Jump to content

ShadowPuterDude

Emsisoft Employee
  • Posts

    20056
  • Joined

  • Last visited

  • Days Won

    212

Everything posted by ShadowPuterDude

  1. You are not following the directions as outlined in the thread tilted START HERE, if you don't we are just going to send you back to this thread. Your a-squared log does not show the infection that requires the running of Win32kDiag. You are missing 2 required logs.
  2. Thread Closed Reason: Resolved The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread
  3. Attach fresh logs for: a-squared Free/Anti-Malware ISeeYouXP HiJackFree Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  4. Download GMER 1. Click-on the "Download Exe" button, this will generate a random name for GMER, accept the default file name and save the file to your Desktop. 2. Double click the file you just downloaded. 3. Click the Rootkit tab and then click the Scan button. 4. IMPORTANT: Do NOT use the computer while the scan is in progress 5. Do not select the "Show all" checkbox during the scan. 6. When it finishes, click the Copy button. This will copy the results to your clipboard. 7. Paste the clipboard into a notepad file and save it to a log (like gmer.log). Attach the GMER log with your next reply.
  5. These are False Positive detections. C:\Program Files\support.com\temp\ComcastToolbar.exe/ComcastAntiSpyService.exe detected: Trojan-Dropper.Delf!IK C:\Program Files\support.com\temp\ComcastToolbar.exe/langv5.dat detected: Trojan-Dropper.Delf!IK Submit to EMSI Software as False Positive detections.
  6. Which command depends on whether or not I had you rename combofix during download.
  7. Until you have removed all pirated software, keygens, patches, and cracks. You will not receive malware removal assistance. Software piracy is illegal, and failure to comply with requests to remove illegal software will result in you not receiving assistance on this forum.
  8. We can disable Autoruns, and may be able to disinfect the USB drive as well.
  9. Can you post a log from ZA. So, I can see what exactly was detected and quarantined.
  10. Download avz4.zip from here Unzip it to your desktop to a folder named avz4 Double click on AVZ.exe to run it. Run an update by clicking the Auto Update button on the Right of the Log window: Click Start to begin the update Note: If you recieve an error message, chose a different source, then click Start again After the update, from the "File" menu, choose "Standard Scripts" Put a check next to item 2: Advanced System Investigation Click Execute selected scripts At the next prompt, click the OK button Let the scan run and click "OK" when the completion prompt pops up Now Close out of the Standard Scripts window, and exit AVZ Navigate to the avz4 folder and locate the folder LOG Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip Attach the Compressed file, virusinfo_syscheck.zip, to your next reply, along with a fresh HijackThis log
  11. Run OTL Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Under Custom Scan paste this in netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %SYSTEMDRIVE%\*.exe %SYSTEMDRIVE%\tdlcmd.dll /s %SYSTEMDRIVE%\tdlwsp.dll /s Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. Attach both files.
  12. Your logs look fine. Unless you are having problems from Malware it is time to do the final steps. If you used ComboFix, uninstall ComboFix: Click START then RUN and enter the below into the run box and then click OK. (Use only the command of the same name as your copy of combofix.) AvoidTDSS /u or combofix /u Note: The space before /u, must be there. This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults. Delete the C:\AvoidTDSS or C:\ComboFix folder from combofix. Delete everything in C:\!KillBox Delete the following from your Desktop (If they exist) Avenger.exe Avenger.txt Avenger.zip DisableAutoRuns.reg FixMe.reg FixReg.reg ISeeYouXP.exe ISeeYouXP.lnk ISeeYouXP.txt Anything else I had you use Delete the following: (If they exist) C:\Avenger.txt C:\Avenger C:\ComboFix.txt C:\ComboFix C:\SDFix C:\Qoobox You can delete and uninstall any programs I had you download, that you do not wish to keep on the system. Empty the Recycle Bin Run ATF Cleaner In the ISeeYouXP folder double-click HideIT.bat. Turn off System restore to flush all your restore points then turn system restore back on. To manually turn off System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. 4 Click Yes when you receive the prompt to the turn off System Restore. To turn on System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. Delete C:\ISeeYouXP Run Windows Update and update your Windows Operating System. Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated. That should take care of everything. Safe Surfing!
