I am writing to solicit assistance for helping to clean up the last few issues I am having as the result of getting infected with a Bagel variant.
I had executed an inappropriate file and fragged my system ... I immediately know that something was amiss (reasons as to why escape me now) .
At any rate, after much fighting with the darn bug, I was able to rid it of it's hooks in my system, but it had left some nasty side effects. The results of which I have nearly gotten rid of (McAfeee not running, NDIS getting vaporized, no wireless connectivity, etc.).
I was surprised at how targeted the malware was - hooking into explorer and changing executables to render them invalid (IceSword), etc.
Anyways, I have a few symptoms that after hours of trying to resolve, I am no where nearer getting them fixed, and am throwing in the towel and humbly asking for help.
The remaining symptoms, that I am aware of, are:
- Wireless Adapter Connects, but fails to get a good IP - always results in the win32 default ip being assigned - 169.254.248.79 with subnet mask of 255.255.0.0 - Gateway, DNS, and WINS server ips are all blank (null)
- The Service Windows Driver Foundation - User-Mode Driver Framework won't start - barfs up Error 31: A device attached to the system is not functioning...
- Booting into safe mode yields dialog about resources being locked as read only and being unable to authenticate the copy of windows and forces a log out (the OS is legit and came installed from the OEM).
I was able to get rid of the executables that floated around, and removed the various reg keys that I was able to ascertain as being faulty, reinstalled McAfee VSE 7.1.0 and updated it with the latest DATs and engine. I was unable to even boot to safemode, but used Dial-a-fix to restore the corrupted keys and was able to finally get it to boot safe without a BSOD showing up. Now Safemode gives the dialog described above.
I have printed (to .pdf) the prep-guide from herein. I have the following tools available for use:
- Ad-Aware SE
- Dependancy Scanner
- Process Explorer (from SysInternals [MS])
- RegMon (from SysInternals [MS])
- FileMon (from SysInternals [MS])
- Winspector Spy
- Trojan Remover
- Helios Lite
- HJT (uninstalled)
- modservices (uninstalled)
- roguescanfix (uninstalled)
- smitfraud & smitrem (both uninstalled)
- spybotsd1.52 and the include (both uninstalled)
- stinger from NAI (stng380.exe)
- McAfee Virtual Tech app
- AVZ 4.29
- WinPatrol PLUS v12.0.2007.6:12.0.2007.6 (runs at boot)
- McAfee VirusScan Enterprise v7.1.0 with 5267 DATs and 5.2.00 Engine (installed as service)
- and all of the win32 tools (MSConfig/MSInfo/GPE/etc.)
Up until I acted like a moron and kicked off the infected malware, the machine was surprisingly stable.
It is now, once again, running stable, barring the symptoms described above.
I just got done with a 16+hr AVZ deep scan on the system.
If one of the Malware experts could please take me under their wing and walk me through getting the last of these issues resolved, I'd be greatly appreciative of it, and would reciprocate in any manner appropriate.
Thank you very much, in advance, for your time, consideration, and assistance.
Edited by Wulffy, 05 April 2008 - 05:41 PM.