Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Laptop seriously infected


  • Please log in to reply
7 replies to this topic

#1 Kat91119

Kat91119

  • Members
  • 128 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:06:01 PM

Posted 05 June 2009 - 05:25 PM

A family member brought over their 5 month old Acer Laptop for me to fix. It has Vista on it. Something I know nothing about. I don't know anything about laptops either.

It runs slow as heck. Takes sometimes 10+ minutes to boot up a program...if the program decides its going to load.

I've tried connecting to my internet with an Ethernet cord, but it just freezes up. Don't know if I have to configure the laptop somehow, or if the computer has too many issues.

I put Malwarebyes, Adaware, and AVG on a disc and transfered it to her computer. Adaware finally ran, it doesn't say AVG installed, and Malwarebyes kept giving me a runtime 0 error. Finally I tried installing Malwarebyes in Safemode, and I got it to work.

It found Rogue.A360Antivirus (in program files), Trojan.Agent (in Windows\WindowsUpdate.log), Hijack.StartMenu (in the registry). I'd copy and paste the log..but as I said, I cannot connect to the internet with that computer. I clicked on remove, it froze up then said the stuff was deleted, and I restarted.

Also, sometimes it freezes up and you'll get the blue screen of death, with the following error:
Kernel_data_inpage_error
Bowser.sys address A529d9d3 base at a5290000, datastamp 47918a7a

Edited by Kat91119, 05 June 2009 - 05:27 PM.


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,939 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:01 PM

Posted 05 June 2009 - 10:21 PM

If you are transferring programs to the infected computer, you can transfer MBAM's log and then copy/paste it back here for review.

Scanning with Malwarebytes Anti-Malware in safe or normal mode will work but removal functions are not as powerful in safe mode. MBAM is designed to be at full power when malware is running so safe mode is not necessary when using it. In fact, it loses some effectiveness for detection & removal when used in safe mode because the program includes a special driver which does not work in safe mode. Further, scanning in safe mode prevents some types of malware from running so it may be missed during the detection process. For optimal removal, normal mode is recommended so it does not limit the abilities of MBAM. Doing a safe mode scan should only be done when a regular mode scan fails or you cannot boot up normally.

Rescan again with Malwarebytes Anti-Malware but this time perform a Full Scan in normal mode and check all items found for removal. Don't forgot to check for database definition updates through the program's interface (preferable method) before scanning and to reboot afterwards. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs tab and copy/paste the contents of the new report in your next reply.

If you cannot update through the program's interface and have already manually downloaded the latest definitions (mbam-rules.exe) shown on this page, be aware that mbam-rules.exe is not updated daily. Another way to get the most current database definitions if you're having problems updating, is to install MBAM on a clean computer, launch the program, update through MBAM's interface, copy the definitions (rules.ref) to a USB stick or CD and transfer that file to the infected machine. Copy rules.ref to the location indicated for your operating system. If you cannot see the folder, then you may have to Reconfigure Windows to show it.
  • XP: C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware
  • Vista: C:\Documents and Settings\Users\All Users\Malwarebytes\Malwarebytes' Anti-Malware
Note: bowser.sys is a part of Windows Vista

KERNEL_STACK_INPAGE_ERROR

Explanation: This Stop message indicates that the requested page of kernel data from the paging file could not be read into memory. It might have been caused by a bad block (sector) in a paging file, a disk controller error, a defective motherboard, failing RAM, or because the stack signature in the kernel stack was not found. In extremely rare cases, it is caused when nonpaged pool resources run out.

technet.microsoft

Also see:
Troubleshooting KERNEL_DATA_INPAGE_ERROR in Vista
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Kat91119

Kat91119
  • Topic Starter

  • Members
  • 128 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:06:01 PM

Posted 07 June 2009 - 09:13 PM

I finally got everything to update via the internet. AVG hasn't found anything, and neither has Adaware. Malware found some more viruses though its normal scan not in safe mode. Here is the last "dirty" log I got.

Malwarebytes' Anti-Malware 1.37
Database version: 2240
Windows 6.0.6001 Service Pack 1

6/6/2009 11:29:48 PM
mbam-log-2009-06-06 (23-29-48).txt

Scan type: Quick Scan
Objects scanned: 72514
Time elapsed: 5 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NoAdware 5.0_is1 (Rogue.NoAdware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NoAdware5.0 (Rogue.NoAdware) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\NoAdware (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\program files\NoAdware\logs (Rogue.NoAdware) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NoAdware5 (Rogue.NoAdware) -> Quarantined and deleted successfully.

Files Infected:
c:\program files\NoAdware\noadware4_021709.na (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\program files\NoAdware\NoAdware5.exe (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\program files\NoAdware\nutilities.dll (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\program files\NoAdware\unins000.dat (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\program files\NoAdware\unins000.exe (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\program files\NoAdware\UninstlDll.dll (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\noadware5\NoAdware5 .lnk (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\noadware5\Uninstall NoAdware .lnk (Rogue.NoAdware) -> Quarantined and deleted successfully.
c:\Users\Owner\Desktop\NoAdware5.lnk (Rogue.NoAdware) -> Quarantined and deleted successfully.



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,939 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:01 PM

Posted 08 June 2009 - 09:52 AM

I wanted you to rescan with Malwarebytes Anti-Malware but perform a Full Scan, not a Quick Scan, in normal mode. Could you please do that now.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Kat91119

Kat91119
  • Topic Starter

  • Members
  • 128 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:06:01 PM

Posted 08 June 2009 - 12:30 PM

Sorry, just assumed that since I got everything workking normally it was good to do the normal quick scan.

Here is the full scan log.

Malwarebytes' Anti-Malware 1.37
Database version: 2248
Windows 6.0.6001 Service Pack 1

6/8/2009 12:58:39 PM
mbam-log-2009-06-08 (12-58-39).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 172734
Time elapsed: 1 hour(s), 54 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Owner\downloads\noadware.exe (Rogue.NoAdware) -> Quarantined and deleted successfully.



#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,939 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:01 PM

Posted 08 June 2009 - 12:57 PM

That looks better.

If there are no more problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista users can refer to these links: Create a New Restore Point in Vista and Disk Cleanup in Vista.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 Kat91119

Kat91119
  • Topic Starter

  • Members
  • 128 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:06:01 PM

Posted 08 June 2009 - 03:24 PM

Thank you very much for all your help

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,939 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:01 PM

Posted 09 June 2009 - 06:22 AM

You're welcome.

Tips to protect yourself against malware and reduce the potential for re-infection:Keep Windows and Internet Explorer current with all critical updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. If you're not sure how to do this, see Microsoft Update helps keep your computer current.

Avoid gaming sites, porn sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. To learn more about this risk, please read:Many security experts recommend you disable Autorun asap as a method of prevention. Microsoft recommends doing the same.

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...

Microsoft Security Advisory (967940): Update for Windows Autorun
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users