Malware generating random number.exe cant run any malware soft

ComboFix second link was able to do a Reduced Functionality scan and report. Tthe file from the first link would not scan.

Reduced functionality isn't ideal, but it's better than not running at all. Give me a bit to analyze the log. I'll be back to you as soon as I can.

Now that Combofix removed some files (in the reduced functionality mode) let's try running the current version again and see if it works ok now.

Please right-click and delete any copies of Combofix from your desktop (including the renamed one).



Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

Combofix asks to be updated to a newer version then hangs at the 10min screen.

Please delete all copies of Combofix from your desktop. Then download from This Link specifically . Please do not use any other link than this one. Be sure your Lavasoft Ad-Watch is complete turned off and run as per the previous instructions please and let me know the results.

I am getting the same stuck on blue 10 minute screen with any link or version of combofix whether I am in Normal or Safe modes. Am i doing something wrong?

Have you ensured you are not doing anything else on the computer while it is running? You should make sure that your internet and all other programs are closed and Combofix is the only thing running so that nothing causes it to stall. I have seen Combofix take 30-45 minutes to run in some cases and I just want to be sure we aren't jumping the gun on thinking it's stuck. (It may also reboot the machine and that is perfectly normal and ok). Have you let it run for at least 45 minutes yet? If not let's give that a try and see if it gets any further. Just start it and go off and watch TV or something for a little while and then check it. Even if it hasn't finished running by that time, it should be obvious if it is making it's way through the necessary stages of the scan. If there is any progress at all, please just let it go and give it longer to finish. If it's still on the exact same screen come back and let me know. I do appreciate your patience. I know this must be terribly frustrating for you. I assure you that Combofix is the most efficient means of addressing this infection, but it needs to run properly and fully for us to be able to start getting rid of the files that are causing the problems.

okay combofix did something different now. A message and a beep came up saying ComboFix - ZeroAccess "You are infected with Rootkit.Zero.Access. It has inserted itself into the tcp/ip stack. then it went away and said combofix has found a rootkit and must restart. upon restart fatal system error blue screen.

okay ran startup repair and got back into normal boot mode and combofix pops up before anything else and starts running..all the way to 50 and then it started saying access denied… and closed and rebooted.

tried to run combofix again and its says "Combofix has detected the presence of rootkit activity and needs to reboot the machine"

Just to give you a little background on why we are having so many roadblocks on this - Zero access is a very challenging infection because it affects each machine a little differently. It's made up of several components, all of which need to be cleared, or the infection simply comes back by infecting different files. Since each machine manifests the infection differently, it's a tough rootkit to clean and it can take many steps to fully eradicate it.

We are going to take a different approach here and see if we can make some headway.

Download Farbar Recovery Scan Tool and save it to a flash drive.

Plug the flashdrive into the infected PC.

Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer

Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.

In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.

• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe and press Enter.

Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Uncheck the Whitlelist boxes next to Registry, Services, Drivers, and known DLL's
• Place a check next to List Drivers MD5
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

I'm going to go offline for the evening in a few minutes. I will take a look at the log tomorrow and respond back then. In the mean time, please be patient. Please don't run any other tools aside from the one I just noted, as it can make it more difficult to clean and can further complicate things when files start changing and disappearing.

successfully ran combofix and rebooted

There is a folder that I am concerned about in your logs and I just want to touch base with you on it. It is for a program that appears to be called Cracklock. Is this something that you have knowingly installed on the system?

If so, just let me know. If not, please do not do anything to remove it - I just needed clarification at this point.

Also, please do not run any other tools until you hear back from me.

Thanks!

Yes CrackLock is a program I knowingly installed.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\system32\c_44374.nl_
c:\windows\system32\drivers\92184235.sys
c:\windows\system32\drivers\tskCB89.tmp
c:\windows\system32\drivers\utiymje4.sys
c:\windows\system32\drivers\91912406.sys
c:\windows\system32\drivers\62361770.sys

DirLook::
c:\windows\system32\%APPDATA%

Driver::
utiymje4
17703796
58010134

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe. ComboFix may request an update; please allow it.

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.