Total Security 2009 Infection

Do these please.

1.  Download the following file and save to your desktop.
http://live.sysinternals.com/procexp.exe

Rename the file to "winlogon.exe" and then run it.(do not rename with a generic name)
Then look for any random numbers executables e.g.,3425631.exe, highlight any random.exe and rightclick and select "kill process".

Once the process is killed, you can then run MalwareBytes or Combofix.



IF you don't find any random process showing... run these tools and give us the logs please.(Rename RootRepeal to "svchost.exe" if it won;t run.

2.  Download RootRepeal from the following location and save it to your desktop.
Zip Mirrors (Recommended)
Primary Mirror
http://rootrepeal.googlepages.com/RootRepeal.zip
Secondary Mirror
http://ad13.geekstogo.com/RootRepeal.zip


Rar Mirrors - Only if you know what a RAR is and can extract it.
Primary Mirror:
http://ad13.geekstogo.com/RootRepeal.rar
Secondary Mirror:
http://ad13.geekstogo.com/RootRepeal.rar


Extract RootRepeal.exe from the archive.
Open RootRepeal on your desktop.
Click the "Report" tab.
Click the "Scan" button.
Check all seven boxes:

o Drivers
o Files
o Processes
o SSDT
o Stealth Objects
o Hidden Services
o Shadow SSDT

Push Yes
Check the box for your main system drive (Usually C:), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the "Save Report" button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.




3.  Please download this tool and run it.
http://ad13.geekstogo.com/Win32kDiag.exe

It will create a file "Win32kDiag.txt" on the desktop. Please post the result here.

Have you also tried downloading Combofix and renaming the file before saving it to your desktop?

My first post {http:#25213639}  is assuming that Combofix still won't run after being renamed before saving/before actually downloading the file.

<<<" but it still won't allow me to run any antispyware or antimalware programs.  They all start and they they just stop running for some reason. ">>>

1.  Unavailability to run any programs can be caused by rogue programs Security 2009 etc , if that's the case then renaming process explorer to winlogon.exe and killing the random process should let you run MalwareBytes and or Combofix.

2.  A new infections (win2k.sys:1, win2k.sys:2) also block security programs from running (users also alerted of the presence or rogue programs in the system), if so then RootRepeal and Win32Kdiag.exe should confirm it and also help us removing the infection.

Okay thanks for that. this is the new infection that patches files and create junctions.

You need to run Win32kDiag.exe again but  you must use this command.
Click on Start-> Run, and copy-paste the following command (the bolded text)  into the "Open" box, and click OK. When it's finished, there will be a log  called Win32kDiag.txt on your desktop. Please open it with notepad and post the  contents here.

"%userprofile%\desktop\win32kdiag.exe" -f -r


After you've done that, run Rootrepeal and show us the log.


Also Download this batch file and save to your desktop.
http://download.bleepingcomputer.com/bats/peek.bat
Double-click on Peek.bat it will produce a LOG.txt  please post the content of that.

Thanks for the logs.... the eventlog.dll is the one patched... so we need to replace that with a clean one using Avenger.
First we need to copy a clean one to the root drive... then move from the rootdrive to system32 to replace the patched one.


Create a batch file to copy the clean eventlog.dll to the C:\.
Copy and paste the bold text into Notepad.
Save this text as "Fix.bat", make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.
Double-click on the "Fix.bat"

@echo off
copy C:\WINDOWS\ServicePackFiles\i386\eventlog.dll c:\eventlog.dll
Exit



Once there's a clean copy in the root drive we then use that copy to replace the patched one using Avenger.
1. Please download The Avenger by Swandog46 to your Desktop.
http://swandog46.geekstogo.com/avenger2/download.php

   * Right click on the Avenger.zip folder and select "Extract All..."
   * Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):


Files to move:
c:\eventlog.dll | C:\WINDOWS\system32\eventlog.dll



Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

   * Right click on the window under Input script here:, and select Paste.
   * You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
   * Click on Execute
   * Answer "Yes" twice when prompted.


4. The Avenger will automatically do the following:

   * It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
   * On reboot, it will briefly open a black command window on your desktop, this is normal.
   * After the restart, it creates a log file that should open with the results of Avengers actions. This log file will be located at C:\avenger.txt
   * The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply.



Then run Win32Diag.exe again using the switch below:

"%userprofile%\desktop\win32kdiag.exe" -f -r


Then run the renamed Combofix..... then RootRepeal to check that it's gone.

Please download ComboFix by sUBs:(Rename it before saving to your desktop)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..


Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix



Btw, when you run RootRepeal and on the Drivers or hidden services tab if you still see this, rightclick and use the "Wipe File" button.
Name: win32k.sys:1
Image Path: C:\WINDOWS\win32k.sys:1

Name: win32k.sys:2
Image Path: C:\WINDOWS\win32k.sys:2


Also on these hidden/locked file and folder use "Wipe File" on this
C:\WINDOWS\system32\intel64.exe
C:\WINDOWS\system32\terrapof32

Yes, and RootRepeal...Win32Diag.exe as well.

<<<"Error: file "c:\eventlog.dll" not found!">>>

Avenger failed to move the file from the root drive to the system32 folder.
You did run the Fix.bat did you? I asked because the Fix.bat was supposed to copy the clean file from the source and into the C:\ ready for Avenger to move to system32.

Let's start again please....


Step 1:
Open notepad and copy/paste the bolded text below into it.
Save this text as "Fix.bat"  Make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.
Double-click on the "Fix.bat". You may see a window flashes it's normal.

@echo off
copy C:\WINDOWS\ServicePackFiles\i386\eventlog.dll c:\eventlog.dll
copy C:\WINDOWS\ServicePackFiles\i386\dumprep.exe c:\dumprep.exe
Exit



Step 2:
Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, copy, then paste the following bolded text(all text inside the lines below):

--------------------------------------------------------

Files to move:
C:\eventlog.dll | C:\WINDOWS\system32\eventlog.dll
C:\dumprep.exe | C:\WINDOWS\system32\dumprep.exe

--------------------------------------------------------

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage

the workings of your system.

Now, open the avenger folder and start The Avenger program by clicking on its icon.

   * Right click on the window under Input script here:, and select Paste.
   * You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
   * Click on Execute
   * Answer "Yes" twice when prompted.


Please copy/paste the content of c:\avenger.txt into your reply.




Step 3:
Click on Start->Run, and copy-paste the following command into the "Open:" box, and click OK.


"%userprofile%\desktop\win32kdiag.exe" -f -r

When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.



Step 4:
Run the renamed MBAM and renamed Combofix.exe and attachs the logfiles.

When creating the Fix.bat yes leave it at default ANSI.
And if you check, the eventlog.dll and dumprep.exe should be present on the C:\

Sorry about the Avenger was using the old canned....
when you doubleclicked Avenger it already opens in the "Input script here:" window so just paste it inside that window or click on the 3rd button that says"(when hover it with mouse) "Paste Script from Clipboard.
Click on  "Execute" and reboot when prompted.

Thanks for the logs...
I assume you let MBAM took care of those bad files where it says in the log "no action taken"?

We just need to remove some leftover files.

Run combofix again using this script.

1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
File::
c:\windows\temp\mscipevc.exe
c:\windows\system32\wmiapise.exe
c:\windows\system32\drivers\svchost.exe.sys
c:\documents and settings\HP_Administrator\settings.dat
C:\tujfbtrj.exe
C:\enurmyv.exe
C:\hpbyv.exe
C:\pvewnn.exe
C:\emxtqjit.exe
C:\blyuwrjl.exe

Driver::
WMIAPISE

FileLook::
c:\windows\system32\svcprs32.exe

DirLook::
c:\program files\Common Files\tenu._sy
------------------------------------------------------------------------
3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.



Can you please submit the below file for online virus check  -->http://virusscan.jotti.org/
C:\windows\system32\svcprs32.exe


You might also like to clean your temp folders.
CCleaner:
http://www.ccleaner.com/download/

Things look good.

If you like you can also do an online scan to make sure nothing is missed, either Activescan or Kaspersky.
Panda's Activescan:
http://www.pandasecurity.com/activescan/index/

Kaspersky's online scanner:(save the log because Kaspersky doesn't remove any threats found.
http://www.kaspersky.com/virusscanner
   

No problem....sounds good then.
Kaspersky is a very thorough scanner so if it didn't find any thing, then I'd say you're good to go.

To uninstall Combofix:
Go to Start > Run and 'copy and paste' next command in the field:

ComboFix /u



You can run CCleaner also if you like to clean out temp folders etc.
http://www.ccleaner.com/download/



If you have time, please check out these links below:
1.  TonyKlein's article "So how did I get infected in the first place?"
http://www.spywareinfoforum.com/index.php?showtopic=60955

2.  miekiemoes' "How to prevent Malware"
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html

3.  Simple and easy ways to keep your computer safe and secure on the Internet:
http://www.bleepingcomputer.com/tutorials/tutorial82.html