Help! My PC has been attacked. Yesterday several shortcuts were popping up on my desktop and (VIP Casino, Cheap Software, Cheap Pharmacy On-Line, Search On-line, SMS Trap) and then good ol Spyware Protect 2000 and Windowsclick took over (along with I am sure a host of nieces and nephews).
I am currently posting this using my laptop.
Anyway, here is what it has caused:
In IE 6, which I dont use much, windows just pop open over and over and I cant stop them. I have to shut down the computer.
In Mozilla Firefox, my default browser, the following is happening, but not limited to:
1. Slow loads on pages.
2. Unable to access help sites such as mybleepingcomputer.com, Maleware.org, or places used to download such things as ComboFix, Hijack This, etc&&page opens up and says :Mozilla Firefox cannot open web page&.
3. I cannot access certain websites past the Login page such as Experts-Exchange and others. The page times out after entering my username and password. Sometimes when I do click on a site that I am trying to get help from, then Windowsclick takes over and redirects me to where they want me to go! Another site that is hijacking me is mobilreads.com &.another re-directing site/problem
And in general:
4. When trying to run ComboFix, Spybot, Ewido anti-spy, Smitfraud, Ad-Aware&the programs will not launch. I DID get ComboFix to run (and have attached my most current log below) only by changing its name. I tried that with the others, however, Spybot still wont launch, Ewido starts and then gives an error message, Ad-Aware starts and then I get the error message that says: System Error: 1810 has occurred. Description: Service is not on line. Application Terminates. &then when I try to go to their site for support&..SEE # 2 above! The Ad-Aware logo stays up on my bottom tool bar and I cant close it&.I have to go to Task Manager which shows its still running&but it aint!
5. I ran AVG Anti-Virus overnight and it found a Trojan as follows:
C:\WINNT\System32|wpv 361235072128.cpx. Says it was a Trojan Horse 5Heur2.RLK. Anyway, it took care of it, but nothing I can see has changed.
6. I noticed in my Task Manager that svchost.exe is running 6 different times and using from 4200k to 19,000 k in memory. Also, services.exe (shown just like that&all lower case) is running around 3800k. I know I read somewhere that a virus or something under that name exists, but I cant tell it between the normal services.exe&.does any of the above here in number 5 have any bearing?
Below are both my most current Log Files from A.) Hijack This and B.) ComboFix
Any help with this would be greatly appreciated!!!!!
Greg
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Davids recommendations will do the job, but i would suggest that while your already in safe mode to go ahead and go to control panel add remove programs and remove anything suspicious or unused.
Also go to start - run - type in msconfig then select the startup tab and unclick anything you dont want to run at start up.
Then when you have a chance, if you dont have one, create a limited user account and use that for your everyday usage.
good luck too you.
I had this happen to me recently as well as to a friend of mine. I ran various anti-virus products (AVG for example - http://free.avg.com/) and Spy Bot Search and Destroy (http://www.safer-networki
These attacks are so annoying. It makes the machine unusable. It is so frustrating. These people should be castrated.
I got attacked by this virus / malware while running FireFox 3 one day. I thought FF was less prone to these attacks. I believe the attacks are coming in via Java applets, not javascript, so I have since disabled Java in both FF and IE. In FF the setting is in Tools - Options - Content (button) and its a check box named "Enable Java". Have not had the problem since. This won't help you clean your system, but it may help you in the future.
Good luck.
I had a couple of computers (one here at my office and another a friends) that even after running different anti-virus products (AVG, Ad-ware, Spy Bot, Clam) and cleaning the systems, they still could not recover the changes they did to browsers and system.
I got an external drive and copied all the user data, formatted hard drive and reinstalled Windows. I then made sure Windows was updated and installed anti-virus software and made sure to scan the files again that I saved to the external drive before coping back to computer.
You may want to try doing this if you have the time and all your programs that you had installed available.
