What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Please Help!

36 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
This post was edited because I ran the OTL when I was online. It's late here on the east coast so I'll rerun it properly tomorrow. Thank you SOOOOOOOOOOO much for your help! :notworthy: I can already see that my computer is much quicker!
Post #17
OTL: netsvcs %SYSTEMDRIVE%\*.exe /md5start eventlog.dll scecli.dll netlogon.dll cngaudit.dll sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys nvrd32.sys symmpi.sys adp3132.sys mv61xx.sys /md5stop %systemroot%\*. /mp /s CREATERESTOREPOINT %systemroot%\system32\*.dll /lockedfiles %systemroot%\Tasks\*.job /lockedfiles %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav
Post #18
HAMeb_Check Scan

Re-Run the HAMeb_check.exe tool that you should already have downloaded to your computer.

Double Click on the tool to run it and post the contents of the resulting log.



NEXT:



It looks like the contents of your latest post were the Custom Scan items that I included in my first post.

Try the following set of instructions for re-running OTL.

Re-Running OTL
  • Please double click on the OTL icon which should be located on your desktop. This will run OTL. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open up a notepad window called OTL.txt.
    Note: This log can be located in the OTL folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt file, and post it with your next reply.


NEXT:



Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that was produced after running the HAMeb_check.exe scan.
3. The log that was produced after running the new OTL scan.
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #19
HAMeb:

C:\Documents and Settings\Jodi\Desktop\HAMeb_check.exe
Sat 03/13/2010 at 11:37:54.70

Full Name Remote Desktop Help Assistant Account
Account active Yes
Local Group Memberships *Administrators

~~ Checking profile list ~~

S-1-5-21-3533875668-1734397294-677057713-1005
%SystemDrive%\Documents and Settings\HelpAssistant.D894GL61.000

~~ Checking for HelpAssistant directories ~~

HelpAssistant
HelpAssistant.D894GL61
HelpAssistant.D894GL61.000

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x82C2BBA8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x82c2bba8
NDIS: Intel® PRO/100 S Server Adapter -> SendCompleteHandler -> 0x8263f690
Warning: possible MBR rootkit infection !
copy of MBR has been found in sector 0x094FE9BD
malicious code @ sector 0x094FE9C0 !
PE file found in sector at 0x094FE9D6 !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

~~ Checking for termsrv32.dll ~~

termsrv32.dll present!


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\termsrv32.dll

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"=65533:TCP:*:Enabled:Services
"52344:TCP"=52344:TCP:*:Enabled:Services
"2479:TCP"=2479:TCP:*:Enabled:Services
"3246:TCP"=3246:TCP:*:Enabled:Services
"3389:TCP"=3389:TCP:*:Enabled:Remote Desktop
"4100:TCP"=4100:TCP:*:Enabled:Services
"1944:TCP"=1944:TCP:*:Enabled:Services
"6021:TCP"=6021:TCP:*:Enabled:Services
"7021:TCP"=7021:TCP:*:Enabled:Services
"4835:TCP"=4835:TCP:*:Enabled:Services
"6366:TCP"=6366:TCP:*:Enabled:Services


~~ EOF ~~
Post #20
desertbeach,

We still have work to do.

Hold up on running the OTL scan until after you've performed these instructions:

Please make sure you follow the instructions in the ordered posted and post the logs that are produced after running them.


Makes sure that you still have this tool: HelpAsst_mebroot_fix.exe downloaded to your computer. If you don't have it on your computer please re-download it.

Double click on the tool to run it.

Once the tool has completed running please do the following:

Click on Start > Run > type the following bolded command c:\mbr.exe -f then press OK

Once you've entered the above command you should see that a black box flashes on your screen for a few seconds and then should disappear shortly after appearing.

After the black box has disappeared please go ahead and reboot your computer.

After reboot, provide a fresh OTL log

Re-Running OTL
  • Please double click on the OTL icon which should be located on your desktop. This will run OTL. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open up a notepad window called OTL.txt.
    Note: This log can be located in the OTL folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt file, and post it with your next reply.


NEXT:



Then a new mbr log by going to Start > Run > type the following bolded command c:\mbr.exe -t then press OK

(the mbr log can be found wherever you saved the MBR.exe program to. In your case I asked you to save it to your root drive (C:)).
Post #21

desertbeach,

We still have work to do.

Hold up on running the OTL scan until after you've performed these instructions: I'm sorry, I didn't read this until I was done with the OTC Scan… however, it would not give me a txt file when it was done. So I logged in to ask you what to do and saw these new instructions.

Please make sure you follow the instructions in the ordered posted and post the logs that are produced after running them. I will.
I had to reboot because my computer locked up and the reboot was very slow to open up Fire Fox.
I am in the process of completing the next tasks.

Makes sure that you still have this tool: HelpAsst_mebroot_fix.exe downloaded to your computer. If you don't have it on your computer please re-download it.

Double click on the tool to run it.

Once the tool has completed running please do the following:

Click on Start > Run > type the following bolded command c:\mbr.exe -f then press OK

Once you've entered the above command you should see that a black box flashes on your screen for a few seconds and then should disappear shortly after appearing.

After the black box has disappeared please go ahead and reboot your computer.

After reboot, provide a fresh OTL log

Re-Running OTL

  • Please double click on the OTL icon which should be located on your desktop. This will run OTL. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open up a notepad window called OTL.txt.
    Note: This log can be located in the OTL folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt file, and post it with your next reply.


NEXT:



Then a new mbr log by going to Start > Run > type the following bolded command c:\mbr.exe -t then press OK

(the mbr log can be found wherever you saved the MBR.exe program to. In your case I asked you to save it to your root drive (C:)).

Post #22

I'm sorry, I didn't read this until I was done with the OTC Scan… however, it would not give me a txt file when it was done. So I logged in to ask you what to do and saw these new instructions.

Did you mean to say OTL scan rather than saying OTC scan.
Post #23

I'm sorry, I didn't read this until I was done with the OTC Scan… however, it would not give me a txt file when it was done. So I logged in to ask you what to do and saw these new instructions.

Did you mean to say OTL scan rather than saying OTC scan.


Yes, I did mean to say OTL.

I still had my HelpAsst mebroot fix.exe on my desktop so I clicked on it and it said… "Please wait" …and I did for about 5 mins. so I logged in to see if you want me to redownload it? My computer is running much slower now than when I first logged in today.
Post #25

Does HelpAsst mebroot fix.exe still say "please wait"?


Now it reads… "Help Asst account does not exist… press any key to continue".
Post #27

Press any key, and then continue with the instructions.

I do this but it just disappears. I've tried this a few times already.
Post #28
That is correct the HelpAsst_mebroot_fix.exe tool should disappear after you press a key on your keyboard.

You will need to proceed with these instructions next:
Click on Start > Run > type the following bolded command c:\mbr.exe -f then press OK

Once you've entered the above command you should see that a black box flashes on your screen for a few seconds and then should disappear shortly after appearing.

After the black box has disappeared please go ahead and reboot your computer.

After reboot, provide a fresh OTL log

Re-Running OTL
  • Please double click on the OTL icon which should be located on your desktop. This will run OTL. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open up a notepad window called OTL.txt.
    Note: This log can be located in the OTL folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt file, and post it with your next reply.


NEXT:



Then a new mbr log by going to Start > Run > type the following bolded command c:\mbr.exe -t then press OK

(the mbr log can be found wherever you saved the MBR.exe program to. In your case I asked you to save it to your root drive (C:)).

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI