Hello,
I am trying to repair a firned of mine's laptop. He recently became a victim of one of those malware programs that claims your pc is infected and shows a fake scanning logpage.
1. I have tried to go to online scanning sites to remove the program, but it shuts down the browser whenever I do.
2. I have tried to install Malware Antibytes and HijackThis to obtain logfiles, and the malware shuts them down once they start scanning. Trying to re-run the program results in a message saying that I do not have permission to run the program.
3. I've logged into the laptop in safe mode and search the directories, trying to find out what was installed at the time he first noticed the message. I found a folder with a jumbled assortment of letters as it's name and deleted the contents.
4. When booting up now, both in normal and XP mode, I now see empty desktops (completely black screen with just a cursor in safe mode, completely blue screen with cursor in normal).
5. I am able to do ctrl-alt-del and pull up Task Manager and do some stuff (such as running a program from a command line).
The laptop is a Dell D620 running Windows XP SP3.
I'm usually able to trace down most of the viruses and malware than my friends get on their machine, but this one has me hunkered in a corner with my safety blanket. Your help would be GREATLY appreciated on this one!
Thanks!
-JT
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
run an online scan
http://www.eset.com/online
also install spybot Search & destroy, remove all addons on IE
also reset IE (tools - internet options - advanced - reset)
try to run all these from safe mode
also install CCleaner and delete all temp files before doing these removal processes...
Install www.superantispyware.com.
Do a complete scan, when it requires reboot pull up safe mode and do another complete scan then reboot.
Hi guys,
Thanks for your prompt responses.
Houssam = I did the restore point trick, but unfortunately the only restore point was the one I created before I started to work with his machine. Even when I go to that one, I still get the blank screens in both safe and normal mode.
Hainkurt = I am in the process of trying to install CCleaner and Spybot right now in safe mode.
Hainkurt and TunerML - Thanks for the suggestion about the website scans, but I'm not sure if you read my post fully. The first thing I mentioned was the fact that when I do go to these sites to run a scan, the malware closes the browser once the scan starts.
I will post another update after I install the CCleaner and Spybot.
Thanks for your quick responses!
Hi JTinAtlanta,
Download this Keyfinder: http://www.magicaljellybea
then,
Download an ISO of Windows XP and burn to disk using Burnaware (http://www.burnaware.com/
Once thats on disk boot from disk and do a fresh install..
I had to do this recently on my friends laptop who was infected by 'Total Security'
Hope this helps
Try downloading MBAM again - but this time use the "Save As" function and rename it to something like MB.exe
Lots of malware will read the file names of the anti-malware apps and block them before you even get started. It sounds as though that is what happened to you.
Do the same thing with ComboFix (CF.exe).
---------------
Below is the basic recommendation for getting your system running correctly. Posting the "Log Files" for evaluation is critical so that we can take a look at what is going on in your system.
Either use MalwareBytes or Combofix (or both) and show us the logfiles.
1. Download Malwarebytes' Anti-Malware to your desktop, check for the tool's Updates before running a scan.
http://www.malwarebytes.or
2. Please download ComboFix by sUBs:
http://download.bleepingco
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcompute
or create a BartPE boot cd, it has all the tools you need (+ some others you can add)
http://www.nu2.nu/
http://www.nu2.nu/corpmodb
burn this to a cd, and boot from this cd and scan hdd, clean viruses, check logs etc...
better option if you cannot remove/install to another pc...
@Sci-Fi-Si & HainKurt - Scanning inert files on a 'Slaved' drive will not do much at all. You need to scan both the files and the processes that are running on a Windows computer that is booted to "Normal Mode".
If the problem can't be solved with MBAM and ComboFix, it makes sense to try something (anything) else - but those steps should not be taken until the more direct methods are tried.
Sci-Fi Si and HainKurt: I am going to go younghv's route first, and if it doesn't work, then I will go your route.
radoo2009: Does that take the keys from the current install?
younghv: I tried to run MBAM under a new name, but it did just like the other attempts and shut down.
Combofix, however, seems to be making more progress under a new name. I will post my results from that run.
-JT
As you're still not able to connect to the internet, try the IE options menu.
Click the connection tab, and ensure proxy is *not* selected.
Then try running this script to fix your connection. It will reinstall winsock, the TCP/IP stack, and the HOSTS file.
http://downloads.subratam.
Also ensure your antivirus and other Security programs are not preventing website access.
Once you've regained internet connectivity try running Malwarebytes again. You may still need to rename it.
From your ComboFix log results, you could manually install the Recovery Console once you have regained internet access. Then hopefully the infected eventlog.dll file problem (along with possibly others) can be resolved.
Scroll to sub-heading "Manually installing the Windows Recovery Console":
http://www.bleepingcompute
Please delete your version of Combofix and download the latest version... that one you have is expired that's probably why Combofix didn't fix the patched file(or maybe there isn't a clean one).
You need to use the latest version as CF should be able to take care of this infection. I looked in the log and I couldn't see a clean file....if the new CF won't do then perhaps we need to run other tools
c:\windows\system32\e
If it's not too much trouble, it's also a good idea to run these tools:(the logs are very helpful)
OTL will give us the locations of the clean file, and Win32Diag will remove all mountpoints created by the infection.
