Jump to content

ShadowPuterDude

Emsisoft Employee
  • Posts

    20172
  • Joined

  • Last visited

  • Days Won

    214

Everything posted by ShadowPuterDude

  1. OK, let's use a different tool. Download -->> OTL <<-- to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically. Attach both logs with your next reply.
  2. Submit C:\WINDOWS\system32\spoolsv.exe to http://virustotal.com for analysis, post the results URL with your next reply.
  3. I am going to have you run another tool that will look at many of the same areas of the tools already ran, but also looks at a few areas the others don't. Download -->> OTL <<-- to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically. Attach both logs with your next reply.
  4. Thread Closed Reason: Resolved The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread
  5. Thread Closed Reason: Lack of Response PM either ShadowPuterDude or Lynx to have this thread reopened. The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread
  6. Thread Closed Reason: Lack of Response PM either ShadowPuterDude or Lynx to have this thread reopened. The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread
  7. You should not be quarantining anything unless instructed to do so. Some of the tools I am having you run are malware removal tools. ----------------------------------------------------------- The installed version of Java on this computer is out-dated. Install Java Runtime Environment (JRE) 6u17 available from Sun Microsystems. ----------------------------------------------------------- Using Add or Remove Programs in the Control Panel; uninstall the following: ----------------------------------------------------------- Now we need to use ComboFix to remove some stuff. Make sure that the copy of combofix.exe that you downloaded earlier is on your Desktop but Do not run it! If it is not on your Desktop, the below will not work. Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ): KILLALL:: File:: c:\windows\Vjagoxiredoxi.dat c:\windows\Qvimogo.bin C:\WINDOWS\kvetms.dll C:\WINDOWS\tasks\SysSchedule.job C:\Documents and Settings\Ben\Stuff\Programs\EvID4226Patch223d-en.zip c:\documents and settings\All Users\Application Data\6798f8b\sqlite3.dll c:\documents and settings\All Users\Application Data\6798f8b\mozcrt19.dll c:\program files\mozilla firefox\components\_vjS01otIjWsYg.dll Folder:: c:\documents and settings\All Users\Application Data\6798f8b C:\WINDOWS\temp\.nvdkit C:\WINDOWS\temp\PDFC Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe At this point, you MUST EXIT ALL BROWSERS NOW before continuing! You should have both the ComboFix.exe and CFScript.txt icons on your Desktop. Now use your mouse to drag CFscript.txt on top of ComboFix.exe Follow the prompts. When it finishes, a log will be produced named c:\combofix.txt I will ask for this log below Note: DO NOT mouseclick combofix's window while it is running. That may cause it to stall. The ComboFix folder should not be renamed since ComboFix and even we would have suspicions about it. Also when you uninstall CF, the folder would not be removed since it does not look for that folder name. ----------------------------------------------------------- Attach fresh logs for: ComboFix (C:\combofix.txt) a-squared Free/Anti-Malware ISeeYouXP Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  8. The installed version of Java on this computer is out-dated. Install Java Runtime Environment (JRE) 6u17 available from Sun Microsystems. ----------------------------------------------------------- Using Add or Remove Programs in the Control Panel; uninstall the following: ----------------------------------------------------------- Download Avenger from HERE and unzip to your desktop. Run Avenger Read the prompt that appears, and press OK Copy & paste the following text in Input script Box: Folders to delete: C:\Documents and Settings\Chris Kinnane\Local Settings\Application Data\nwgktm Then click "Execute". You will be presented with 2 confirmation prompts. Select yes on each. Your system will reboot. Note: It is possible that Avenger will reboot your system TWICE. Upon reboot, a command prompt window will appear on your screen for a few seconds, and then Avenger's log will open. Attach that log here in your next post.
  9. Malware disabled via MSsonfig can not be removed properly. Everything that is disabled via MsConfig must be enabled; so, that it can be properly dealt with.
  10. Value: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run --> reminder detected: Trace.Registry.FTPAttack!A2 THis is normally the run key for a registration reminder. Cookies aren't a threat, they'll get regenerated everytime you vist the site the generated the cookie. Download Avenger from HERE and unzip to your desktop. Run Avenger Read the prompt that appears, and press OK Copy & paste the following text in Input script Box: Files to delete: C:\Documents and Settings\HelpAssistant\Local Settings\Temp\31C.tmp C:\Documents and Settings\HelpAssistant\Local Settings\Temp\jltqbj.dll Then click "Execute". You will be presented with 2 confirmation prompts. Select yes on each. Your system will reboot. Note: It is possible that Avenger will reboot your system TWICE. Upon reboot, a command prompt window will appear on your screen for a few seconds, and then Avenger's log will open. The rest a System Restore Points. You clear those by turning off System Restore, reboot, then turn System Restore back on. Attach fresh logs for: Avenger (C:\avenger.txt) a-squared Free/Anti-Malware ISeeYouXP Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  11. Download Avenger from HERE and unzip to your desktop. Run Avenger Read the prompt that appears, and press OK Copy & paste the following text in Input script Box: Files to delete: C:\WINDOWS\Temp\av1.tmp C:\WINDOWS\Temp\av3E.tmp C:\WINDOWS\Temp\fb_1404.lck C:\WINDOWS\Temp\fb_1752.lck Then click "Execute". You will be presented with 2 confirmation prompts. Select yes on each. Your system will reboot. Note: It is possible that Avenger will reboot your system TWICE. Upon reboot, a command prompt window will appear on your screen for a few seconds, and then Avenger's log will open. Please Attach that log here in your next post.