  13. Run OTL.exe Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL :OTL PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) :Files C:\32788R22FWJFW\eXereg.exe C:\32788R22FWJFW C:\Documents and Settings\John\Desktop\Combo-Fix.exe C:\Documents and Settings\John\Local Settings\Application Data\Mozilla\Firefox\Profiles\e4okl6jf.default\Cache\C2152591d01 :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Attach the new OTL log ( don't check the boxes beside LOP Check or Purity this time ) Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  14. Thread Closed Reason: Lack of Response PM either ShadowPuterDude or Lynx to have this thread reopened. The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread
  15. Boot to Safe Mode and log on to the Administrator account. You should be able to manage users from the Administrator Account.
  16. This profile appears to be so heavily damaged, that it cannot be repaired. You will need to remove this profile from the system and create a new profile for this user.
  17. Your logs look fine. Unless you are having problems from Malware it is time to do the final steps. If you used ComboFix, uninstall ComboFix: Click START then RUN and enter the below into the run box and then click OK. (Use only the command of the same name as your copy of combofix.) AvoidTDSS /u or combofix /u Note: The space before /u, must be there. This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults. Delete the C:\AvoidTDSS or C:\ComboFix folder from combofix. Delete everything in C:\!KillBox Delete the following from your Desktop (If they exist) Avenger.exe Avenger.txt Avenger.zip DisableAutoRuns.reg FixMe.reg FixReg.reg ISeeYouXP.exe ISeeYouXP.lnk ISeeYouXP.txt Anything else I had you use Delete the following: (If they exist) C:\Avenger.txt C:\Avenger C:\ComboFix.txt C:\ComboFix C:\SDFix C:\Qoobox You can delete and uninstall any programs I had you download, that you do not wish to keep on the system. Empty the Recycle Bin Run ATF Cleaner In the ISeeYouXP folder double-click HideIT.bat. Turn off System restore to flush all your restore points then turn system restore back on. To manually turn off System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. 4 Click Yes when you receive the prompt to the turn off System Restore. To turn on System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. Delete C:\ISeeYouXP Run Windows Update and update your Windows Operating System. Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated. That should take care of everything. Safe Surfing!
  18. You can attach more than 1 file per reply. Keep all attached files in the same reply. Run OTL.exe Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL :OTL PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\AskBarDis\bar\bin\AskService.exe () SRV - (ASKService [Auto | Running]) -- C:\Program Files\AskBarDis\bar\bin\AskService.exe () DRV - (Teefer [unknown | Running]) -- Service key not found. File not found DRV - (wpsdrvnt [unknown | Running]) -- Service key not found. File not found O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Spy Blocker Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll (Ask.com) :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify"=- "FirewallDisableNotify"=- "UpdatesDisableNotify"=- "AntiVirusOverride"=- "FirewallOverride"=- :Files C:\WINDOWS\System32\*.tmp C:\WINDOWS\*.tmp :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Attach the new OTL log ( don't check the boxes beside LOP Check or Purity this time ) AVG is broken. You will need to uninstall AVG, reboot, and install AVG again. Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  19. Download -->> OTL <<-- to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically. Attach both logs with your next reply.
  20. Run OTL.exe Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL :OTL PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\EA GAMES\The Battle for Middle-Earth\game.dat"=- "C:\Program Files\EA GAMES\The Battle for Middle-Earth\patchget.dat"=- "C:\Program Files\BitTorrent\bittorrent.exe"=- "C:\Documents and Settings\Albino Cerberus\Desktop\Downloads\RVB\700_DDI_CB.exe"=- "C:\Program Files\Blizzard Entertainment\Warcraft\Warcraft III Files\Warcraft III\Warcraft III.exe"=- :Files C:\WINDOWS\System32\*.tmp C:\WINDOWS\*.tmp C:\Documents and Settings\Albino Cerberus\My Documents\*.tmp @C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 @C:\Documents and Settings\All Users\Application Data\TEMP:7E95B6FD @C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Attach the new OTL log ( don't check the boxes beside LOP Check or Purity this time )