Download OTL to your Desktop
http://oldtimer.gee
Do
Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.e
%SYSTEMD
%SYSTEMDRIVE%\scecli.d
%SYSTEMDRIVE%\netlogon
%SYSTEMDRIVE%\cngaudit
%SYSTEMDRIVE%\sceclt.d
%SYSTEMDRIVE%\ntelogon
%SYSTEMDRIVE%\logevent
%SYSTEMDRIVE%\iaStor.s
%SYSTEMDRIVE%\nvstor.s
%SYSTEMDRIVE%\atapi.sy
%SYSTEMDRIVE%\IdeChnDr
%SYSTEMDRIVE%\viasraid
%SYSTEMDRIVE%\AGP440.s
%SYSTEMDRIVE%\vaxscsi.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files.
Please download this tool and run it.
http://ad13.geekstogo.c
Dou
A black command prompt window shall appear.
It will now begin to scan. This may take a while, please be patient until the scan is complete.
Once it's done, in the black screen it will say "Finished! Press any key to exit....
A log file called Win32KDiag.txt will be created on your desktop.
Please copy and paste the contents of that log file here in your next reply please.
Hey guys,
I did a lot of the things suggested since my last post. Here's a list, along with some observed notes.
Also, it should be said that everything I am doing is under "Safe Mode with Networking".
One other thing that I think might be of value. The corrupted laptop is running XP Professional, SP3. My non-corrupted work laptop is also loaded with XP Professional, SP3. If as a last resort you need me to copy some files from my version of XP over to the corrupted machine, I can. Also, my machine is a Dell Latitude D820, and the corrupted laptop is a Dell Latitude D620.
1. Combofix - downloaded newest version from bleepingcomputer, re-ran. Successfully fixed eventlog.dll, but took a couple of re-starts and re-do's to complete (restarts because it detected rootkit, re-do's because one time the malware shut it down. When I restarted, I got a message saying that this isn't a valid combofix. Deleted that version and copied over a fresh combofix under a new name and re-ran). During the run, it said that the AVG antivirus software is still installed and running. I uninstalled it a while back, because it seems that the malware has attached to it. Apparently it brought it back. I am unsure of the best approach how to remove/uninstall (other than just deleting the file and folders), as I unable to access the control panel since I still have an empty desktop. Additionally, since the internet connection is still broken on the laptop, Combofix was unable to install the recovery console. Logfile attached.
2. OTL - Ran program. Logfiles attached.
3. Win32kDiag - I actually ran this yesterday before posting this message on the forum. I re-ran it to get a new logfile. Logfile attached.
4. WinsockFix - Tried to download from the link provided, but the site is not responding. Went to majorgeeks and downloaded WinsockFixXP and ran it. After restart, still no internet connectivity.
Again, thank you all for your help and suggestions. This is a frustrating task for me, mainly because I'm encountering malware behavior I haven't faced in the past.
-JT
Additionally, I downloaded the latest version of Malware AntiBytes after the last posting. Instead of installing it in the suggested destination, I installed it into a folder under the root drive (C:\MBA). I ran it without it going to get an updated virus definition file. During a quick scan, it detected a trojan loader, win32k.sys. Using MBAM, I removed the file and restarted the machine (still in safe mode).
I am now running a full scan, and 8 minutes have elapsed. It has found 3 more objects that are infected. I will keep ya'll (hey...I'm in Atlanta :-) ) posted with the progress.
-JT
The best thing to do when your computer has huge problems like yours is a Format.
Then after installer fresh Windows you do all your windows update THEN you install anti-virus + firewall.
then you tell your friend to stop downloading Torrents and stop going in LimeWire.
It seems like a joke but im very serious. Dont play with infected objects you will burst hours for nothing.
Have fun
So so more updates:
1. HijackThis - I downloaded the latest version from TrendMicro and was able to successfully run it. Logfile attached.
2. Spybot S&D - I downloaded the latest version and the latest virus def. file. Ran the program and found nothing.
@Philippe - agreed about the torrents. Regarding the reinstalling, he didn't provide me with a cd as he wasn't given one with the laptop.
Any suggestions after seeing the log?
Thanks again,
-JT
Final Update:
So after doing some more runs of mbam and spybot, I finally got to a point where it shows no spyware/malware.
I then downloaded subinacl, and ran a batch process to restore all my permissions for the different files.
I now have a working desktop!
I've run a scan using Kapersky's online tool and it's showing nothing is present.
I'm in the process of updating the JRE, the windows and microsoft updates, and setting Spybot to run full time.
Thank you all for your help. Now the fun part...explaining to my idiot friend about the dangers of downloading torrents, lol.
It would've been easier if we run the Wind32kdiag.exe first(which I usually do with win2k.sys:1 win2k.sys:2 infections).
Glad to know you got there anyway.
Please run Win32Kdiag.exe using the command switch below to remove those mountpoints created by the infection, they are now just empty folders. The -f -r switch removes them - not by doubleclicking on the Win32KDiag.exe
Click on Start->Run, and copy-paste the following command into the "Open:" box, and click OK.
"%userprofile%\desktop\win
Business Accounts
Answer for Membership
by: houssam_balloutPosted on 2009-11-01 at 08:36:49ID: 25714259
Try system restore from command line:
http://www.tech-recip