My home computer recently became infected with the "winupdate86.exe" trojan. Initially I thought it was the "worm.win32.netsky" as this is what kept popping up on my computer's task bar. Also at that time, it tried to direct me to buy new software….so after some searching on a different computer I found out what I really had. For awhile I could not do anything on computer including using the internet or looking at the C: drive. The trojan would simply use up all of my computer memory. After a few attempts, at one point I was able to open the C: drive and find the following files:
winupdate86.exe
winhelper86.dll
winlogon86.exe
that I thought were part of the virus. I tried to delete the winupdate86.exe but it would not let me but I was able to delete the winlogon86.exe. Which now looking back was probably the wrong thing to do. After doing this, I have a new problem. When I start at the Welcome / Log-in screen, it starts as normal saying: "loading your personal setting…" then quickly jumps to "closing your network connections…", "saving your settings…." and finally goes back to the Welcome / Log-in screen.
So, I'm sure I didn't remove the infection but now think I may have caused additional problems. Is there any hope of fixing this? Many thanks in advance…….
My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. I'd be grateful if you would note the following:
Logs from malware removal programs (DDS is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
Please make sure to carefully read any instruction that I give you.
Reading too lightly will cause you to miss important steps, which could have destructive effects.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within five days. I will post a reminder should you seem to fail to do this, however, if you fail to reply within three days then,
unless I have been notified of your absence in advance, the topic shall be closed!
Please do not PM me directly for help. If you have any questions, post them in this topic.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system. Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.
I am checking over your log, I will post back shortly with instructions.
Lets see if we can get your computer to boot up properly. Please follow the instructions in order.
Note:
If one method doesn't work proceed with the next.
Last Known Good Configuration
Start the computer by using the last known good configuration. To start the computer by using the last known good configuration, follow these steps:
Restart your computer.
As the computer starts to boot-up, Tap the F8 KEY repeatedly,
This will bring up a menu.
Use the Up and Down Arrow Keys to scroll to Last Known Good Configuration
Then press the Enter Key on your Keyboard
Go into your usual account
Next:
If that doesn't work try this:
Entering Safe Mode
Restart your computer.
As the computer starts to boot-up, Tap the F8 KEY repeatedly,
This will bring up a menu.
Use the Up and Down Arrow Keys to scroll to Safe Mode
Then press the Enter Key on your Keyboard
Go into your usual account
Next:
Upon reboot of your computer attempt to log into your computer normally. If you are successfully in getting to your desktop please go ahead and run OTL, GMER. Instructions for running these tools can be found below.
Note:
In the event that you are unable to boot your computer in Normal mode please attempt to boot using Last Known Good Configuration. If you are still unable to access your desktop then please attempt booting into Safe Mode. If after trying booting into Safe Mode you are still unable to load your desktop then please post back here for further instructions.
Next:
OTL Custom Scan
Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.
Next:
Scanning with GMER
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
In the right panel, you will see several boxes that have been checked. Uncheck the following …
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Next:
Please make sure you include the following items in your next post:
1. The log that was produced after running OTL. 2. The log that was produced after running GMER. 3. An update on how your computer is currently running.
It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Thank you for the response. I'll try working on this tonight or tomorrow morning. Since I currently can only access the internet via work my response may be delayed until Monday. Please bear with me until then.
If you are unable to boot your computer using Last Known Good Configuration, then please try the following set of instructions below.
Insert the Windows XP CD into your computer and then restart your computer. Press 'R' to enter the Recovery Console.
The Recovery Console will start and ask you which Windows installation you would like to log on to. If you have multiple Windows installations, it will list each one, and you would enter the number associated with the installation you would like to work on and press enter. If you have just one Windows installation, type 1 and press enter.
You will need to enter the administrator password. If a password was not set then leave the password field blank and press Enter.
From the Command Prompt please type the following lines, one at a time, hit the Enter key after each line. (If your CD drive is not D - change it to the appropriate letter)
cd system32
copy userinit.exe winupdate86.exe
copy userinit.exe winlogon86.exe
Note:
In the first line there is a space after cd
In the second line there is a space after copy and one after userinit.exe
In the third line there is a space after copy and one after userinit.exe
After hitting Enter for the first line you will see that the cursor will go to a new prompt if successful (you should see that it says: c:\windows\system32) if it is not successfully you will see a message similar to this: "The system cannot find the path specified."
After hitting Enter for the first line you will receive a message that says: "1 file(s) copied message"
After hitting Enter for the second line you will receive a message that says: "1 file(s) copied message"
Next:
In the Command Prompt type: exit
Note: This command will exit the recovery console and reboot your computer.
NOTE: If you have any questions while being in the Recovery Console please STOP and ask me for clarification before you continue.
OTL logfile created on: 1/26/2010 7:27:02 AM - Run 1
OTL by OldTimer - Version 3.1.25.4 Folder = C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1,015.00 Mb Total Physical Memory | 539.00 Mb Available Physical Memory | 53.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 224.12 Gb Total Space | 51.27 Gb Free Space | 22.87% Space Free | Partition Type: NTFS
Drive D: | 8.74 Gb Total Space | 0.44 Gb Free Space | 5.06% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 298.02 Gb Total Space | 97.53 Gb Free Space | 32.72% Space Free | Partition Type: FAT32
Computer Name: YOUR-4DACD0EA75
Current User Name: HP_Administrator
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
MOD - C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Desktop\OTL.exe (OldTimer Tools)
MOD - c:\Program Files\Common Files\Symantec Shared\CCL40.DLL (Symantec Corporation)
MOD - C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Temp\IadHide5.dll (BackWeb)
MOD - C:\Program Files\Common Files\Symantec Shared\AntiSpam\asOEHook.dll (Symantec Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcp71.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation)
NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/11/14 21:13:14 | 00,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (53765113575899136)
========== Files/Folders - Created Within 30 Days ==========
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
Next:
I would like for you to run GMER. I'll include directions for how to run it below:
Scanning with GMER
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
[external image: Posted Image]
Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
In the right panel, you will see several boxes that have been checked. Uncheck the following …
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Next:
Please make sure you include the following items in your next post:
1. The contents of the Extras.txt file. 2. The log that was produced after running OTL. 3. The log that was produced after running GMER. 4. An update on how your computer is currently running.
It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
I have been trying to run the GMER for 3 days and each time after scanning for hours I end up with an error message and the program has stopped running. Any thoughts why that would be happening?
I will try to find that other file when I get home.
Running ComboFix
Download ComboFix from one of the following locations: Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now
Here is the extras file that you previously asked for. I have downloaded the ComboFix and will run that ASAP. I'll post those results soon.
OTL Extras logfile created on: 1/26/2010 7:27:02 AM - Run 1
OTL by OldTimer - Version 3.1.25.4 Folder = C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1,015.00 Mb Total Physical Memory | 539.00 Mb Available Physical Memory | 53.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 224.12 Gb Total Space | 51.27 Gb Free Space | 22.87% Space Free | Partition Type: NTFS
Drive D: | 8.74 Gb Total Space | 0.44 Gb Free Space | 5.06% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 298.02 Gb Total Space | 97.53 Gb Free Space | 32.72% Space Free | Partition Type: FAT32
Computer Name: YOUR-4DACD0EA75
Current User Name: HP_Administrator
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe" = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe:*:Enabled:Updates from HP – (Hewlett-Packard)
![[external image: Posted Image]](http://i266.photobucket.com/albums/ii277/sUBs_/Gmer_initScan.gif){kind=link}