I need help identifying a virus if a computer still has a virus. There are 3 things that tell me there is still a virus:
1. Schedule tasks service will not start
2. Cannot upgrade IE to 7 or 8
3. Installed Malwarebytes, HiJackThis & Spybot but when start to run scan program is stopped and then cannot launch program again. Error comes up Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access them
I did have and removed from system the following viruses:
1. Packed.Generic.233
2. XPSecurityCenter
3. Backdoor.Trojan
4. Infostealer.Gampass
Now, I have installed Symantec Endpoint Enterprise (it had Symantec v10 that the viruses destroyed from running at all) and done several daily scans and the system is clean. I have done the scans in normal mode and save mode, a same result that includes the removal of Spybot, Malwarebytes, and HiJackThis. The computer runs like a champ now and other than the 3 things mentioned above there are no signs of infection that I can tell. I guess it is possible that windows is just damaged now but not sure. Some help either fixed or find a virus would be greatly appreciated.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
i guess the best option is to install (Kaspersky 2009) and run it using the free-trial version that well work for 30day and update its virus definations, then trying booting at safemood and stop all msconfig startup applications, then do a full scan
PS(booting from safemood will not give you any permission to scan any network disks..)
Yazan.
You can either run the suggested Combofix... BUT rename the file before saving to your desktop and let us know if it won't run.
OR... Download RootRepeal from the following location and save it to your desktop. If it doesn't run, rename it to "svchost.exe" and show us the log.
Zip Mirrors (Recommended)
Primary Mirror
http://rootrepeal.go
Se
http://ad13.geekstog
Rar Mirrors - Only if you know what a RAR is and can extract it.
Primary Mirror:
http://ad13.geeksto
Secondary
http://ad13.geeksto
Extract RootRepeal.exe from the archive.
Open RootRepeal on your desktop.
Click the "Report" tab.
Click the "Scan" button.
Check all seven boxes:
o Drivers
o Files
o Processes
o SSDT
o Stealth Objects
o Hidden Services
o Shadow SSDT
Push Yes
Check the box for your main system drive (Usually C:), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the "Save Report" button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.
3. Please also download this tool and run it.
http://ad13.geekstogo.com/
It will create a file "Win32kDiag.txt" on the desktop. Please post the result here.
Click start -- > run --> type msconfig
Goto Startup tab and disable all items but symantec.
Goto Services tab, click Hide all Microsoft Services.. If you noticed any weird services are running you can untick them as well.. these might be viruses or malware that loads on windows as a service.
Download SmitfraudFix
Restart your windows in safe mode and then run the tool
http://siri.urz.free.fr/Fi
Post the log here along with all the other logs that you had from Hijackthis, Malwarebytes.
Download Stinger and fully scan all your partitions ..
http://vil.nai.com/vil/sti
Follow the instructions found in the same link..
GL
Sorry about the delay in responding but I have been swampedwith work and have not had the time to do anything with this computer.
Warturtle: I cannot run the combofix program because itresets the network connection and I do not have anyone on site that can handlerunning the program.
Rpggamergirl: When I run the RootRepeal as you suggested, itcloses the program when scanning the files and then I cannot launch the programanymore. Even changing the name does not matter, when it starts the file scanit kills the program. So I did run a Processes Scan, Shadow SSDT scan and SSDTscan and have attached the results of those scans. I also ran the win32kdiag andthe log is posted.
Also, I noticed that Symantec is posting an error messagefrom time to time that states as follows: Traffic has been blocked from thisapplication: (nbf.sys)
You should be able to run any renamed scanners after this.
Step 1:
Our aim is to have a copy of eventlog.dll in the C:\
Open notepad and copy/paste the bolded text below into it.
Save this text as "Fix.bat" Make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.
Double-click on the "Fix.bat". You may see a window flashes it's normal.
@echo off
copy C:\WINDOWS\ServicePackFile
Exit
Step 2:
1. Please download The Avenger by Swandog46 to your Desktop.
http://swandog46.g
Extrac
Start up Avenger.
In the box that opens, copy, then paste the following bolded text(all text inside the lines below):
-------------------
Fil
c:\eventlog.dll | C:\WINDOWS\system32\eventl
----
Now, open the avenger folder and start The Avenger program by clicking on its icon.
Click on Execute
Answer "Yes" twice when prompted to reboot.
Please copy/paste the content of c:\avenger.txt into your reply.
Step 3:
Click on Start->Run, and copy-paste the following command into the "Open:" box, and click OK.
"%userprofile%\desktop\
When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.
Step 4:
Run the renamed MalwareBytes, it would be better if you're on site and run the renamed Combofix as well.
After completing the Avenger steps and a reboot Malwarebytesdid work and I was able to run a full scan. It did find a lot of issues. I alsowas able to run RootRepeal completely and have attached the log from it, alongwith the win32diag log with the -r f switches.The Avenger did not create a log. As far as running the Combfix the place is 7hours away and I have no idea when the next time I will be down there.
RootRepeal log is not showing win2k.sys: infection as active, there's just one driver that looks suspicious --> bjbu.sys
See if you can check the properties of that file.
Since Combofix is not an option, you can use other scanners now... online scanners that remove threats found or any scanners you preferred.
And those multiple mountpoints(second folder of the same name) showing in both logs were created by the infection, those folders can be safely deleted if still present(they should be empty), Win32Diag.exe were supposed to remove them but doesn't always removed.
Examples below:
C:\WINDOWS\Config\Co
C:\WIN
C:\WINDOWS\ADDINS\AD
etc..
A
I removed the folders, which were empty, and the bjbu.sysfile is gone. I did a search for it and did not find it anywhere. I did anotherRootRepeal on drivers and that one did not show up again. I even was able toinstall Spybot now and did a scan; it found a few things and removed them. Ire-installed Symantec with all options and it is working great too. Do youstill feel as if this computer is still infected? I am still having an issueinstall IE8 and starting the service Task Scheduler, which is what lead me tobelieve that the computer was still infected.
If MalwareBytes scan came up clean then that's good.
The RootRepeal is for rootkits and for that win2k.sys: infection so with the Win32Diag.exe, but generic viruses are not covered with those. But if Spybot also comes up clean then one more scanner I would use to confirm would be an online scan with Kaspersky(it will not remove found threats so you would've to save a log).
http://www.kaspersky.
Or an online scan with scanners that remove if it finds any threats like Panda's activescan.
http://www.pand
The system could still be infected or could be due to permissions problem.
The virus/root kit has been resolved completely. Now I just need help fixed the damange to windows. I have created two new questions so that I can increase the points. Below are the links to the questions if you have any thought or ideas please let me now. Thank you all for your help in fixing my problem.
Task scheduler repair:
http://www.experts-
IE repair:
http://www.experts-
Business Accounts
Answer for Membership
by: warturtlePosted on 2009-08-29 at 01:59:05ID: 25213402
Change the name of executable of MalwareBytes and run it. If it still doesn't run, then download ComboFix from here:
http://www.bleepingcompute
Read the instructions carefully before running it. All computer security software must be disabled prior to running it. After ComboFix is done and has created a log, please send that log to us and re-enable all security software.
Hope it helps.