BleepingComputer.com: Desktop will not accept XP updates

ESET finally finished and found and quarantined several files. Here is the report:

C:\Documents and Settings\Owner\Desktop\FS-C1-VP-BX2_Driver Today.zip a variant of Win32/Mepaow.AA trojan deleted - quarantined
C:\Documents and Settings\Owner\Desktop\BleepingComputer docs\Best_Boot_Disk_Fix_Windows_Restore_Repair.zip multiple threats deleted - quarantined
C:\Documents and Settings\Owner\Desktop\BleepingComputer docs\UTILCD.iso multiple threats deleted - quarantined
C:\Documents and Settings\Owner\Desktop\Cnet files\utility cd\ODDTOOLS\KEYFINDER.EXE a variant of Win32/PSWTool.RAS.A application deleted - quarantined
C:\Documents and Settings\Owner\Desktop\FS-C1-VP-BX2_Driver\FS500.exe a variant of Win32/Mepaow.AA trojan cleaned by deleting - quarantined
C:\Documents and Settings\Owner\My Documents\UBCD4Winv312download\UBCD4WinV312.exe multiple threats deleted - quarantined
C:\System Volume Information\_restore{9D1A4C99-E141-4B32-851C-B01FBAF27868}\RP935\A0174548.exe a variant of Win32/Adware.AdvPCTweak application cleaned by deleting - quarantined
C:\System Volume Information\_restore{9D1A4C99-E141-4B32-851C-B01FBAF27868}\RP972\A0181441.EXE a variant of Win32/PSWTool.RAS.A application deleted - quarantined
C:\System Volume Information\_restore{9D1A4C99-E141-4B32-851C-B01FBAF27868}\RP972\A0181442.exe a variant of Win32/Mepaow.AA trojan cleaned by deleting - quarantined


I think I got most of them from a UtilCD called something like Best Boot Disk for XP or something close. I am going to try installing my updates again now.

No luck. Updates failed to install again. Maybe I need to reboot and try again.

This post has been edited by tyl604: 04 May 2011 - 09:13 PM

Ok, yes looks like you installed a creacked or infected utility that appears was infected. Did you also instal the Magic Jelly bean and/or Rock XP??

Reboot and try Killer again.

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to these[/color] instructions. [color=green]In some cases it may be necessary to redownload TDSSKiller and randomly rename it before downloading and saving to the computer.

Do not recognize Jellybean or RockXP so do not think I have downloaded either.

Killer will not run in normal mode. It says it cannot load driver. I tried renaming it but still will not run. It will also not run in Safe because the icon does not appear on the Safe desktop. I even tried to copy it to my thumbddrive and run in Safe from the thumbdrive; however, for some reason, in Safe I cannot find it loaded on the thumbdrive.

Not sure what to do now. Updates will still not work. Dr. Web will still not work; says my license has expired. Also I am running IE8 if it matters.

This post has been edited by tyl604: 05 May 2011 - 08:58 AM

Well we can fix this,only iy will take a few days as we need to move you and the MRL guys are backed up a couple days. We have something buried and need to dig it out.

Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

I have already posted this answer but it did not seem to make it through the ethernet. So here goes again.

I finished everything and posted it as directed. I could not figure out which one was only supposed to be posted as a zip file - so everything is in the clear.

Gmer would not run. Said there was a driver error. It then seemed to run but would not let me add any check to other boxes. The output report did not seem to say anything.

I ran Avira on four boot discs that I copied from the internet and sure enough it identifed the trojans and bad stuff. So I asked Avira to quarantine those files and I threw the discs away.

Everything is posted as you requested and I will be interested to hear the feedback. Thanks for your help. (What are MRL guys?)

This post has been edited by tyl604: 05 May 2011 - 02:25 PM

Hi, MRL, Malware Removal Logs guy/gals
We train our own team of specialists to find and remove difficult malwares..

It will take a few days for them to anlalyze your logs and repy,but they will as ALL logs are answered at BC.

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.