  21. The installed version of Java on this computer is out-dated. Install Java Runtime Environment (JRE) 6u16 available from Sun Microsystems. ----------------------------------------------------------- Using Add or Remove Programs in the Control Panel; uninstall the following: ----------------------------------------------------------- Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*). REGEDIT4 [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7605b91e-f1bb-4213-908e-66785c1e72b4}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{A7327C09-B521-4EDB-8509-7D2660C9EC98}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "fakolituw"=- "hijogesabo"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "yufarovad"=- "kiwejogop"=- "rimiwikot"=- "jomabiwas"=- "zovapulig"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{32c9806b-6aee-45bc-a15d-e07db5457b4a}"=- "{063b3142-9a73-47cf-bc6b-bab1bfb18428}"=- "{b22c3534-cdd2-4409-83de-be0eb0449933}"=- "{c29bdebf-30a7-4dac-98dc-feace0d5a035}"=- "{eac64338-adb8-459b-a0c7-2f4a4e59aec3}"=- Close Notepad. Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry. ----------------------------------------------------------- Now we need to use ComboFix to remove some stuff. Make sure that the copy of combofix.exe that you downloaded earlier is on your Desktop but Do not run it! If it is not on your Desktop, the below will not work. Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ): KILLALL:: RegLockDel:: [HKEY_USERS\S-1-5-21-2484928147-4131447111-3784547135-1008\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{FB9D384F-AACB-00EE-A0A4-D86FE2964408}*] File:: C:\Documents and Settings\All Users\Application Data\toyinoki\toyinoki.dll c:\windows\system32\denekilo.dll c:\windows\system32\giwawuvi c:\windows\system32\hovogove.dll c:\windows\SYSTEM32\jazejumi.dll c:\windows\SYSTEM32\nakokote.dll c:\windows\SYSTEM32\yihalubo.exe c:\windows\SYSTEM32\zukenezo.dll Folder:: c:\documents and settings\All Users\Application Data\peyumama c:\documents and settings\All Users\Application Data\loyayono c:\documents and settings\All Users\Application Data\fubatuzo c:\documents and settings\All Users\Application Data\44768534 c:\documents and settings\All Users\Application Data\janufini c:\documents and settings\All Users\Application Data\yitofoyi c:\documents and settings\All Users\Application Data\rijavuza c:\documents and settings\All Users\Application Data\toyinoki Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe At this point, you MUST EXIT ALL BROWSERS NOW before continuing! You should have both the ComboFix.exe and CFScript.txt icons on your Desktop. Now use your mouse to drag CFscript.txt on top of ComboFix.exe Follow the prompts. When it finishes, a log will be produced named c:\combofix.txt I will ask for this log below Note: DO NOT mouseclick combofix's window while it is running. That may cause it to stall. The ComboFix folder should not be renamed since ComboFix and even we would have suspicions about it. Also when you uninstall CF, the folder would not be removed since it does not look for that folder name. ----------------------------------------------------------- Attach fresh logs for: ComboFix (C:\combofix.txt) a-squared Free/Anti-Malware ISeeYouXP HiJackFree Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
  22. Run OTL.exe Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL :OTL PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe File not found :Files C:\WINDOWS\*.tmp C:\WINDOWS\System32\*.tmp C:\Combo-Fix1859C C:\32788R22FWJFW C:\Combo-Fix8775C @C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Attach the new OTL log ( don't check the boxes beside LOP Check or Purity this time )
  23. Thread Closed Reason: Lack of Response PM either ShadowPuterDude or Lynx to have this thread reopened. The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread
  24. Your logs look fine. Unless you are having problems from Malware it is time to do the final steps. If you used ComboFix, uninstall ComboFix: Click START then RUN and enter the below into the run box and then click OK. (Use only the command of the same name as your copy of combofix.) AvoidTDSS /u or combofix /u Note: The space before /u, must be there. This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults. Delete the C:\AvoidTDSS or C:\ComboFix folder from combofix. Delete everything in C:\!KillBox Delete the following from your Desktop (If they exist) Avenger.exe Avenger.txt Avenger.zip DisableAutoRuns.reg FixMe.reg FixReg.reg ISeeYouXP.exe ISeeYouXP.lnk ISeeYouXP.txt Anything else I had you use Delete the following: (If they exist) C:\Avenger.txt C:\Avenger C:\ComboFix.txt C:\ComboFix C:\SDFix C:\Qoobox You can delete and uninstall any programs I had you download, that you do not wish to keep on the system. Empty the Recycle Bin Run ATF Cleaner In the ISeeYouXP folder double-click HideIT.bat. Turn off System restore to flush all your restore points then turn system restore back on. To manually turn off System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. 4 Click Yes when you receive the prompt to the turn off System Restore. To turn on System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. Delete C:\ISeeYouXP Run Windows Update and update your Windows Operating System. Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated. That should take care of everything. Safe Surfing!
×
×
  • Create New...