Good luck,
Okay, did as David said...disabled System Restore and started back in safe mode. The following occurred:
1. Still could not run Ad-Aware and got new error message: Exception EAccesViolation in module AD-Aware 2007.exe at 001DD084
2. Spybot would not launch.
3. Rogue Remover says I'm clean (won't count on it anymore).
4. Combofix started to run and then said it found a ReTool something or other and wanted to restart the computer....I didn't want to take a chance so I clicked out of it.
5. I ran HiJack This again and have log posted below.
6. I ran AVG and it detected and cleaned 16 infections and have also posted that log below
7. I went through Control Panel in Safe Mode as Dirtpatch-Jenkins said to, however, didn't see anything there that I didn't recognize.
Here is log from AVG and the Hijack This log from scan in Safe Mode.
I now have to log off this computer and re-connect my PC to the internet. I will get bac to you and let you know if these things worked, albiet, limited in ability to run some of the programs that David suggested.
Back in a bit and thanks so far!
Okay, your system is hammered. The following entries state that they were moved to a virus vault and are listed as Trojans.
?\globalroot\systemroot\sy
C:\WINNT\system32\winlogon
\?globalrootsystemrootsyst
C:\WINNT\system32\services
\?globalrootsystemrootsyst
C:\WINNT\system32\lsass.ex
\?globalrootsystemrootsyst
C:\WINNT\system32\svchost.
\?globalrootsystemrootsyst
C:\WINNT\explorer.exe (772) Trojan horse Generic12.BRSC Object was moved to Virus Vault.
\?globalrootsystemrootsyst
C:\Program Files\AVG\AVG8\avgui.exe (1328) Trojan horse Generic12.BRSC Object was moved to Virus Vault.
\?globalrootsystemrootsyst
C:\Program Files\AVG\AVG8\avgscanx.ex
\?globalrootsystemrootsyst
C:\Program Files\AVG\AVG8\avgcsrvx.ex
--------------------------
Unknown application. Remove if you cannot determine it's origin.
O2 - BHO: WinGDI Class - {12c7290a-157b-4f43-b109-9
Unncessary entries. Can be removed.
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-9
O2 - BHO: BHO - {C9C42510-9B21-41c1-9DCD-8
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-F
O16 - DPF: {01012101-5E80-11D8-9E86-0
O16 - DPF: {511073AD-BE56-4D43-AE68-9
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-6
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D
Your log file is clean minus the entries I listed.
Please run Combofix and allow it to finish running.
Restart your computer and test your internet connection.
If it does not work, then click Start ->Settings and Control Panel.
Select Network connections. Locate your connection and right click on it.
In the menu click the Repair option. When the repair proccess has finished, your connection should be working again. Reboot to test.
I have been having really good results running Malwarebytes' Anti-Malware software. It's free, it doesn't add any running tasks, and it has fixed 3 systems that I spent hours on with other utilities. Worth trying
The website is www.malwarebytes.org and you can download it from download.com
http://www.dow
David and everyone else: Here is where I am at since your last posting David....
Okay, after running AVG in safe mode and getting 16 items cleaned, I then downloaded Malware on my thumbdrive from the conncetion I have on my laptop. Upon restarting computer, ComboFix came up and ran its scan (a log from it is below). The computer then started up. The system restore was already in the "on" position.
When I went to install the Malware....it wouldn'tlaunch the install...until I changed its name. It then installed but when I went to run it...it wouldn't launch.
I then restarted again in Safe Mode and tried to run the Malware....but it wouldn't run in Safe Mode either.....
Going to reconnect PC and internet, follow David's newest steps and see. I will be back.
Thanks in advance - See Attached Combofix log from last run out of Safe Mode:
Okay, we have some progress.
If you are running into brick walls with my latest suggestions then can you log on as a different user? There is no doubt that the system is infected. However, you may have better success under a new profile or one that is not corrupted. Please see if you can log on with a new profile (create one if you must). If you can log on in that manner (Safe Mode) please test your antimalware applications. They may run under that profile vice your current one.
David
It doesn't look like you installed the Combofix Recovery Console installed.
Combofix works in reduced mode unless it is installed.