  12. The only other method to repair the WMI engine is to reinstall the Operating System.
  13. C:\Program Files\Microsoft Office\Office\SBT\SBCM\SBCMAUT.EXE detected: Gen.Trojan!IK False Postive. Submit to EMSI. C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir detected: Rootkit.Win32.TDSS!IK C:\Qoobox\Quarantine\C\WINDOWS\system32\logon.exe.vir detected: Trojan.Win32.Bredolab!IK Inactive. Quarantined by ComboFix. C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000011.EXE detected: Gen.Trojan!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000040.exe detected: Virus.Win32.Rootkit!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0008249.exe detected: Trojan.Win32.Bredolab!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009234.exe/pc.exe detected: Trojan.Win32.FakeAV!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009234.exe/agent.exe detected: Trojan.Win32.FakeAV!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009234.exe/guide.html detected: Fraudload!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009235.exe/pc.exe detected: Trojan.Win32.FakeAV!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009235.exe/agent.exe detected: Trojan.Win32.FakeAV!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009235.exe/guide.html detected: Fraudload!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009236.exe/pc.exe detected: Trojan.Win32.FakeAV!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009236.exe/agent.exe detected: Trojan.Win32.FakeAV!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009236.exe/guide.html detected: Fraudload!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009237.exe/pc.exe detected: Trojan.Win32.FakeAV!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009237.exe/agent.exe detected: Trojan.Win32.FakeAV!IK C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP27\A0009237.exe/guide.html detected: Fraudload!IK Inactive. System Retore Point. Antivirus Tools Cannot Clean Infected Files in the System Restore Folder. The System Restore feature in Windows protects all folders and files in the System Restore folder on the Windows partition. This folder and all of its subfolders are the data store that the System Restore feature uses to restore your computer's operating system to a previous state from a previous point in time. Although some antivirus programs may have the ability to work with files that have been compressed or stored in .zip or .cab file format, the System Restore feature does not permit these utilities to manipulate these files within the data store. The data store is protected for data integrity purposes, and the System Restore feature is the only method you can use to obtain access to the data store. Because of this, the antivirus program is unable to remove the virus from the file or files in the data store. The files in the data store are inactive and can be used only by the System Restore feature. ----------------------------------------------------------- Your logs look fine. Unless you are having problems from Malware it is time to do the final steps. If you used ComboFix, uninstall ComboFix: Click START then RUN and enter the below into the run box and then click OK. (Use only the command of the same name as your copy of combofix.) AvoidTDSS /uninstall or combofix /uninstall or Combo-Fix /uninstall Note: The space before /uninstall, must be there. Which command you use depends on if I had you rename ComboFix during download. This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults. Delete everything in C:\!KillBox (If I didn't have you use KillBox, then this won't be present) Delete the following from your Desktop (If they exist) Avenger.exe Avenger.txt Avenger.zip CFscript.txt dds.scr dds.pif DisableAutoRuns.reg fixes.bat FixMe.reg FixReg.reg ISeeYouXP.exe ISeeYouXP.lnk ISeeYouXP.txt Win32kDiag.exe Win32kDiag.txt Anything else I had you use Delete the following files: (If they exist) C:\Avenger.txt C:\ComboFix.txt Delete the following folders: (If they exist) C:\Avenger C:\AvoidTDSSS C:\ComboFix C:\SDFix C:\Qoobox You can delete and uninstall any programs I had you download, that you do not wish to keep on the system. Empty the Recycle Bin Run CCleaner Turn off System restore to flush all your restore points then turn system restore back on. To manually turn off System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. 4. Click Yes when you receive the prompt to the turn off System Restore. To turn on System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. Delete C:\ISeeYouXP Run Windows Update and update your Windows Operating System. Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated. That should take care of everything. Safe Surfing!
  14. Thread Closed Reason: Resolved The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread
  15. The WMI Engine appears to be damaged. To fix a corrupted WMI repository, you have to reinstall WMI. Follow these steps: Click Start, Run and type CMD Type this command and press Enter: net stop winmgmt Using Windows Explorer, navigate to %systemroot%\system32\wbem directory and delete the Repository directory. By default, the repository folder is located in the C:\Windows\system32\wbem directory. Switch to Command Prompt window, and type: net start winmgmt Re-registering the WMI components The .DLL and .EXE files used by WMI are located in %windir%\system32\wbem. You might need to re-register all the .DLL and .EXE files in this directory. If you are running a 64-bit system you might also need to check for .DLLs and .EXE files in %windir%\sysWOW64\wbem. To re-register the WMI components, run the following commands at the command prompt: cd /d %windir%\system32\wbem for %i in (*.dll) do RegSvr32 -s %i for %i in (*.exe) do %i /RegServer Attach a fresh ISeeYouXP log.
  16. Attach a new a-squared log, so I can compare it to the first log.
  17. 1) Press CTRL+ALT+DEL 2) Task Manger will open. Click on the Processes tab and search for VIEWMGR.EXE, if its found, click on it and then click End Task to close it. 3) Exit Task Manger 4) Click on Start, Control Panel, Add/Remove Programs. 5) Uninstall Viewpoint Manager. 6) Close the Add/Remove Programs and Control Panel 7) Restart your computer
