No Internet Access Infected With XP Antivirus 2012

Hello Sunyata I'am posting the combofix-quarantined log that you requested. 📎ComboFix_quarantined_files.txt

Hello InfoGeek

Please create and Run a CFScript:

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
C:\Documents and Settings\sam\My Documents\My Downloads\Unlocker1.9.1.exe	

Folder::
C:\WINDOWS\$NtUninstallKB2125$

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• If you need help to disable your protection programs see here.
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Please tell us how the computer is performing now.

Hello Sunyata I tried to run combofix i download it and place the CFScript on it to open it and run a scan. Just like before it would not scan, it just hang there. I thought that we remove this zeroaccess rootkit, so it should not be blocking the combofix scan. Went to start then run and try to rerun infogeek.mbr that did'not work. So maybe we need to find a work around like infogeek.mbr or something like that, so we can get combofix to scan again. My computer is booting up slow, and i'am not able to install security update for microsoft net framework 2.0 SP2 on windows server 2003. But for the most part my computer is running good.

Hello InfoGeek

The 2003 Server you mention… Is that another computer you have?

The reason ComboFix hangs is not related to ZeroAccess. There is no more ZeroAccess on your computer.
There are just a few things left for us to remove on your machine.

Please run an OTL Fix

• Please reopen [external image: Posted Image].
• Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"
  

  :Services
  
  :Files
  C:\Documents and Settings\sam\My Documents\My Downloads\Unlocker1.9.1.exe
  C:\WINDOWS\$NtUninstallKB2125$
  
  :Commands
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [Reboot]

• Push [external image: Posted Image]
• OTL may ask to reboot the machine. Please do so if asked.
• Click [external image: Posted Image].
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

Hello Sunyata No it is not another computer that i have, it is from microsoft servers these are the windows security updates. Here is the log from OTL Fix below. All processes killed ========== SERVICES/DRIVERS ========== ========== FILES ========== C:\Documents and Settings\sam\My Documents\My Downloads\Unlocker1.9.1.exe moved successfully. C:\WINDOWS\$NtUninstallKB2125$\1170689418\U folder moved successfully. C:\WINDOWS\$NtUninstallKB2125$\1170689418\L folder moved successfully. C:\WINDOWS\$NtUninstallKB2125$\1170689418 folder moved successfully. Folder move failed. C:\WINDOWS\$NtUninstallKB2125$ scheduled to be moved on reboot. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: sam ->Temp folder emptied: 913268231 bytes ->Temporary Internet Files folder emptied: 261229709 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 4354 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 483 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 17409452 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 25447 bytes Total Files Cleaned = 1,137.00 mb [EMPTYFLASH] User: Administrator User: All Users User: Default User ->Flash cache emptied: 0 bytes User: LocalService User: NetworkService ->Flash cache emptied: 0 bytes User: sam ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.31.0 log created on 02052012_233442 Files\Folders moved on Reboot… Folder move failed. C:\WINDOWS\$NtUninstallKB2125$ scheduled to be moved on reboot. Registry entries deleted on Reboot..

Hello InfoGeek

Please perform the following task:

• Please select and copy the contents of the following codebox (please do not copy the word "CODE"):
  
  

  cd c:\
  del C:\WINDOWS\$NtUninstallKB2125$\2703768717
  rmdir C:\WINDOWS\$NtUninstallKB2125$
  junction -s c:\ >jun.txt
  dir C:\WINDOWS\$NtUninstallKB2125$ 2>>jun.txt
  start jun.txt

• Open Notebook.exe and paste the codebox contents into the Notebook window.
• Save it as jun.bat
• Navigate to where you saved jun.bat and double click the file.
• Wait until a log file opens.
• Copy and paste or attach the content of it in your next reply

Next, to fix your Windows Update problem…

• Follow this link
• First try Method 1
• If that does not work, try Method 2

Is Windows update working now?

Hello Sunyata When i double click the file jun.bat it open up and said->📎jun.txt Allso i fix my windows update i try method 2 i just uninstall net framework and reinstall. Thank Sunyata for the info. Windows update is now working.

Hello InfoGeek

Your machine appears to be ALL CLEAN

Time to clean up our tools…

Please remove from your desktop:

• All the logs we created
• FSS.exe
• InternetFix.reg
• InternetFix2.zip
• RogueKiller.exe
• aswMBR.exe
• MBR.dat
• GETxPUD.exe
• gmer.zip
• gmer.exe
• SystemLook.exe
• Junction.zip
• jun.bat

Follow these steps to uninstall Combofix

• Make sure your security programs are totally disabled.
• Click START then RUN
• Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

The above procedure will:

• Implement some cleanup procedures.
• Reset System Restore.

Next, Please re-enable any security that was disabled.

Next,

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep it updated and use it regularly.
ESET online scan can be removed via add/remove programs.

Next, you need to install an anti-virus program and keep it's virus definitions updated:

Below are links to three very good, free anti-virus programs. Please choose only one and install it:
Microsoft Security Essentials
AVG
Avira

Next, we have a few recommendations to help you stay malware-free:

Make your Internet Explorer more secure - This can be done by following these simple instructions:

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

Please download JavaRa and unzip it to its own folder

• Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista or Windows 7), pick the language of your choice and click "Select".
• Then click "Remove Older Versions".
• Accept any prompts.
• Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista or Windows 7) again and select "Search For Updates".
• Select "Update Using Sun Java's Website".
• Then click "Search" and click on the "Open Webpage" button.
• Download and install the latest Java Runtime Environment (JRE) version for your computer.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.


WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for both Firefox and IE.

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.

Only run one Anti-Virus and Firewall program.

I would suggest you read:
PC Safety and Security–What Do I Need?
How to Prevent Malware

If there is nothing else, we will close this thread
Take care and safe computing

Hello Sunyata

Thank You Sunyata, so much for your help me in removeing this malware from my computer. Just a few more things I have a folder call Qoobox that is part of combofix. When i try to delete it, it said cannot delete BackEnv: access is denied make sure the disk is not full or write-protected and that the file is not currently in use. Please show me how to remove this folder. And how do i uninstall regedit.exe. I just don't want to delete the icon and still have this rename version of combofix still install on my computer. I went to start then run then type in Combofix /uninstall, but regedit.exe is still install on my computer. And if you can show me how to speed up my boot up time, i was think about going to misconfig and click disable services and then click reable services this might remove any startup service that is uninstall but is still starting up when the computer boots up but i and not sure. Again Thank You for HELP Sunyata, this will be the last post that i post to you. My computer is running good, but for the fact of the slow boot up time i'am on a laptop so it should not take that long to boot up. But other then that you'll done a great job. I can'not say thank you enough. Thank You for returning my machine to me take care sunyata

Hello InfoGeek

Thank You for HELP

You are most welcome

Qoobox will be deleted when you execute Combofix /uninstall from the run box. The regedit.exe on your desktop is just a renamed ComboFix.exe. You can delete that manually without worry.

If you have already run Combofix /uninstall, download a new copy of ComboFix, then re-run Combofix /uninstall from the run box. The Qoobox directory should then be gone.

I'm not sure about your slow boot up. Sometimes the machine boots slowly at first after a ComboFix run. If your system continues to boot slowly, you can post here to our Windows forum and ask for help with that. They are the experts with a clean system. If you do post your problem there, please include a link to this topic so that they see all we have done here.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.