What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Slooowww computer, keeps freezing - can't get it cleane

55 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Hi, your external burner will work fine.

Once you get the Hiren's boot cd burned,
Start the BootCD at the Hiren's menu.

At the utilities menu, select #6 Hard Disk Tools.

Now select #1 HDD Regenerator.

While loading it, a menu or 2 will pop up with Auto preselected - don't click anything - allow it to continue loading.

Once loaded it should detect the hard drive - press Enter to continue.

At the HDD Regenerator main menu, select #1 Scan and Repair, then hit Enter.


Hit Enter again when prompted for Starting Sector.


Now walk away and check it from time to time - it may take hours and hours to complete.


Once complete, exit and restart the machine by pressing Ctrl+Alt+Del


When the Hiren's boot menu loads again, select MiniXP then let me know when it's fully loaded and we'll continue.
Post #32
Hello again! I'm back - had to make dinner, borrow the neighbor's CD burner (my DVD burner only makes DVD's), the other car pool driver canceled - so I had to drive my daughter to Irish dance (St. Patrick's day is almost here!) Then the dog threw up all over the kitchen ahd to take her to the ER vet - got home at about 1 AM. (SHe had evidently eaten some curling ribbon from a birthday present, and it was obstructing her digestive system. $350 later . . . Had to get daughter up early for her first High School radio show program and so I have JUST NOW finished making this boot CD. I booted to the mini Windows XP sucessfully and then read that I should have gone somewhere else. Re-booted to BootCD - Ran the scan, and it found and recovered 7 bad sectors. re-boot to Mini Windows XP - And that went fine - so now what? Whew. I didn't have any faith that this would work. Glad it did!
Post #33
Hi,

Sorry to hear about your day, I wasn't have a good one myself either, but I guess that's what makes life interesting!!


Now that you are back into MiniXP we need to look for the existence of your boot.ini file

Navigate to the C:\ drive and look for the boot.ini configuration file.

Double click the "My Computer" Icon > Click C:\ Local Disk

[attachment removed]


If it does not exist then look for the boot.bak file

if boot.ini DOES NOT exist but boot.bak DOES then right click on book.bak and choose to rename it.

Rename boot.bak to boot.ini

exit and try and boot normally.


If boot.ini does exist we need to get a look at it to see what it says.


So right click on "My Computer" (in the left side pane) > properties > click the Advanced tab > click the "Settings" button under Startup and Recovery > under System Startup click the "Edit" button


That should open up a notepad document with the heading boot.ini.

In the boot.ini file, you should see something that looks like this:

[boot loader]
timeout=4
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect


If it doesn't look like that then edit it so that it does > save the changes


Now exit the Hiren's boot CD and see if you can boot into Windows normally.
Post #34
Hopefully we will all have a good weekend! Both boot.ini and boot.bak are there. Boot.bak is dated 10/2004! Yikes. Notepad says that boot.ini is not a editable file - and there is nothing in it. I will look at the bak file. It looks a lot like yours - so I edited boot.ini to be exactly like yours. Tried to re-boot, and I now get that menu with the Recovery Console option on it - and then it boots to an error message that says there is a hardware configuration error. I'm going to try to copy the boot.bak into the boot.ini and try to boot from that. AND the winner is: the boot.bak - and I am now back to the log in screen of my PC! Woo-hoo. Now - I can't remember what we were doing when we spiraled into this abyss of corruption. I'll go back and read - and perhaps you can decide where we go from here. Thanks you so much for all this. I think I'm learning a lot too.
Post #35
so can you confirm that you can log in normally,

Did you try and can you successfully boot into the recovery console should we need to?

that your programs work and there are no obvious issues.