If you didn't have any success with my last post then please install the Recovery Console and scan again.
I am going to be away from this post for about 1.5 hours. I will check back in around 6PM PST.
David
David, I must have run a different ComboFix that I found in safe mode. I have run another along with Hijack This and have posted the logs below.
I deleted those files you suggested from the previous HJ log, have restarted in regular mode under my profile and tested the internet.......again, can't get into some sites (like Experts-Exchange) once I enter my username and pass.
btw, I am on the internet on both my pc and laptop now....you helped me fix an unrelated problem on my laptop...thanks....I'll give some points on that too!
Okay, I started computer up under my daughters old profile. Malware still would not launch. Started Firefox and went to several web sites that I have been having the trouble getting past the login page, Experts-Excahnge included, and still unable to get past it. Note that there are no error messages, the page just wont load and it times out. I can get on other sites such as facebook, my banking, some sites that I pay bills on, etc..
I'm at a loss. Just can't figure it out. Perhaps with those last log files I sent you, you may see something that I don't see.
Thanks in advance and we will keep trying
Greg
The boot disk is in iso format, burn it to cd - put the cd in the drive and reboot the comp... if you get a boot from cd window press a button..
It will run from the cd - you will run the virus scan from the menu - it takes a while running from cd -
after the virus scan is complete highlight all the found viri and right click and set to delete.
You can then run the registry cleaner - same thing just about. lots faster though.
after its done take the disk out and reboot.
i am remote controlling my server right now trying to get the file up for you,, will put a link in when its done,
as far as the trusting me part... youve already been over-ridden,, what can it hurt? lol.
Greg, can you go to the other system (the one that you can get on the internet with) and try this? It's a small download and it designed to correct and repair Winsock 2 settings, caused by buggy or improperly removed Internet software, and that results in the loss of Internet access.
It's worth a shot.
http://www.download.com/LS
David
Sorry for the delay - i couldnt find my thumb drive - lol... a friend uploaded it to rapidshare, you can get it here -
http://rapidshare.com/file
Greg, just out of curiosity can you locate and then copy/paste your Host file for me?
It's located at:
My Computer > C: (or whatever drive Windows is on) > WINDOWS > system32 > drivers > etc > hosts
Or you can just go to Start and Search For Files and Folders
Then type in Hosts and select Search.
david
David, I just ran the program and am restarting the computer so we will see in a second if that helped at this point.
I wanted to point something out to you....below is a small section of code from ComboFix that I noticed while analyzing it. The entries shown are some things that were created around the hour or so that I began getting those shortcuts popping up on my desktop. None of the items you see in this code are things I downloaded or wanted, let alone installed. Could any of these be causing some problems?
Outstanding catch Greg.
Remove this file:
XPPoliceAntivirus
You can read about the above file here:
http://www.spywaredetector
It's fake antivirus.
Remove this file:
digeste.dll
The above file is Trojan.Downloader.Bredolab
Remove them, reboot and test please.
David
You may need to enable Hidden Files.
To see hidden files:
1.
On the Tools menu in Windows Explorer, click Folder Options.
2.
Click the View tab.
3.
Under Hidden files and folders, click Show hidden files and folders.
To access Windows Explorer, click Start, point to All Programs, and then click Windows Explorer.
How do I remove it though. Inside the folder there is no .exe file but there are the following:
There are two .dll files, s .dat file. a .cfg file and then a folder with plugins with 3 .dat files and a folder with three .wav files.
How would you go about this. Rename them all or drag the whole XPPoliceAntivirus folder to the trash? Its not in Add and Remove.....
Sorry...I had two things going on at a once.
See if you can locate the file here and then rename it.
