Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Problem with AV hang, dds.scr not running, Search redirect


  • This topic is locked This topic is locked
7 replies to this topic

#1 3panther

3panther

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:47 PM

Posted 03 April 2009 - 04:53 PM

I am having issues with Anti Virus tools hanging, search redirection and I can't get cmd to run. Trying to get ddr.scr to run results in a quick flash of what looks like the command prompt but then it goes away. I am currently offline with that machine due to the issues it was having, I download the dds.scr to USB stick and put in on the desktop that way.

Originally I am pretty sure I had the conficker issue as I could not update windows, then I tried to update and run the anti-virus software. That didn't work either. On the Microsoft website was a description of how to manually do the update, which required editing the registry. I did that and identified kmsvc.dll as a potential culprit. Removing that allowed me to get to update one time, however on restart, I could not again. I did run SuperAntispyware and MBAM with neither showing a problem, but the issues with redirection on searches persisted. It was taking some 6 hours or so for the scans so I have since uninstalled some of my larger programs, and reinstalled SuperAntispyware and MBAM from a clean computer when I downloaded dds.scr. I was trying to generate the two dds.scr logs to send one along, but as stated above that did not work.

So at this point I am very concerned with what is going on, and how much of my personal information could be compromised by these events. Please let me know which tools you would like me to run and what additional information could make your job easier. And BTW: Thank you in advance

Machine Dell XPS 600, Pentium D
Windows XP, SP3, Build 2600
2GB RAM, 250GB HD

On the machine are the following tools downloaded to a clean laptop and transferred to the machine via USB stick.
Superantispyware
Malwarebytes antimalware
Spybot SD
Ad Aware
Spyware Blaster
HJT
OTListIT2
ATF-Cleaner


I haven't run all of these yet, but I have been collecting as I have been reading others' posts so they are available.

BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:02:47 AM

Posted 03 April 2009 - 06:08 PM

Hi,

Do you have MBAM installed on the good computer? This because it targets and removes this pest, but since you can't update it, you need to transfer the update file from the good to the infected computer.
So, update mbam first on the good computer - make sure it's version 1.35 and database version 1937 (or higher). Then navigate to the C:\Documents and settings\All Users\application data\MalwareBytes\Malwarebytes' Anti-Malware - folder and in there you'll find the file rules.ref
In case you're using Vista, the file will be present in C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware
Transfer that file via usb to the infected computer and let it overwrite the existing rules.ref (make sure your mbam is closed when you do that)

Then run MBAM on the infected computer, let it reboot (IMPORTANT) and post the log in your next reply.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 3panther

3panther
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:47 PM

Posted 03 April 2009 - 06:48 PM

So on reboot, it just continually reboots. That is new behaviour, I tried safe mode with no luck.

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:02:47 AM

Posted 03 April 2009 - 06:54 PM

Can you post the malwarebytes log please?
Also a hijackThislog?
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:02:47 AM

Posted 03 April 2009 - 07:36 PM

Looks like it's more aggressive then we thought. We can't reproduce this here with the same infection, so can you test something please?
From the F8 menu, can you select "disable automatic restart on system failure" - then let me know what exact errors you see.
This should tell us what this piece of malware exactly does at reboot when scanners are trying to delete it.
To get back into Windows, use the "last known good" option afterwards. Then post the mbam log and a HijackThislog.

Edited by miekiemoes, 03 April 2009 - 07:39 PM.

AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#6 3panther

3panther
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:47 PM

Posted 03 April 2009 - 08:59 PM

I haven't been able to get back into the computer. I have booted off the install disk, gone to the repair screen. The C: is not available and chkdsk gives me the following error " The volume appears to contain one or more unrecoverable problems"


Any ideas?

#7 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:02:47 AM

Posted 04 April 2009 - 03:22 AM

Hi,

This looks like something was actually already damaged before though. This error may be caused by a corrupt file system or bad ram. Could also because your MBR got corrupted.
Please read here: http://support.microsoft.com/kb/314503
I don't know what else you've tried on the computer already besides running those extra scans, but if your ram was already faulty and you've used a lot of things in between that puts extra stress on the cpu, it may indeed give that as a result.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#8 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:02:47 AM

Posted 16 April 2009 - 07:13 AM

Since there is no feedback anymore, I assume this issue is resolved ... so, this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users