Let's see where we stand with this infection:

run the batch, then run DDS and GMER, so we can get an analysis of where we are now:

Go to Start > Run > type in Cmd > OK

a command window will open

copy/paste the following text inside the quote box into the command window:

net user HelpAssistant>%temp%\temp0
start notepad %temp%\temp0
exit
cls



a Notepad will pop open


please post the contents of the notepad in your next reply


NEXT

Delete the copies of the programs on your desktop,
I'll give you fresh ones to download:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT

For this gmer program,

uncheck the box beside files as well and close any open programs, disable all security programs


If it makes your computer freeze - do not do a hard shutdown use Ctrl + Alt + Del to end the process.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #36
1. Again, sorry for the delay. I'm not sure if I will be able to complete the tasks as you have requested, as the computer keeps on freezing. It's taken me four tries to get this far in this message. I freezes up more when connected to the internet. Now I'm on the my netbook - and I'll do what I can manually on the desktop. I can login fine, everything looks like it should. However, when I f8 into safe mode, only XO OS comes up as a choice, there is not a choice for the Recovery Console. I do still have that Hirens boot CD - doesn't it have a recovery console on it? 2. I ran the CMD script and am moving the results between PCs via usb drives. User name HelpAssistant Full Name Remote Desktop Help Assistant Account Comment Account for Providing Remote Assistance User's comment Country code 000 (System Default) Account active Yes Account expires Never Password last set 3/8/2010 11:50 AM Password expires Never Password changeable 3/8/2010 11:50 AM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 3/8/2010 11:50 AM Logon hours allowed All Local Group Memberships *Administrators Global Group memberships *None The command completed successfully. 3. I have been using Firefox as my browser, but I thought I'd try explorer since the PC keeps freezing - maybe it is firefox that is doing it. But I can't get explorer to load. It flashes on the screen and then closes very quickly. I have task manager open so I see it appear and then close. Just an FYI. I'm not sure what is important for me to tell you. 4. I logged into whatthetech via firefox browser. I downloaded dds and GMER and then unplugged the internet connection. I think I can avoid hard shutdowns this way. We'll see. So, mving files via USB drive: DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 13:46:30.10 on Mon 03/08/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1512 [GMT -6:00] AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\UAService7.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\System32\MsPMSPSv.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\SpywareGuard\sgmain.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\system32\taskmgr.exe C:\Documents and Settings\Sara Byron\Desktop\dds.com ============== Pseudo HJT Report =============== uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://member.square-enix.com/na/ mSearch Bar = uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\4608\SiteAdv.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File TB: AIM Search: {40d41a8b-d79b-43d7-99a7-9ee0f344c385} - TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [WebDriveTray] c:\program files\netdrive\netdrive.exe /trayicon mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [pdfFactory Dispatcher v2] "c:\windows\system32\spool\drivers\w32x86\3\fppdis2a.exe" /source=HKLM mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" StartupFolder: c:\docume~1\saraby~1\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\Hotsync.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\1.0.150\SSScheduler.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe IE: &AIM Search - c:\program files\aim toolbar\AIMBar.dll/aimsearch.htm IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000 LSP: c:\program files\common files\is3\anti-spyware\iS3lsp.dll DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1212589685328 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124298262359 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\4608\SiteAdv.dll Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\saraby~1\applic~1\mozilla\firefox\profiles\sayrjs30.