  18. You are using MsConfig to prevent several items from loading at Windows start. MsConfig is a diagnostic tool, and not intended to be used in the manner you are using MsConfig. Enable everything you used MsConfig to disable. If you are receiving error messages, related to these items, at system start; we can fix this without using MsConfig. ----------------------------------------------------------- Now we need to use ComboFix to remove some stuff. Make sure that the copy of combofix.exe that you downloaded earlier is on your Desktop but Do not run it! If it is not on your Desktop, the below will not work. Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ): KILLALL:: Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8450ECD6-C797-4777-A1B7-E4C4D38ADC2E}] File:: c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil841111111111111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil841111111111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil84111111111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil8411111111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil841111111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil84111111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil8411111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil841111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil84111111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil8411111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil841111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil84111111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil8411111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil841111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil84111.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil8411.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil841.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\msgutil84.dll c:\documents and settings\Rich\Application Data\Messenger\Drivers\Aud32\smartasf27.exe c:\windows\system32\nvbjhjkn.dll C:\Program Files\SUN.EXE C:\Program Files\game.exe Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe At this point, you MUST EXIT ALL BROWSERS NOW before continuing! You should have both the ComboFix.exe and CFScript.txt icons on your Desktop. Now use your mouse to drag CFscript.txt on top of ComboFix.exe Follow the prompts. When it finishes, a log will be produced named c:\combofix.txt I will ask for this log below Note: DO NOT mouseclick combofix's window while it is running. That may cause it to stall. The ComboFix folder should not be renamed since ComboFix and even we would have suspicions about it. Also when you uninstall CF, the folder would not be removed since it does not look for that folder name. ----------------------------------------------------------- Attach fresh logs for: ComboFix (C:\combofix.txt) a-squared Free/Anti-Malware ISeeYouXP HiJackFree Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  19. Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*). REGEDIT4 [-HKEY_USERS\S-1-5-21-2178475379-1560192793-155487171-1006\Software\SAV] Close Notepad. Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry. ----------------------------------------------------------- Download Avenger from HERE and unzip to your desktop. Run Avenger Read the prompt that appears, and press OK Copy & paste the following text in Input script Box: Files to delete: C:\Documents and Settings\Jen\Desktop\Downloads\win_protection_update(2).exe C:\Documents and Settings\Jen\Desktop\Downloads\win_protection_update(3).exe C:\Documents and Settings\Jen\Desktop\Downloads\win_protection_update(4).exe C:\Documents and Settings\Jen\Desktop\Downloads\win_protection_update.exe Then click "Execute". You will be presented with 2 confirmation prompts. Select yes on each. Your system will reboot. Note: It is possible that Avenger will reboot your system TWICE. Upon reboot, a command prompt window will appear on your screen for a few seconds, and then Avenger's log will open. Please paste that log here in your next post. ----------------------------------------------------------- Attach fresh logs for: Avenger (C:\avenger.txt) a-squared Free/Anti-Malware Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  20. Download ComboFix from one of these locations: Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop Link 1 Link 2 Link 3 * IMPORTANT !!! Save Combo-Fix to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools See HERE for help Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, ComboFix will produce a log. Note: 1. Do not mouseclick combofix's window while it's running. That may cause it to stall! 2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet. ----------------------------------------------------------- Attach fresh logs for: ComboFix (C:\combofix.txt) a-squared Free/Anti-Malware ISeeYouXP HiJackFree Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  21. Download ComboFix from one of these locations: Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop Link 1 Link 2 Link 3 * IMPORTANT !!! Save Combo-Fix to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools See HERE for help Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, ComboFix will produce a log. Note: 1. Do not mouseclick combofix's window while it's running. That may cause it to stall! 2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet. ----------------------------------------------------------- Attach fresh logs for: ComboFix (C:\combofix.txt) ISeeYouXP Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  22. Thread Closed Reason: Resolved The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread
  23. The problem is with Windows Management Instrumentation and that its database is incorrect. To fix this: (1) stop the WMI Service, (2) delete the "repository" folder in C:\windows\system32\wbem, and (3) start the WMI Service. Starting the service rebuilds the deleted folder and the database. (4) Reboot.
  24. Your ISeeYouXP log is missing a lot of data. Edit your A2 rules and remove NTVDM.EXE from the rules. Run ISeeYouXP again and this time allow NTVDM.EXE to run.
×
×
  • Create New...