OK,
Is that the full log, or is their more of it?
Please do the following:
You will need to be able to boot into the recovery console for this:
This is how to beeot into the Recovery Console:
Restart your computer Before Windows loads, you will be prompted to choose which Operating System to start Use the up and down arrow key to select Microsoft Windows Recovery Console You must enter which Windows installation to log onto. Type 1 and press enter.
But first - Do the following:
Next, please download
maxlook , saving the file to your desktop.
Double click maxlook.exe to run it.
Note - you must run it only once!
As instructed when the tool runs, > restart the computer and logon to the
Recovery Console .
Execute the following bolded command at the
x :\windows> prompt <— the red x represents your operating system drive letter, usually C
batch look.bat
🖼 Click to load external image (Posted Image)
You will see
1 file copied many times then return to the
x :\windows> prompt.
Type
Exit to restart your computer then logon in normal mode.
Please run maxlook.exe again now.
Note - you must run it only once!
It will produce looklog.txt on the desktop and open it.
Please post the results here.
Hi,Run from C:\Documents and Settings\Donal\Desktop\maxlook.exe on 26/02/2010 at 14:04:21.29
Hi,
Please do the following:
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Copy/paste the text inside the Codebox below into notepad:
Here's how to do that:
Click
Start > Run type
Notepad click
OK.
This will open an empty notepad file:
Copy all the text
inside of the code box -
Press Ctrl+C (or right click on the highlighted section and choose 'copy')
FCopy::
C:\WINDOWS\ServicePackFiles\i386\netbt.sys | C:\WINDOWS\system32\dllcache\netbt.sys
C:\WINDOWS\ServicePackFiles\i386\netbt.sys | C:\WINDOWS\system32\drivers\netbt.sys
Now
paste the copied text into the open notepad - press
CTRL+V (or right click and choose 'paste')
Here's how to do that:
1.Click
File ;
2.Click
Save As … Change the directory to your
desktop ;
3.Change the
Save as type to
"All Files";
4.Type in the file name:
CFScript
5.Click
Save …
[external image: Posted Image]
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Reboot your computer, then repost a fresh maxhandle log
OK. ComboFix did much the same as before - i.e. detected rootkit activity, rebooted computer and continued scan. The log is below.
ComboFix 10-02-25.02 - Donal 26/02/2010 14:36:14.3.2 - x86https://login.live.com/ppsecure/sha1auth.srf?lc=2057 http://www.gmer.net http://www.gmer.net
Then I rebooted and ran maxhandle. Here's the log:
Run from C:\Documents and Settings\Donal\My Documents\Downloads\maxhandle.exe on 26/02/2010 at 14:55:14.71
hmm,
this is a very stubborn infection to kill.
let's try this:
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Copy/paste the text inside the Codebox below into notepad:
Here's how to do that:
Click
Start > Run type
Notepad click
OK.
This will open an empty notepad file:
Copy all the text
inside of the code box -
Press Ctrl+C (or right click on the highlighted section and choose 'copy')
FCopy::
c:\windows\ServicePackFiles\i386\netbt.sys | c:\windows\system32\dllcache\netbt.sys
c:\windows\ServicePackFiles\i386\netbt.sys | c:\windows\system32\drivers\netbt.sys
File::
C:\WINDOWS\system32\config\8monrowg.sav
Now
paste the copied text into the open notepad - press
CTRL+V (or right click and choose 'paste')
Here's how to do that:
1.Click
File ;
2.Click
Save As … Change the directory to your
desktop ;
3.Change the
Save as type to
"All Files";
4.Type in the file name:
CFScript
5.Click
Save …
[external image: Posted Image]
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Try that again,
then post a fresh maxhandle log
Uh oh.[…] PAGE_FAULT_IN_NONPAGED_AREA )
OKcopy C:\i386\netbt.sys c:\windows\system32\drivers\netbt.sys copy C:\i386\netbt.sys c:\windows\system32\dllcache\netbt.sys exit , to exit the recovery console
When I type that and press enter it saysAccess is denied
When I restart after the BSOD one of the options I'm given is to start Windows in the Last Known Good Configuration (your most recent settings that worked) . Should I try this?
OK
lets try this first
still in recovery console:
At the command prompt, type the following command and press Enter:
disable netbt
Note the startup type, it should be service_demand_start
if it disables - then try the copy commands from before
then exit and try rebooting
yes,
if that doesn't work try last known good configuration
the startup type was SERVICE_SYSTEM_START AND IT WAS CHANGED TO SERVICE_DISABLED
OK
go back into the Recovery console and try this command:
copy c:\windows\system32\dllcache\netbt.sys c:\windows\system32\drivers\netbt.sys
press enter
then type exit and give normal boot a try
Phew…
OK that worked, was able to boot normally. Waiting to run maxhandle again now. Thanks
OK good
this infection has really got a hold of those drivers, we'll see if this has finally got it