C:\Program Files\XPPoliceAntivirus\xp
To perform manual removal of XP Police Antivirus rogue anti-spyware, you should do the following:
Delete XP Police Antivirus corrupt files:
%Program Files%\XPPoliceAntivirus
%Program Files%\XPPoliceAntivirus\A
%Program Files%\XPPoliceAntivirus\b
%Program Files%\XPPoliceAntivirus\C
%Program Files%\XPPoliceAntivirus\s
%Program Files%\XPPoliceAntivirus\x
%Program Files%\XPPoliceAntivirus\P
%Program Files%\XPPoliceAntivirus\P
%Program Files%\XPPoliceAntivirus\P
%Program Files%\XPPoliceAntivirus\P
%Program Files%\XPPoliceAntivirus\P
%Program Files%\XPPoliceAntivirus\P
%Program Files%\XPPoliceAntivirus\P
%Program Files%\XPPoliceAntivirus\P
%Program Files%\XPPoliceAntivirus\s
%Program Files%\XPPoliceAntivirus\s
%Program Files%\XPPoliceAntivirus\s
%Program Files%\XPPoliceAntivirus\s
%UserProfile%\Desktop\XP Police Antivirus.lnk
%UserProfile%\Start Menu\XP Police Antivirus.lnk
Remove XP Police Antivirus registry entries:
HKEY_CURRENT_USER\Software
Have rebooted....still can't launch Malware Anti-Malware, still can't log in to Experts-Exchange or another site that I use, and some others.
I also noted that when I go to the official Malwarebyte.org site I am redirected to a site that "looks" like it, but its just a search portal.......that has a header that says Malewarebytes.org...what you need, when you need it....but its fake.
Okay Greg, at this point I'm going to recommend that you download a suite. If you can get there.
I've used it for one year and it works.
http://www.pctools.com/spy
You will have to purchase it but the license is for one year.
This is the first time I've recommended a paid for suite. However, your system seems that is so badly infected this may be one of about three recourses that we have. The other two are a boot and scan ISO that was recommended earlier or an XP Repair (or at the worst an XP Reinstall).
Guys, I work nights at FedEx and have to go in in a few minutes. Please reply to this post as soon as you can.
I will download the infor that Jankins has for me and try it in the morning.
I have Spyware Doctor on my laptop. Don't know if I can get it over to my PC. I thinks its a trial version, but have used it before.
Will either of you be on tomorrow?
Thanks SO MUCH for your help so far! I will get back to it as soon as I can. Thanks!!!
heres the link again...
http://rapidshare.com/file
[code]<pre>
----a-w 579,072 2008-01-22 18:03:54 C:\Program Files\Grisoft\AVG7\avgcc .exe
----a-w 256,576 2008-01-27 01:10:57 C:\Program Files\iTunes\iTunesHelper .exe
</pre>[/code
The above section of the CF log shows sign of a vundo file infector.
Your Combofix.exe has expired, please update it before running a scan or delete that one you have and download a fresh copy of Combofix.
And the log from AVG shows file patcher which could be virut or sality. If it's virut, I would usually recommend a reformat as virut infected files are uncleanable, but if the infection has just started you can still remove the infection and just replaced all corrupted/deleted files.
Dr Web CureIt does a good job deleting all infected files.
Virut:
http://www.fre
Sality:
http://support.kasp
yes of course....it doesnt load a lot of startup files, etc...
i would do this IN THIS ORDER (important)
If you are transferring these files from another computer via USB stick make sure you WRITE-PROTECT it..cause the virus you have will most likely jump onto your USB drive and keep infecting your machine.
1) Safe Mode
2) (rename the downloaded file) ComboFix- http://download.bleepingco
3) (rename the downloaded file) Malwarebytes- http://www.malwarebytes.or
4) Avast- www.avast.com (boot-time scan)
let me know how you make out.
Xchanging - I have a good copy of combofix. The one you read was an old combofix that I found in Safe Mode and ran...I since posted a log with the newer version.
As for the others, I will download them on my laptop, write protect (although I am not sure how you do that) and put them on my thumb drive. Then you say to install on my infected computer in SAFE mode?
DAVID, I was able to download and run. It is the "Free" version. While it doesn't fix anything in that version, it gives me all the details that I need to delete files, registry keys, etc. Is that okay?
I haven't done Jenkins fix yet cause I downloaded the file and it is 68 megs...unfortunately, my thumb drive is only 60 megs and my laptop doesnt burn CD's. My daughter's does and we are going to do it later. I really want to try that.
