Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Compuer Infected with Spyware...ouch...Happy Monday.


  • This topic is locked This topic is locked
6 replies to this topic

#1 joe_wa

joe_wa

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:10:50 PM

Posted 02 February 2009 - 07:34 PM

Computer started laughing at me today, and playing random music and movie clips. It then began to encounter several .exe problems, a.exe, winlogon.exe, etc. Then it started a Spyware 2009 application trying to get me to purchase a subscription. I have had several forced restarts and blue screens stating 'hard error'. Thanks in advance for any assistance.

Edited by joe_wa, 03 February 2009 - 02:39 PM.


BC AdBot (Login to Remove)

 


#2 joe_wa

joe_wa
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:10:50 PM

Posted 02 February 2009 - 10:24 PM

Just ran the SpyBot program. It detected smitfraud and a couple of others. I deleted them I believe.

Also, I'm running on SAFE Mode w/NETWORKING since I couldn't get the machine to start otherwise.

Here is the RSIT Log as well.

Edited by joe_wa, 03 February 2009 - 02:40 PM.


#3 joe_wa

joe_wa
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:10:50 PM

Posted 03 February 2009 - 02:00 AM

I'm now getting a winlogon.exe-Application Error on startup. "The instruction at "0x7c80cf3a" referenced at "0x470213dc". The memory could not be "written". Click OK to terminate the program. Click CANCEL to debug the program."

If I do anything with this alert box, whether it be OK, CANCEL or close it, the computer restarts.

I've installed OTCleanIt to my desktop, as recommended by other posts on here with similar problems. I have not run this yet, as I don't know what items to "kill" as noted in the same threads. I would assume that my system setup is not the same.

Finally, I've run SPYBOT Search & Destroy 160. I've tried to fix the problems identified, but the program doesn't fix several of the problems.

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:08:50 AM

Posted 03 February 2009 - 03:33 AM

Hi,

I see you are running Trendmicro Officescan.
So, this makes me think that this is a Company owned computer, or a computer used for work.
If so, then there are a few things that need attention first before we proceed with this..

* You must inform your Supervisor immediately.

This because of:
  • Most company machines are connected into a network at some time or other, and your infection may compromise the security of that network.
  • If sensitive material is compromised by an infection, your company could be held liable.
* Your Company must give permission for us to give you assistance.

This because of:
  • We are not here to replace your company's IT Department. If there's an IT Department, then they are responsible to deal with this.
  • There may be sensitive material on your computer that your company would not want revealed in an open forum.
Also, since this is a computer used at work - the first thing I always advise is to back up important files you don't want to lose, this since malware causes a system unstable and it may happen that it suddenly won't boot anymore, because of the damage already present.

The bad news is, this system is severly infected. Problem with these infections nowadays is, it causes a lot of damage. Even if we clean the malware off your system, I can't guarantee that your system will be clean afterwards, because these infections/bundles leave a lot of leftovers behind that most scanners won't even recognise and logs won't show.
Also, I can't promise you we can repair all the damage it caused... Even after cleaning the malware, you can still get errors afterwards because of the damage. Solving these is not always possible since it will be searching for a needle in a haystack to find the right cause and solution.
So, we can try to clean this up and do what we can, but keep in mind that we can't solve ALL problems this malware already caused.

If you use this computer for work, then I strongly recommend a format and reinstall. Because it would be irresponsible not to do so, this since this computer is so severly infected / compromised.
There are several backdoors + rootkits present here that have collected all passwords and other important info, and you will never be able to trust this computer again if you want to deal with it manually.

In case you want to deal with this manually anyway - then I will help you, but it's a huge risk you're taking. Also, don't expect miracles, because the malware already present damaged a lot and the damage cannot always be restored.
Anyway, your choice. Let me know in your next reply what you decide...
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 joe_wa

joe_wa
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:10:50 PM

Posted 03 February 2009 - 02:40 PM

miekiemos,
Thanks for the input. Yes, this "was" a work computer. It is off to IT. I was trying to get in to save some info, and was sort-of successful. That virus hosed up the laptop pretty bad. I should be receiving a new laptop tomorrow to replace this one. Whatever this virus is, it's bad news. I've also gone above and edited out the logs.
Thank you again for your input; please lock the thread.

#6 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:08:50 AM

Posted 03 February 2009 - 02:54 PM

Hi,

That's the best decision you could make. :thumbup2:
As a matter of fact, you were dealing with SEVERAL DIFFERENT infections, including nasty backdoors and rootkits.
In anyway, make sure this won't happen again, so please read my Prevention page with lots of info and tips how to prevent this in the future.
And if you want to improve speed/system performance after malware removal, take a look here.
Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#7 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:08:50 AM

Posted 05 February 2009 - 07:02 AM

Since this issue appears resolved ... this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users