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxps://www.ravelry.com/account/login|https://webauth.att.net/auth/webmail/login?action=Login&url=http%3A%2F%2Fwebmail.att.net%2Fwmc%2Fv%2Fwm%2F49B4A62800082B1E00002C2F2223070362%2F%3Fcmd%3DList%26sid%3Dc0|http://www.voy.com/33031/|http://central.hinsdale86.org/Daily%20Announcements/Forms/AllItems.aspx|http://mail.google.com/mail/?source=navclient-ff&zx=1w0tkde3j7rys&shva=1#inbox|http://www.facebook.com/login.php?v=1.0&api_key=e004be66908863e93f45ec5853daecba&next=%3Faction%3Dseal%26id%3D856664843%26skip%3D856664843&canvas|http://www.atlasquest.com/people/profile.html|http://www.hcbands.org/|http://www.fiberfarm.com/blog FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FF - plugin: c:\documents and settings\madeleine jeffers\application data\move networks\plugins\npqmp071503000010.dll FF - plugin: c:\documents and settings\sara byron\application data\mozilla\plugins\npPxPlay.dll FF - plugin: c:\progra~1\palm\packag~1\NPInstal.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npImgCtl.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R0 MDPMGRNT;MDPMGRNT;c:\windows\system32\drivers\MDPMGRNT.SYS [2005-7-20 24320] R0 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [2008-10-8 49664] R1 MDFSYSNT;MDFSYSNT;c:\windows\system32\drivers\MDFSYSNT.SYS [2006-9-13 213888] R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2006-10-20 214664] R2 DVDAccss;DVDAccss;c:\windows\system32\drivers\DVDAccss.sys [2008-12-3 29156] R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-11-10 359952] R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2006-10-20 144704] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-4-10 24652] R2 WebDriveFSD;WebDrive File System Driver;c:\program files\netdrive\rffsd.sys [2005-9-23 67032] R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2006-10-20 606736] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2006-10-20 79816] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2006-10-20 35272] R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2006-10-20 40552] S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys –> c:\program files\superantispyware\SASKUTIL.sys [?] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2006-10-20 34248] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2006-2-16 4096] S4 RFNP32;WebDrive Provider; [x] =============== Created Last 30 ================ 2010-03-03 03:22:05 0 dc—-w- C:\HelpAsst_backup 2010-03-02 01:33:23 98816 —-a-w- c:\windows\sed.exe 2010-03-02 01:33:23 77312 —-a-w- c:\windows\MBR.exe 2010-03-02 01:33:23 261632 —-a-w- c:\windows\PEV.exe 2010-03-02 01:33:23 161792 —-a-w- c:\windows\SWREG.exe 2010-02-27 00:57:22 8704 –sha-w- c:\windows\Thumbs.db 2010-02-25 16:29:06 0 d—–w- c:\program files\common files\Innovative Solutions 2010-02-25 16:29:03 47984 —-a-w- c:\windows\system32\AdvUninstCPL.cpl 2010-02-25 16:29:03 0 d—–w- c:\docume~1\alluse~1\applic~1\Innovative Solutions 2010-02-15 22:31:41 0 dc-h–w- c:\windows\ie8 ==================== Find3M ==================== 2010-02-25 21:26:47 128728 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT 2010-01-07 22:07:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 22:07:04 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2009-12-31 16:50:03 353792 ——w- c:\windows\system32\dllcache\srv.sys 2009-12-21 13:19:18 173056 ——w- c:\windows\system32\dllcache\ie4uinit.exe 2009-12-16 18:43:27 343040 —-a-w- c:\windows\system32\mspaint.exe 2009-12-16 18:43:27 343040 ——w- c:\windows\system32\dllcache\mspaint.exe 2009-12-14 07:08:23 33280 —-a-w- c:\windows\system32\csrsrv.dll 2009-12-14 07:08:23 33280 ——w- c:\windows\system32\dllcache\csrsrv.dll 2009-12-11 08:38:55 69120 ——w- c:\windows\system32\dllcache\iecompat.dll 2009-12-09 05:53:44 726528 —-a-w- c:\windows\system32\dllcache\jscript.dll 2003-08-27 20:19:18 36963 -c–a-r- c:\program files\common files\SM1updtr.dll 2009-04-27 12:58:21 49152 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009042720090428\index.dat 2009-04-28 09:43:20 49152 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009042820090429\index.dat 2009-05-04 01:36:55 49152 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009050320090504\index.dat ============= FINISH: 13:47:26.10 =============== 5. I was just waiting for something on my netbook - glanced at the task manager running on the infected PC - and saw a process flash on the task manager screen - it ws called SpyFader. It flashed by and then disappeared. Another FYI. 6. I've zipped the attach file and will attach it somehow. 7. GMER is next. I closed the task manager. Ran GMER. It's going now - Last time it took 13 hours, so I'm going to post this and the attack.zip and finish the GMER post later. Just so you know that I didn't disappear. And this gives me the chance to ask if running these tasks offline is going to be adequate. Thanks!

Attachments:

Post #37
Hi,

Yes that's fine

You still have the MBR infection. You can cancel GMER if you wish.

I have the information I need.

The developer of HelpAsst_mebroot_fix. has updated the tool

I think we should give the newest version a try:

Please do the following:

Delete the copy of HelpAsst_mebroot_fix.exe that you have on the desktop.


Please download HelpAsst_mebroot_fix.exe and save it to your desktop.
Close out all other open programs and windows.
Double click the file to run it and follow any prompts.

If the tool detects an mbr infection, please allow it to run mbr -f and shutdown your computer.
Upon restarting, please wait about 5 minutes, click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !

When it completes, a log will open.

Please post the contents of that log.
Post #38
Great that I don't have to wait for that MBER.

When I stopped the MBER, reconnected the internet, opened firefox, the PC did a physical memory dump. I did a hard shutdown and rebotted and then did a graceful reboot once more. FYI.

Help asst ran without much intervention and did not do a shutdown. Here is the report:

C:\Documents and Settings\Sara Byron\Desktop\HelpAsst_mebroot_fix.exe
Mon 03/08/2010 at 15:38:49.71

HelpAssistant account was found to be Active ~ attempting to de-activate

Full Name Remote Desktop Help Assistant Account
Account active Yes
Local Group Memberships *Administrators
The command completed successfully.

HelpAssistant account successfully set inactive
termsrv32.dll found ~ attempting to remove
Remove on reboot: C:\WINDOWS\system32\termsrv32.dll
HelpAssistant profile found in registry ~ backing up and removing S-1-5-21-1117699391-305849530-2431133585-1007
HelpAssistant profile directory exists at C:\Documents and Settings\HelpAssistant.FAMILYDELL ~ attempting to remove

~ All C:\Documents and Settings\HelpAssistant.FAMILYDELL files successfully removed ~

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Mon 03/08/2010 at 15:57:56.07

Full Name Remote Desktop Help Assistant Account
Account active No
Local Group Memberships
The command completed successfully.

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89253B88]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\iaStor -> 0x89253b88
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x894ea330
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

~~ Checking for termsrv32.dll ~~

termsrv32.dll present!


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking for HelpAssistant directories ~~

~~ HelpAssistant directories found! ~~

HelpAssistant

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9272:TCP"=9272:TCP:*:Enabled:Services
"3389:TCP"=3389:TCP:*:Enabled:Remote Desktop
"65533:TCP"=65533:TCP:*:Enabled:Services
"52344:TCP"=52344:TCP:*:Enabled:Services
"2479:TCP"=2479:TCP:*:Enabled:Services
"4883:TCP"=4883:TCP:*:Enabled:Services


~~ EOF ~~
Post #39
OK, I'm going to post your results to the developer to review as well, you seem to have a very stubborn case, just so we don't run into issues again, I want him to have input into our next steps. I'm not sure if you tried this previously, but did you try to access the Recovery console from your installation CD? or did you not get that far before the computer crashed? I'll be back as soon as possible with further instructions, if you could just answer the Recovery Console question. Thanks
Post #40
Hi,

Please do the following:


Go to Start > Run > copy/paste the bolded text into the open run box > hit OK

helpasst -cleanup


then reboot.


Browse for a bit (10-15 min)

Advise, if you are getting redirected, and note how your computer is running, then do the following:


Go to Start > run > copy/paste the bolded text into the open run box > hit OK


helpasst -mbrt


When completed a log should pop open for you - please post the resulting log in your next reply.
Post #41
OK! Here we go! We did not ever get to thepoint to boot from the OS CD and see if the recovery console was there or not. So, I did that earlier and there is a choice called ASR - or Automated System recovery. I booted to it and the PC froze.

But I proceeded with your tasks anyway and here is the log:


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Mon 03/08/2010 at 20:18:26.96

Full Name Remote Desktop Help Assistant Account
Account active Yes
Local Group Memberships *Administrators
The command completed successfully.

