much!

    I am attaching the fixlist.

    I also completed the entire malware removal section and will attach the logs from the programs, a couple of the scans found some things, I don't know if they are bad or not.

    For the MGtools one, I was supposed to click accept for some trend micro thing but I did not accept by accident, hope that doesn't matter.

    Let me know if you think we should address any findings from these programs. The CCleaner thing deleted like 40 gig worth of crap so I figure my machine might have some other bad things on it as well. I will upload the MGlogs in the next post as I can only upload 5 things at a time.

    -Jeff
     

    Attached Files:

    Jmodel06, Jan 16, 2014
    #5
  6. Jmodel06

    Jmodel06 Private E-2

    Uploading MGlogs here.

    -J
     

    Attached Files:

    Jmodel06, Jan 16, 2014
    #6
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi :)

    Premiumplay Codec-C <<< Uninstall this junk, I believe it's what brought in the Zero Access infection.


    Re run Hitman Pro and have it delete Potential Unwanted Programs.


    http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.



    http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate this detection:

    • [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-2700143586-360211862-3685699043-1001\$7ec59d2defa715ab8ed24602e53139cd\n. [x]) -> FOUND

    Place a checkmark next to each of these items, leave the others unchecked.
    Now press the Delete button.

    ...and the same for these entries on the file/folder tab please...

    • [ZeroAccess][Junction] en-US : C:\Program Files\Windows Defender\en-US >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MpAsDesc.dll : C:\Program Files\Windows Defender\MpAsDesc.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MpClient.dll : C:\Program Files\Windows Defender\MpClient.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MpCmdRun.exe : C:\Program Files\Windows Defender\MpCmdRun.exe >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MpCommu.dll : C:\Program Files\Windows Defender\MpCommu.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MpEvMsg.dll : C:\Program Files\Windows Defender\MpEvMsg.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MpOAV.dll : C:\Program Files\Windows Defender\MpOAV.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MpRTP.dll : C:\Program Files\Windows Defender\MpRTP.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MpSvc.dll : C:\Program Files\Windows Defender\MpSvc.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MSASCui.exe : C:\Program Files\Windows Defender\MSASCui.exe >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MsMpCom.dll : C:\Program Files\Windows Defender\MsMpCom.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MsMpLics.dll : C:\Program Files\Windows Defender\MsMpLics.dll >> \systemroot\system32\config [-] --> FOUND
    • [ZeroAccess][Junction] MsMpRes.dll : C:\Program Files\Windows Defender\MsMpRes.dll >> \systemroot\system32\config [-] --> FOUND

    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Reboot the machine.




    C:\Program Files (x86)\Premiumplay Codec-C <<< Delete this if it remains.


    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.




    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.

    After reboot, check to see if your firewall is working.



    • Re run RogueKiller again, just a scan, and attach log.
    • Same for Hitman Pro.
    • Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
    • Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
    Kestrel13!, Jan 17, 2014
    #7
  8. Jmodel06

    Jmodel06 Private E-2

    Thanks again for the response.

    So the first thing I did was uninstall the codec-c thing. Before I continue any further on the last steps you wrote I just want to clarify the HitmanPro instructions, you said to delete any potential unwanted programs. So I ran hitman pro again, it comes back with 1 identified threat and 112 traces. Most of the things have default repair/ignore, with the one trojan codec-C(1).exe defaulted at quarantine. Are you saying before I move on I should apply to all -> delete? So Delete the 112 traces and 1 threat?

    -J
     
    Jmodel06, Jan 17, 2014
    #8
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    This is what I want you to be rid of:

     
    Kestrel13!, Jan 17, 2014
    #9
  10. Jmodel06

    Jmodel06 Private E-2

    Hello,

    I did all the steps and I believe everything worked out, the items were added to the registry successfully and windows firewall is/was now working. Sadly, and kind of hilariously, I spilled water on my desk and it dripped off into the top my desktop. It wasn't much and I thought I cleaned it off but like 10 minutes later the thing just shut down and now won't boot. I took a hairdryer to it, but I guess the mobo (or power switch) shorted out. I'm going to take it to local repair store monday and hopefully it'll be back up and running in a few days. It wasn't much water and I'm shocked it did anything, but til then I can't actually get the logs, haha.
     
    Jmodel06, Jan 18, 2014
    #10
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Oh nu! I am so sorry to hear this. Please do let me know how everything turns out. If it boots up, return to me and we will wrap things up. :)
     
    Kestrel13!, Jan 19, 2014
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds