[Resolved] Slooowww computer, keeps freezing - can't get it cleane

Hi,

Please do the following:

highlight and copy the contents of the code box below.

@echo off
echo please wait
reg delete HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List /v 9272:TCP /f
reg delete HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List /v 65533:TCP /f
reg delete HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List /v 52344:TCP /f
reg delete HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List /v 2479:TCP /f
reg delete HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List /v 3389:TCP /f
reg delete HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List /v 4883:TCP /f
attrib -r -h -s %systemdrive%\docume~1\HelpAssistant\* /s /d
del /f/s/q %systemdrive%\docume~1\HelpAssistant\*.*
rmdir /s/q %systemdrive%\docume~1\HelpAssistant
rmdir /s/q %systemdrive%\docume~1\HelpAssistant.FAMILYDELL
if exist %systemroot%\system32\termsrv32.dll del /q %systemroot%\system32\termsrv32.dll
exit
cls

Click Start>Run and type cmd then hit Enter to open a command window.
Right click in the command window and select paste.
Wait for the command window to close, then restart the machine once more.

Now click Start>Run and type helpasst -cleanup then hit Enter.

Browse for a little bit, then run the helpasst -mbrt command again in the run box (Start >run > type in the command > OK) to get a status report - post the log.

Good morning!

This went well. Logged in to read your message. Disconnected from Internet. Ran the code - Restarted, not a powerdown, but a restart.
Re-connected to Internet - Ran cleanup. Browsed for about 20 minutes with no problems.
Ran mbrt. Still no problems, but see there may still be an infection.

Log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Wed 03/10/2010 at 10:01:44.92

Full Name Remote Desktop Help Assistant Account
Account active Yes
Local Group Memberships *Administrators
The command completed successfully.

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89547B48]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\iaStor -> 0x89547b48
NDIS: Intel® PRO/1000 MT Network Connection -> SendCompleteHandler -> 0x894f2330
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

~~ Checking for termsrv32.dll ~~

termsrv32.dll was not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking for HelpAssistant directories ~~

~~ HelpAssistant directories found! ~~

HelpAssistant.FAMILYDELL.000

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"=65533:TCP:*:Enabled:Services
"52344:TCP"=52344:TCP:*:Enabled:Services
"2479:TCP"=2479:TCP:*:Enabled:Services
"4883:TCP"=4883:TCP:*:Enabled:Services


~~ EOF ~~

This thing just refuses to die doesn't it

I think we are going to have to get into the Recovery Console to kill it.

We need to remove the recovery console that isn't being recognized right now and let combofix reinstall it again.

Please do the following:

I suggest printing these instructions out:

Please do the following:
removed instructions


NEXT

Delete the copy of ComboFix that you have on your desktop.

Download a fresh copy from the link below

Link 1

Make sure all other windows are closed and that you have an active internet collection so ComboFix can install the Recovery Console.

Make sure your security programs are disabled before you run ComboFix.

Allow ComboFix to complete even though it may appear to have stalled, as it does take longer than you think it should to run and create a log.

An aside question - Does your computer run hot? Do you clean it from dust and debris regularly?

I like the brick wall! Yeah, I keep on thinking, I'VE DONE THAT ALREADY! And just when I feel like I know what I'm doing, you tell me something simple that I can't figure out. OK - finished 2 & 3. #4. I have users set up for each family member. We are all administrators, we just wanted different browser favorites. I can't see how to log in as a LOCAL ADMINISTRATOR. So logged in as just myself - and as the MOM I have all the POWER, I cannot delete that cmdcons folder. It gives me an error message and that "Cannot delete 1394BUS.sys ACCESS is denied. Make sure disk is not full or write-protected and that the file is not currently in use." ANd when I go into the folder to delete files individually - it says this for every file in there. Sorry. How do I log in as a super user or super administrator? There aren't any choices on the login menus. I tried going into safe mode, but that doesn't do it either. Elementary question, I know.

