Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan / Unable to normally


  • This topic is locked This topic is locked
18 replies to this topic

#1 Sprite Monkey

Sprite Monkey

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 05 July 2009 - 08:35 PM

I was infected by a website I visited. A bunch of strange warnings popped up on my computer so I shut it down and disconnected the computer from my network. I tried to run Ad Aware which found a trojan and tried to delete it on reboot, only it kept resurfacing. I tried to run spybot S&D, but it wouldn't open. Then I tried to boot in safe mode to run these programs but it gave me a bsod when I tried that. I downloaded on a different computer AVG and PC Tool Antivirus. AVG found infections but was unable to clean them. PC Tools Antivirus crashed and was unable to solve any problems. I used Piriform's CC Cleaner to identify weird programs in my start up and then searched for them on the computer and deleted them. At that point, windows froze and I lost my task bar. I did a hard shutdown and restarted my computer, but windows would not boot up properly. So here I am looking for advice.

Any assistance you all could offer would be greatly appreciated, thank you very much.

BC AdBot (Login to Remove)

 


m

#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,114 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:50 PM

Posted 05 July 2009 - 08:50 PM

Hello, first I am moving this from XP to Am I Infected as You still may be.

If you have Spybot installed temporarily disable it.
We need to disable Spybot S&D's "TeaTimer"
TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can reenable it when we're done if you like.
  • Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
  • If prompted with a legal dialog, accept the warning.
  • Click Posted Image and then on "Advanced Mode"
    Posted Image
  • You may be presented with a warning dialog. If so, press Posted Image
  • Click on Posted Image
  • Click on Posted Image
  • Uncheck this checkbox:
    Posted Image
  • Close/Exit Spybot Search and Destroy

Next run ATF:
Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

Please download ATF Cleaner by Atribune & save it to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main "Select Files to Delete" choose: Select All.
  • Click the Empty Selected button.
  • If you use Firefox browser click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • If you use Opera browser click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.

Next run MBAM (MalwareBytes):

NOTE: Before saving MBAM please rename it to zztoy.exe....now save it to your desktop.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 Sprite Monkey

Sprite Monkey
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 05 July 2009 - 09:00 PM

Thanks for your quick reply.

Unfortunately at this time, I am not able to access my start button as windows is not booting properly. If you can, please help me get up and running so I may further follow your advice.

Thank you again in advance.

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,114 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:50 PM

Posted 05 July 2009 - 09:08 PM

You have no Start button>>??

You need to run sfc /scannow

You will need your XP CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the XP CD when asked.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 Sprite Monkey

Sprite Monkey
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 05 July 2009 - 09:12 PM

After I try to log on to my user, I have my background, but no desktop icons, no taskbar, and no start button.

This is my friend's old PC that he gave me because I did not have a computer. He doesn't have the CDs anymore, I needed them when I tried to install the Japanese language support. Is there another solution?

Edited by Sprite Monkey, 05 July 2009 - 09:13 PM.


#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,114 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:50 PM

Posted 06 July 2009 - 09:46 AM

Hello can you borrow an XP cd to run sfc?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 Sprite Monkey

Sprite Monkey
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 06 July 2009 - 06:51 PM

Hello can you borrow an XP cd to run sfc?


I reached out to a few of my friends today to see if I could find one but so far I haven't had any luck in finding a disc.

#8 Sprite Monkey

Sprite Monkey
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 07 July 2009 - 10:15 AM

I can't find anyone with a Windows XP CD. They either don't have it or they're running vista now. Are there any alternative solutions when I can run off of a boot CD or some other way to verify the files are intact?

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,114 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:50 PM

Posted 07 July 2009 - 11:50 AM

ask this in the XP forum ...Someone will have an idea on that.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 Sprite Monkey

Sprite Monkey
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 07 July 2009 - 01:50 PM

Update.

Ran sfc /scannow with an XP CD. It had me click retry over 100 times because it would keep stopping, but I made it all the way through the progress bar. When it was done, nothing changed so I restarted the computer, logged on to my user, and I still have no task bar, start button, or desktop icons.

By the way, thanks for all your help so far.