Any thoughts on the above?
yes def in safe mode.
the link i sent you should be the latest version...if you boot in Safe Mode with networking it will as you if you want to download the latest version if there is a newer one available.
certain USB drives have little switches on them to write protect kinda like an old cassette tape.
Dont forget to rename the files before running them.
Mine is a Lexar...it doesn't have that switch. Can I download the files, put them on the thumb drive and rename them there, before I load them on my PC? Would that be the same>
Also, what do I rename? If I just do the setup file name, is that enough? It seems as if I may need to rename the .exe as well?
just rename the setup file once you copy them to your computer from the USB drive. Some will not run if they are only on the thumb drive.
name them anything....a series of numbers, etc...anything. The setup files only..that should do it. Leave the extension (.exe)...you cant remove that or the file will not work at all.
Wow, that would have to be my last resort. It can be done, and actually can be refreshing at the same time. My fear there is losing something, or not bein able to save it like it should be. All my Outlook stuff.....certain programs that have data saved like Family Tree (my wife's project).....I have no problem saving downloaded programs and re-installing them, but I am not so sure about other things. What do you suggest....
You can always do a search for *.doc *.jpeg, etc. The * is a wildcard and will search for all files with whatever extension it is attached to. An example of this would be a search for *.doc
That will search for and list all documents (From Word) that reside on the system.
The same would hold true for jpegs, Excel files (*.xls), etc.
Another option would be to copy each profile to removeable media (CDR, etc.)
You would simply right click Start, select Explore and then locate say your profile. Right click on Greg (as an example) and select Copy. Then copy that profile to removeable media. Repeat as necessary with all profiles.
That link seems to work fine for me.
Try this.. http://www.forospyware.com
You would simply access or open the folder (Profile) and then select what you want to copy (My documents, photos, etc.) If you copy the entire profile it will bring over My Documents, My Favorites, etc. The problem can be when people create folders on C: outside of their profile. Like if your wife created a Family Tree folder on root (C:) it would not automatically copy over. You have to search or look for created folders of this type and manually copy them.
If the XP CD is in your drive on boot watch for Boot from CD message. Hit any key and the XP CD will start to load.
http://support.microsoft.c
Okay, call me stupid, but I am really confused. I burned the file Jenkins had on a CD. I put it in both the CD and DVD drive, however, when I rebooted each time, it went right to the normal start up.
Are you saying that i have to have my original XP reboot disc in?
If I do what you say, and the XP CD starts to load, where does the CD with Jenkins file come into play?
Forgive my ignorance on this one.......
if you dont have burner software here is a free one...
http://infrarecorder.org/
once you unrar the iso, burn the image(iso) with infrarecorder.
That cd will boot directly
Ugh....I downloaded the CD burning file. I then extracted the ISO file. When I go to burn it with the CD burning software, I get the following message:
ERROR: Unable to parse project file, it may be corrupt. The XML processor returned: 2
?????
Next question....what do I do if I can't find my friggin XP recovery disc? I am at a total loss here.
heres a link with a short list of burning apps...
http://www.petri.co.il/how
if the rar file extracted with no errors then it will burn, i just used the same image this afternoon
Okay, here is what took place overnight. I ran the boot disc and the Avast found and deleted the following:
WIN32:Agent-QZQ (Trojan)
WIN32:DNSChanger-VJ (Trojan)
WIN32:Downloader-AVS (Spy)
WIN32: ADWARE-GEN (ASW)
WIN32:Trojano-214 (Trojan
I then ran the registry cleaner. It was able to perform 6 of 7 functions but couldn't run the second one (Registry File Types) and came up with the error message "Can't Enumerate Subeys"
I finished everything, removed Boot CD and restarted. Tries to get on Experts-Exchange and a couple other sites that I use for my job, and again....no entry once I try to log in. ON Facebook, my daughter can get on, however, just trying to launch her friends chat, or to update her profile....the page just bogs down and won't load.