Hi, Try this instructions removed

Nope. I tried to delete them as unchecked read-only and as read-only but neither one allowed me to delete them! On the other hand - I have not frozen this PC for hours! That's an improvement. And to answer an old question, this PC is in the basement - it is pretty chilly, but even so it does not feel warm to the touch. Vacuum regularly? Hmm - it's been about 6 months. I can do that tonight. We got a new puppy about a year ago and she does shed more than our last dog. And those hairs get sucked right into the computer. It really doesn't seem so bad right now. But this beast is an old one. It's still really fast, when it is not infected and it's great for all our i-tunes and other stuff. Daughter is going to college in a year and a half so will need a new laptop for that - and would like to keep this one limping along. 2 kids in college = no money. Sara

Hi,

Please go to Start > Run > type in cmd > OK to open a command window


copy/paste the following text inside the code box into the open window > press enter

@echo off
 code removed

once done > type exit to close the command window:

that should delete those folders for you.


before you have combofix download and install a new recovery console, please run this reg query for me:

go to start > run > type cmd into the run box to open a command window


copy/paste the following into the open window > press enter

reg query HKLM\SYSTEM\CurrentControlSet\Control\hivelist | findstr /i "helpassistant" >log.txt
start notepad log.txt
exit
cls

post the content of log.txt in your next reply (let me know if the log is empty

I don't think that script worked. I let it run for about 20 minutes - but when I checked for it, the cmdcons folder was still there. The script runs through every line but just sits and blinks at the last line. I'm not sure if it is done or not. It does not return a c:\ prompt at the end. I ran it three times - I'll run it again and let it sit until you respond. But the second time I ran it, the computer froze. I did run that second cmd script and it said that the log.txt did not exist, I hit yes to create it and it came up blank.

OK,

Please run this


Go to Start > Run > type in cmd to open a command window

Copy/paste the following command into the open window > press enter:

code removed

post the content of log.txt in your next reply

Here you go: cmdcons Everyone:(OI)(CI)(DENY)(special access:) DELETE FILE_WRITE_DATA FILE_APPEND_DATA FILE_DELETE_CHILD BUILTIN\Administrators:F BUILTIN\Administrators:(OI)(CI)(IO)F NT AUTHORITY\SYSTEM:F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F FAMILYDELL\Sara Byron:F CREATOR OWNER:(OI)(CI)(IO)F BUILTIN\Users:R BUILTIN\Users:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE BUILTIN\Users:(CI)(special access:) FILE_APPEND_DATA BUILTIN\Users:(CI)(special access:) FILE_WRITE_DATA

Hi,

This should resolve the permission issue


Please go to Start > Run > type in cmd to open a command window


copy / paste the following text inside the code box into the open window > Press enter

make certain the folder is now deleted, then continue on with ComboFix

@echo off
removed

There is a sub folder, under cmdcons, called system32 with 2 files in it that will not delete. Can we change the permissions on those also? So, C:\cmdcons\SYSTEM32 The files are: NTDLL.DLL and SMSS.

Hi,

Let's get a look at the permissions on that subfolder first

Go to Start > Run > type in cmd > OK > to open a command window

Copy/Paste the following into the command window:

removed

Post the results in your next reply

Permissions on subfolders: C:\cmdcons\SYSTEM32 Everyone:(OI)(CI)(DENY)(special access:) DELETE FILE_WRITE_DATA FILE_APPEND_DATA FILE_DELETE_CHILD BUILTIN\Administrators:F BUILTIN\Administrators:(OI)(CI)(IO)F NT AUTHORITY\SYSTEM:F NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F FAMILYDELL\Sara Byron:F CREATOR OWNER:(OI)(CI)(IO)F BUILTIN\Users:R BUILTIN\Users:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE BUILTIN\Users:(CI)(special access:) FILE_APPEND_DATA BUILTIN\Users:(CI)(special access:) FILE_WRITE_DATA C:\cmdcons\SYSTEM32\NTDLL.DLL Everyone:(DENY)(special access:) DELETE FILE_WRITE_DATA FILE_APPEND_DATA FILE_DELETE_CHILD BUILTIN\Administrators:F NT AUTHORITY\SYSTEM:F FAMILYDELL\Sara Byron:F BUILTIN\Users:R C:\cmdcons\SYSTEM32\SMSS.EXE Everyone:(DENY)(special access:) DELETE FILE_WRITE_DATA FILE_APPEND_DATA FILE_DELETE_CHILD BUILTIN\Administrators:F NT AUTHORITY\SYSTEM:F FAMILYDELL\Sara Byron:F BUILTIN\Users:R A C:\cmdcons\SYSTEM32\NTDLL.DLL A C:\cmdcons\SYSTEM32\SMSS.EXE

Hi,

Please do the following:

Please go to Start > Run > type in cmd to open a command window


copy / paste the following text inside the code box into the open window > Press enter

make certain the folder is now deleted, then continue on with ComboFix

@echo off
removed