No Internet Access Infected With XP Antivirus 2012

Hello InfoGeek

Please download a fresh copy of ComboFix and save it to C:\InfoGeek.com
Then, restart your computer and boot into Safe Mode (without networking)

To get into the Windows Safe mode, as the computer is booting keep tapping your "F8 Key" which should bring up the "Windows Advanced Options Menu" . Use your arrow keys to move to "Safe Mode" and press your Enter key.

Run ComboFix (InfoGeek.com) from there.

Please post the log back here.

Hello Sunyata
I'am sorry but i don't understand what you mean save combofix to C:\InfoGeek.com not to your desktop, or do you mean to a folder or do you mean rename it to something. Ran a search for C:\InfoGeek.com could not find it. Please explain what you mean to save c:\InfoGeek.com what is c:\InfoGeek.com, and how do i go about saveing combofix there. I'am thinking you mean save to c:\ but i do'not understand what is InfoGeek.com. So i need to know how to save to c:\InfoGeek.com Thank You.

Hello InfoGeek Sorry for the confusion. I mean to rename ComboFix.exe to InfoGeek.com and save it in the C:\ directory. This is to fool the malware. You just double-click InfoGeek.com once you are in safe mode and ComboFix will execute. Just perform a scan like in the previous ComboFix instructions.

Hello Sunyata Thank you for clearing that up for me. Will go ahead and do exactly what you say, Thank You.

Hello Sunyata I follow your instructions save combofix.exe as InfoGeek.com to C:\ directory. Than ran the scan for over 3 hours and nothing it once again just hang there. But for the first time a pop up box said your are infected with Rootkit. ZeroAccess in your ip/stack or something like that. This rootkit zeroaccess is blocking combofix no matter what we name it or were we save it to, it just can'not remove this malware. The malware will block it and will not allow combofix to remove it. So we can try something call avira rescuse system cd. hopeful this will remove it or somthing.

Hello InfoGeek

We are consulting with some malware experts on your particular infection to help us decide on a course of action for cleaning your machine.

In the meantime, we want to make sure that it is actually InfoGeek.com you are execution and not InfoGeek.com.exe:

• In Windows Explorer at the top click Tools, click Folder Options. Click the view tab and uncheck Hide extensions for known file types
• Click apply, click ok.
• Then have a look in the c:\ directory and make sure that it is in fact InfoGeek.com that you ran.

Also, that warning that you about ZeroAccess the last time you ran ComboFix appears just before the log is created.
Please look in the C:\ directory and also the C:\ComboFix directory to see if there is a CombFix.txt file.
If there is, please post it here

Hello InfoGeek

Assuming that InfoGeek.com is named correctly, this should work:

• Click Start > Run
• Copy and Paste the follwing line into the run box and click OK
  

  C:\InfoGeek /nombr

Hello Sunyata
I did exactly what you said by going to click then start -> run
and i copy and paste the follwing line into the run box and click OK c:\InfoGeek/nombr, combofix started scanning it took less then 30 minutes to complete. I'am posting a log form combofix. I went to Thank You so much for your help. Now for the next step do i run another malware removal tool or does the combofix log say that i'am malware free. 📎Combofix_log.txt_01_28_2012.txt By the way i did download and rename comboxfix to InfoGeek.com not InfoGeek.com.exe

Hello InfoGeek

We have a few more things to do to make sure your machine is clean. Please stay with us.

Next, let's get new OTL and New Gmer scans.

Please re-run OTL.

• If you are using Firefox, make sure that your download settings are as follows:
  

  -Tools->Options->Main tab
  -Set to "Always ask me where to Save the files".

• Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output
• Check the boxes beside LOP Check and Purity Check.
• In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
/md5stop

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open OTL.txt . This is saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents and post it with your next reply.



Next, download GMER from one of the following locations, and save it to your desktop:

• Main Mirror - This version will download a randomly named file (Recommended)
• Zip Mirror - This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
• Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
  

  [external image: Posted Image]

• Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  

  [external image: Posted Image]
  
  [external image: Posted Image]
  Click image to enlarge

• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

IMPORTANT: Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Hello Sunyata Here is the log from OTL Scan i was look for netsvcs but could not find it, so i just post the hole log. 📎OTL.Txt

Hello Sunyata
Unable to run gmer scan recived blue screen of death. Everytime i ran a scan with gmer i'am getting the blue screen of death. I download the main mirror and save it to my desktop. unckeck the following locations then scan, than receive blue screen. I had already download the zip file and save it and ran a scan with this version but yet again before it could start scanning my computer shut down. This is what windows said a problem has been detected and windows has been, shut down to prevent damage to your computer. Driver_IRQL_NOT_LESS_OR EQUAL Technical Information Stop: 0x000000D1 (0X00000060,0X00000005,0X00000000, 0XF82E56AB) atapi.sys-address F82E56AB base at F82DD000 Datestamp 4802539d. I dont know what to make of this. Is it the malware that is blocking the scan or something else.

Hello InfoGeek That message, accompanied by a BSOD, is often associated with a driver that is out of date. Have you reinstalled any drivers recently?

Hello Sunyata I have not reinstalled any drivers or update any drivers recently to my computer xp pro.

Hello InfoGeek

Let's search for good copies of the driver which the error message complains about:

Please re-run Farbar Service Scanner.
Type the following in the edit box after "Search:".

atapi.sys

Click Search Files button and post the log (FSS.txt) it makes to your reply.

Hello Sunyata Here is the log of the farbar service scanner that you requested. 📎FSS.txt