I then tried to download and launch Malwarebytes program. Even renamed it. THe program installed, but when I wne to launch it....nothing.
I am truly stumped. AVG and AVAST combined have removed over 20 viruses, spyware, or adware and I am faced with the same thing.......What now?
I cant remember if i had sent you this link yet,,
http://safecomputing.umn.e
You could try that... i had a buddy with a NASTY rootkit and followed their advice and was at least able to save his personal files. he decided for a reinstall even though it seemed to have removed everything...which is what i would suggest for you just as soon as you can find/get disks.
Thanks Jenkins, I will try this and will let you know. I think this is my last step, and depending on the outcome, will either save me, or have to re-install. Right now, I am leaving to get some divine intervention. Beats the heck out of me.....Jesus rose from the dead in three days, I can't even get my computer to resurrect in three.......I'll get back to you in a bit. THANKS!!!
JENKINS!!!!!!!!!!!!!!!!!!!
IT WORKED!!!!!!
I HAVE BEEN FREED FROM THE BONDAGE OF THE TROJAN ARMY!
Everything is working normally now and all the sites that I could not get into or work on are now operating properly, INCLUDING EXPERTS-EXCHANGE which I am accessing on my PC AS WE SPEAK!
I am ever grateful to ALL OF YOU who walked me through this absolute mess:
David, Jenkins, XCHangingIT, your tips, your patience, and most of all, your absolute and amazing EXPERTISE has made my day (and life a lot easier for now).
As I am somewhat new to this, I am not sure how to reward points in a case like this. I am certain that Jenkins last program suggestion could probably not have cleaned me up entirely. I believe that it was a host of suggestions and recommendations that got me through.....so my next questions, and don't be shy, how do I award the points. You are all deserving!
Jenkins and David, as I am hoping that I can download and now run several of the programs you all have suggested (i.e. Malware, Hackme, etc....what would you suggest I download and/or use on a regular basis to monitor these things. Also, I am using AGV as my anti-virus....and I am not too confident with it. I just downloaded and started using it a week ago, with updates, and all this stuff got through.....any suggestions...after all, you guys are the EXPERTS!
GiforGOD, sorry wasn't able to follow thread of weekend. Please make sure to monitor your bank accounts and credit. I had a co-worker that had his personal infected with same type and right after had his identity stolen. Apparently his had a keylogger and was able to due purchases using info from his online banking and card purchases.
Business Accounts
Answer for Membership
by: David-HowardPosted on 2009-02-20 at 14:28:46ID: 23696963
Prior to running any anti-virus/malware suite disable System Restore. Directions can be found here:
http://support.microsoft.c
If you are unable to view the above link follow these steps.
Click Start, right-click My Computer, and then click Properties.
In the System Properties dialog box, click the System Restore tab.
Click to select the Turn off System Restore check box. Or, click to select the Turn off System Restore on all drives check box.
Click OK.
When you receive the following message, click Yes to confirm that you want to turn off System Restore:
You have chosen to turn off System Restore. If you continue, all existing restore points will be deleted, and you will not be able to track or undo changes to your computer.
Do you want to turn off System Restore?
After a few moments, the System Properties dialog box closes.
Reboot into Safe Mode (F8 at startup) and run your antimalware/antivirus scans.
When you have finished running your scans and the threats have been removed enable System Restore.
Steps to turn on System Restore:
Click Start, right-click My Computer, and then click Properties.
In the System Properties dialog box, click the System Restore tab.
Click to clear the Turn off System Restore check box. Or, click the Turn off System Restore on all drives check box.
Click OK.
After a few moments, the System Properties dialog box closes.
If you can get into Safe Mode and run your scans Combofix and another trusted suite (Malwarebytes) should remove the threat.
www.malwarebytes.org
The program is small enough that you can copy it from another system and install on your own via a thumbdrive.
If you can copy malwarebytes from another location, download HiJackThis as well.
http://www.trendsecure.com
Once you run the utility save the log file.
You can post it for free analysis here or at
www.hijackthis.de