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89563A50]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\iaStor -> 0x89563a50
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x89449330
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

~~ Checking for termsrv32.dll ~~

termsrv32.dll was not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking for HelpAssistant directories ~~

~~ HelpAssistant directories found! ~~

HelpAssistant
HelpAssistant.FAMILYDELL

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9272:TCP"=9272:TCP:*:Enabled:Services
"3389:TCP"=3389:TCP:*:Enabled:Remote Desktop
"65533:TCP"=65533:TCP:*:Enabled:Services
"52344:TCP"=52344:TCP:*:Enabled:Services
"2479:TCP"=2479:TCP:*:Enabled:Services
"4883:TCP"=4883:TCP:*:Enabled:Services


~~ EOF ~~


But I just re-read the directions and I forgot to browse for a bit. - I'll go do that now. See if you see anything

And I just had a computer freeze and it returned me to this spot - I'm posting this before I lose it.
Post #42 last edited
Hi


Please do the following

Please physically disconnect from the internet

run the HelpAsst_mebroot_fix.exe tool once again.


Once it completes please do the following:

Go to Start > Run copy/paste the following bolded command into the run box > hit OK


mbr -f

Repeat that command one more time

Go to Start > Run copy/paste the following bolded command into the run box > hit OK


mbr -f




Now shutdown the computer.


Leave the computer off for at least one minute, then restart, reconnect, browse for a little bit - note how the computer behaves


then Go to Start > Run copy/paste the following bolded command into the run box > hit OK

helpasst -mbrt

Please post the resulting log.
Post #43
Ok - this took longer than I meant it to and it is a fail. I disconnected the internet PHYSICALLY, as I always do - and tried to run HelpAsst_mebroot_fix.exe. I got an error message of "HelpAssistant account does not exist". So, I deleted the file, re-downloaded the last link to this that you provided. Did a reboot, then a power down reboot and tried again and got the same error message. I think I saw somewhere in one of the reports that you had me run, that it did delete the HelpAssistant files. Is there another one that I shoudl try? Between all this, there were many re-boots, but one long period, while not connected to the internet when it stayed up for almost 45 minutes. If I have the task manager open I can see when the CPU % usage stops running and I know that I am frozen again.
Post #44
Did you continue on with the other instructions to run the mbr -f command? If you didn't, please continue with the complete instructions from my previous post
Post #45
No, I had not continued at that point. So, I've gone back.

Restarted PC
Re-ran the Help Asst_mebroot_fix.exe. This time it took much longer and seemed to have run. Did not get that error message that I got twice before. Go figure. Ended with Help.Assistant.FAMILYDELL.000 removed.

I did a complete shutdown.

Restarted. Plugged into Internet. Browsed for about 20 minutes successfully - then PC froze.

Did a hard shutdown & restarted. logged in - did another restart, and then ran helpasst -mbrt.

C:\Documents and Settings\Sara Byron\Desktop\HelpAsst_mebroot_fix.exe
Tue 03/09/2010 at 23:48:25.99

HelpAssistant account was found to be Active ~ attempting to de-activate

Full Name Remote Desktop Help Assistant Account
Account active Yes
Local Group Memberships *Administrators
The command completed successfully.

HelpAssistant account successfully set inactive
termsrv32.dll found ~ attempting to remove
termsrv32.dll successfully removed

HelpAssistant profile found in registry ~ backing up and removing S-1-5-21-1117699391-305849530-2431133585-1007
HelpAssistant profile directory exists at C:\Documents and Settings\HelpAssistant.FAMILYDELL.000 ~ attempting to remove

~ All C:\Documents and Settings\HelpAssistant.FAMILYDELL.000 files successfully removed ~

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Wed 03/10/2010 at 0:36:44.70

Full Name Remote Desktop Help Assistant Account
Account active No
Local Group Memberships
The command completed successfully.

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8956EA08]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\iaStor -> 0x8956ea08
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x894fd330
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

~~ Checking for termsrv32.dll ~~

termsrv32.dll was not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking for HelpAssistant directories ~~

~~ HelpAssistant directories found! ~~

HelpAssistant
HelpAssistant.FAMILYDELL

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9272:TCP"=9272:TCP:*:Enabled:Services
"3389:TCP"=3389:TCP:*:Enabled:Remote Desktop
"65533:TCP"=65533:TCP:*:Enabled:Services
"52344:TCP"=52344:TCP:*:Enabled:Services
"2479:TCP"=2479:TCP:*:Enabled:Services
"4883:TCP"=4883:TCP:*:Enabled:Services


~~ EOF ~~

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI