105 replies to this topic

[Alantb]

Hi Oldman - herewith the data attached? Did it work? Cheers, Alan

Attached Files

•  GMER.txt   46.83KB   239 downloads
•  MBRCheck_11.03.10_09.07.12.txt   7.75KB   192 downloads

[oldman960]

Hi Alantb,

Leave AVG uninstalled for now. This tool must be ran directly from the infected computer's desktop.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log.

Thanks

[Alantb]

Sorry Oldman it didn't seem to work; I've tried maybe ten times. I thought perhaps that the download was defective so I tried the other link but no joy. There was no appearance of the Microsoft Recovery Console. No file called C:\Combofix.txt was produced and I don't get any of the screens illustrated in 'bleeping computer" At one point there was a BSOD with the following Message " The Windows System has been closed to protect your computer...."(etc. etc.) and the following "Stop 0x0000007E, (0xC0000005, 0xA730F900, 0xA730F5Fc) "SST9.sys - Address A650F1BA base at A650B000, Datastamp 4cc88da2" This did not repeat after restart. I'm still pulling in the fixes via the old PC and a pendrive. When the box is on the net there's quite a lot of activity and if I run Task Manager the process ComboFix.exe runs briefly, then Task Manager is terminated. Rerun TM and there is a process called "cmd.cfxxe" and another "mbr.cfxxe" running. But no files produced. I am fairly sure that I have crippled all the AV or Firewall or AD programs. Cheers, Alan

Edited by Alantb, 04 November 2010 - 08:30 AM.

[Alantb]

Hi Oldman; I looked up "Microsoft Recovery Console" on the net and find that it doesn't work with XP after SP2 and the fix for this is rather complex. Is this why Combofix won't run? Alan

[oldman960]

Hi alantb,

I assure you the Recovery Console is available and does work on XP SP3. It's just that they don't make one specific for XP Sp3. We actually used the same program when we made the Recovery Console disk earlier.

Don't worry about combofix not installing the Recovery Console at this point. It won't be able to unless you have an active internet connection.

Those processes you were looking at in Task manger belong to combofix. You should not be opening and closing anything while it is running.

Let's try it this way. Delete the copy of combofix you have now and download a new one.

Please download ComboFix from Link 1or Link 2 .

• If you are using Firefox, make sure that your download settings are as follows:
  -Tools->Options->Main tab
  -Set to "Always ask me where to Save the files".
  
• During the download, before you download it, rename Combofix to jgh.exe

• It is important you rename Combofix during the download, but not after.
• Please do not rename Combofix to other names, but only to the one indicated.

Boot the infected computer to Safe Mode.

Transfer the renamed combofix to the infected computer's desktop and run it by double clicking on it.

[Alantb]

Hi Oldman; Firstly, the PC won't boot if connected to the net Even if I connect the wires in safe mode, Combofix denies existence of a connection to the net. However after running into several dead ends I find that I can't connect in safe mode anyhow - CF won't run if NOT in safe mode. So I can't get the Recovery Console. So I get Combofix to run. It gets down to Stage 50 then sets out to delete a file called .......\niup\XAWAD. Then it says "Preparing report . . ." and - gets a BSOD ".... windows has been shut down to prevent damage to your computer." with STOP 0x0000008E and various addresses as above. Where would CF put it's report? It does do a dump. Can I get to the dump and send it to you - do you need it? Back to the bar, Alan

[oldman960]

Hi Alantb,

Don't worry about the Recovery Console, we have already made a disk so we will have access to it if we need it.

Let's get some new OTL logs.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click on Standard Output at the top
• UNCheck the boxes beside LOP Check and Purity Check.
• In the Extra Registry section, change it to All
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

[Alantb]

Hi Oldman; Here you go again:- (sorry, sent one twice, senile decay setting in....) Alan

Attached Files

•  OTL.Txt   50.47KB   148 downloads
•  OTL.Txt   50.47KB   137 downloads
•  Extras.Txt   47.23KB   236 downloads

Edited by Alantb, 05 November 2010 - 08:56 AM.

[oldman960]

Hi Alantb,

Looks like some new malware has crept in. We'll check something and do a small fix.

On the clean computer make this batch file

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad.

Do Not copy the word CODE

%Windir%\MBR.exe -c 0 1 "%userprofile%\Desktop%\_backup_mbr.dat"

In the notepad

• Click File, Save as..., and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "myfix.bat"
• Click save

You will have a new file on your desktop called myfix.bat with an icon that looks like this We'll be using this file on your infected computer.



Next

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

:Services

:OTL
O4 - HKCU..\Run: [{D9717039-AF6A-796A-29B3-51876546B083}] C:\Documents and Settings\Alan\Application Data\Niup\xawad.exe File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

In the notepad

• Click File, Save as..., and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "fix2.txt"
• Click save

Transfer the 2 files to your infected computer's desktop.

On the infected computer

Double click on myfix.bat. A new file called Alan_backup_mbr.dat will appear on your desktop. Please attach it to your next reply.

Open the file fix2.txt

• right click on the text and click select all
• right click on the highlighted text and click copy

Double click on OTL.exe

• Under the Custom Scans/Fixes box at the bottom, right click and select paste

The text from the notepad should appear.

Click the Run Fix button at the top

• Let the program run unhindered
• Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

plese post back with

• Alan_backup_mbr.dat
• OTL fix log

Thanks

[Alantb]

Hi Oldman - sorry, haven't done this yet - but I haven't forgotten, just a bit busy. Cheers, Alan

[Alantb]

Hi Oldman - One more time!
I hope the .dat file makes sense, looks like garbage to me!
Cheers, Alan


========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{D9717039-AF6A-796A-29B3-51876546B083} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D9717039-AF6A-796A-29B3-51876546B083}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.

OTL by OldTimer - Version 3.2.17.1 log created on 11082010_212220

_backup _mbr.dat:-

3ÀŽÐ¼ |ûPPü¾|¿PW¹å
ó¤Ë½¾±8n | uƒÅâôÍ‹õƒÆIt8,tö µ´‹ð¬< tü» ´ÍëòˆNèF s*þF€~t€~t ¶uÒ€FƒFƒV
è! s ¶ë¼�>þ}Uªt€~ tÈ ·ë©‹üW‹õË¿ ŠV ´Ír#ŠÁ$?˜ŠÞŠüC÷ã‹Ñ†Ö±ÒîB÷â9V
w#r9Fs¸
» |‹N‹V ÍsQOtN2äŠV ÍëäŠV `»ªU´AÍr6�ûUªu0öÁ
t+a`j j ÿv
ÿvj h |j
j´B‹ôÍaasOt2äŠV ÍëÖaùÃInvalid partition table Error loading operating system Missing operating system ,DcÞß €

þÿÿ? � Uª

[oldman960]

Hi Alantb,

Sorry about that. I meant to tell you that you will need to attach Alan_backup_mbr.dat. The forum software will strip out some of the data otherwise.

Please attach it to your next reply.

Thanks

[Alantb]

Hi Oldman, I may have to do it again, the forum software won't accept the file so maybe I did somethig worong. Later - Cheers, Alan

[oldman960]

Hi alantb,

Rename the file to Alan_backup_mbr.txt You will be able to attach it then.

[Alantb]

Here we go again;

Attached Files

•  Alan_backup_mbr.txt   512bytes   164 downloads