#11 Sprite Monkey

Sprite Monkey
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 08 July 2009 - 08:18 AM

On the off chance "see post 4" meant run sfc /scannow again, I tried it again. When it was finished, there was no change to the system. I restarted, and there was no change to the system again, I still have no start button, task bar, or desktop icons. Attempting to run explorer.exe or c:\windows\explorer.exe through the task manager still results in an error. Still cannot boot into safe mode due to the blue screen error, both errors noted here.

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,114 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:50 PM

Posted 08 July 2009 - 09:51 AM

We need to repair some of windows' internal registration settings
  • Please download Dial-A-Fix from one of the following mirrors:
  • Extract the zip file to your desktop.
  • Double click Dial-a-Fix.exe to start the program.
  • Press the green double checkmark box (Looks like this: Posted Image)
  • UNcheck "Empty Temp Folders", as well as "Adjust Time/Date" in the prep section. The prep section should then look like this:
    Posted Image
  • When the window looks like this, press the GO button in the bottom of the window.
    Posted Image
  • Exit/Close Dial-A-Fix

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 Sprite Monkey

Sprite Monkey
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 08 July 2009 - 07:20 PM

I did those things to the best of my ability. Since I have no access to my pc's windows explorer or the internet to download a program, unzip it, or click on the icon to run it, I downloaded Dial-A-Fix to a working computer, unzipped it, and then moved it onto a thumb drive. I then booted up my PC and attempted to run Dial-A-Fix via the task manager from the thumbdrive. I followed the check box instructions perfectly.

Dial a Fix encountered an error that reads:

"Error -2147024891 was encountered while trying to unregister C:\WINDOWS\system32\wuaueng.dll. The error text is: Access is denied.
Dial-a-fix currently has no suggestions for this error code. Please email dial-a-fix@DjLizard.net with a copy of the log pane and any details you can provide about this error."

I clicked ok, then:

"An error occurred during the registration of the fil: C:\WINDOWS\system32\wuaueng.dll (version 7.2.6001.788). The next dialog will contain an error code and possible suggestions."

I clicked ok, then:

Error 0x80070005: 'Acess denied'. It is suggested that you run "Repair permissions" which is found in the Tools dialog. Windows XP Home users will need secedit.exe to perform the repair - [url="http://DjLizard.net/software/secedit-sfx.exe""]http://DjLizard.net/software/secedit-sfx.exe"[/url]

I clicked ok. Dial a fix then completed running. I shut down and attempted to restart my computer in safe mode but recieved the same error as before. I shutdown and attempted to start Windows normally but still had no task bar, start buttons, or desktop icons.

In the background behind the Dial-A-Fix box you mentioned, there was another Dial-A-Fix dialogue box that was not mentioned that might be helpful. The box was titled "Dial-a-fix: Restrictive Policies"

Then there was a table below it:

Hive Key Value Type
HKEY_CURRENT_USER Software\Microsoft\Windows\Currentversion\Policies\Explorer\NoFolderOptions 1 REG_DWORD
HKEY_CURRENT_USER Software\Microsoft\Windows\Currentversion\Policies\System\DisableRegistryTools 1 REG_DWORD
HKEY_LOCAL_MACHINE Software\Policies\Microsoft\WindowsNT\SystemResore\DisableSR 1 REG_DWORD

Remove Posted Image X Rescan [] Hide disable policies CLOSE

3 possible restrictions were found."

When I posted in the Windows XP forum as you instructed, joseibarra mentioned that it looks like the virus changed permissions on my computer. OrangeBlossom moved the thread back to Am I Infected?. Would removing these policies allow me to run explorer again?

Edited by Sprite Monkey, 08 July 2009 - 07:23 PM.


#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,114 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:50 PM

Posted 08 July 2009 - 09:49 PM

Can you run this HotFix from MSFT off that USB?
http://support.microsoft.com/kb/948277/en-us
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 Sprite Monkey

Sprite Monkey
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:11:50 PM

Posted 09 July 2009 - 07:42 PM

Moved the .exe onto the thumb drive I recieved in my email and ran it through the file manager and it extracted an .exe file which I put on my desktop. Tried to run the new extracted .exe file and while it was running this dialogue box:

"Extracting Files

Extracting File:
To Directory: c:\6f594755cb56031f14ef01c5d2feae3e"

an error appeared:

"Extraction Failed

File is corrupt"

Do the restrictions that Dial-A-Fix listed have any bearing on the problem I'm having?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users