Advertisement
Advertisement
 Search | |
| |
29-Apr-2010, 04:04 AM
#2 | ||||||
| Hello there  Welcome to the TSG Forums. My name is NeonFx. I'll be glad to help you with your computer problems. Logs can take some time to research, so please be patient with me. Please note the following:
Step 1 Download OTS to your Desktop
Code: %SYSTEMDRIVE%\*.exe /md5start eventlog.dll scecli.dll netlogon.dll cngaudit.dll sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys nvrd32.sys symmpi.sys adp3132.sys mv61xx.sys /md5stop %systemroot%\*. /mp /s CREATERESTOREPOINT %systemroot%\system32\*.dll /lockedfiles %systemroot%\Tasks\*.job /lockedfiles %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav
Step 2  GMER Rootkit Scanner Please download GMER from one of the following locations and save it to your desktop:
If you have trouble running GMER, please try running it in Safe Mode. To get to Safe Mode you'll need to repeatedly tap the F8 key on your keyboard as you turn your computer on until a black and white menu appears with the option. If you continue to have trouble with it, try running it without the "Files" scan checked. Again, if the results are really long, please attach them using the instructions I gave you at the end of step 1. This is to avoid having to scroll down the page too much make the space cleaner.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
30-Apr-2010, 08:35 PM
#6 | ||||||
| Nope that was enough  Thank youtermdd.sys is our culprit at the end of the picture you sent. Atapi.sys is only infected in memory with this infection. Please do the following now: NOTE: ComboFix should NOT be used without supervision by someone trained in its use. It does a whole lot more to a system than just remove infected files. Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser. 3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you please let me know. A increasing number of infections are spreading using Autoplay and leaving it disabled is a good idea. 4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
30-Apr-2010, 11:23 PM
#9 | ||||||
| If it still doesn't work, feel free to transfer the file I'm having you create over to the infected computer using a flash drive: Please do the following: 1. Close any open open programs before running the fix. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open Notepad (Start > Programs > Accessories) and copy/paste the text in the codebox below into it: Code: File:: c:\documents and settings\All Users\Application Data\8B2B650E78.sys c:\documents and settings\All Users\Application Data\8B2B650E78.sys c:\windows\system32\epmntdrv.sys c:\windows\system32\EuGdiDrv.sys C:\windows\system32\A0.tmp c:\windows\Fonts\TOA0JFj0.com RenV:: c:\program files\Ashampoo\Ashampoo FireWall FREE\FireWall .exe c:\program files\Common Files\Corel\Standby\Standby .exe c:\program files\Dell Support Center\bin\sprtcmd .exe c:\program files\MouseWare\system\EM_EXEC .exe c:\program files\TClockEx\TCLOCKEX .exe Driver:: epmntdrv EuGdiDrv MEMSWEEP2 AtJob:: KillAll:: Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
01-May-2010, 12:55 AM
#11 | ||||||
| That's good  Yeah the files in your startup key were all being infected by Vundo. The good thing is that the malware creators made it so that clean backups of the files were saved with an extra space at the end of the name; making it easy for us in the know to remove the infection. I'll need to scan a file:
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
01-May-2010, 01:52 AM
#13 | ||||||
| Yep. Let's clean up a bit and run a couple scans: STEP 1 Run OTS
Code: [Unregister Dlls] [Registry - All] < File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\ YN -> .exe [@ = secfile] -> Reg Error: Value error. < File Associations - Select to Repair > -> HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>\ YY -> .exe [@ = secfile] -> C:\Documents and Settings\LocalService\Local Settings\Application Data\ave.exe YY -> .exe [@ = secfile] -> C:\Documents and Settings\LocalService\Local Settings\Application Data\ave.exe YN -> .exe [@ = exefile] -> Reg Error: Key error. [Registry - Additional Scans - Safe List] < Disabled MSConfig Registry Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ YN -> Ashampoo FireWall hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Ashampoo\Ashampoo FireWall FREE\FireWall.exe YN -> Malwarebytes Anti-Malware (reboot) hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [Files/Folders - Created Within 30 Days] NY -> 642 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp NY -> 3 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp NY -> 2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp NY -> 1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp [Files/Folders - Modified Within 30 Days] NY -> 8 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp NY -> 7 C:\Documents and Settings\Dinyar\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Dinyar\Local Settings\Temp\*.tmp NY -> 3 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp NY -> 2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp NY -> 1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp [Files - No Company Name] NY -> 0jf5835bS5a -> C:\Documents and Settings\LocalService\Local Settings\Application Data\0jf5835bS5a NY -> 575467727 -> C:\Documents and Settings\Dinyar\Local Settings\Application Data\575467727 NY -> 575467727 -> C:\Documents and Settings\All Users\Application Data\575467727 NY -> 1166257537 -> C:\Documents and Settings\Dinyar\Local Settings\Application Data\1166257537 NY -> 1166257537 -> C:\Documents and Settings\All Users\Application Data\1166257537 NY -> 0jf5835bS5a -> C:\Documents and Settings\Dinyar\Local Settings\Application Data\0jf5835bS5a NY -> 0jf5835bS5a -> C:\Documents and Settings\All Users\Application Data\0jf5835bS5a [Empty Temp Folders] [EmptyFlash] [ClearAllRestorePoints] [Reboot]
Note: You may receive some errors while running the fix. Just press Ok and the fix should continue normally. If it seems to get stuck, give it some time. It's probably still working. STEP 2  Please run Malwarebytes' Anti-Malware
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. STEP 3 Using Internet Explorer or Firefox, visit Kaspersky Online Scanner 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
The program will then begin downloading and installing and will also update the database. Please be patient as this can take quite a long time to download.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| Tags |
| page redirect in search |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
Similar Threads | ||||
| Title | Thread Starter | Forum | Replies | Last Post |
| Search results redirecting to ads | tuluks | Virus & Other Malware Removal | 1 | 18-Feb-2010 09:09 PM |
| Google web search results - no link. HJT log attached | Jakabcin | Virus & Other Malware Removal | 0 | 15-May-2009 07:49 AM |
| Redirected search engine links. | hokieharlem | Virus & Other Malware Removal | 1 | 04-May-2009 05:05 PM |
| Search results being redirected | JuiceFever | Virus & Other Malware Removal | 0 | 14-Jan-2009 04:11 AM |
| search result page hijacked - Mozilla as well as IE | rakeshca | Virus & Other Malware Removal | 0 | 30-Aug-2008 07:17 PM |
