Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

unknown infection [Moved]


  • This topic is locked This topic is locked
6 replies to this topic

#1 535cheetah

535cheetah

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:28 AM

Posted 02 September 2009 - 02:00 AM

hello all ... new to the site, wish i wasnt at the site for this but.....

problems: (all this started 2-3days ago)

1. google will redirect to other sites often
2. homepage will sometimes be changed
3. programs that are suppose to run on startup, are not
4. tried to run a adaware program and tells me cannot connect to server or something of the like.
5. internet is sometimes very slow or wont work unless i refresh
6. tried mbam, wouldnt work, started but disapeared like other adaware program.
7. also tried combofix it worked once, but not all the way .... once computer rebooted it didnt finish. after that it wont work anymore.
I have tried a few things and nothing seems to be helping (much)

any help would be much appreciated!

Edited by 535cheetah, 02 September 2009 - 03:58 AM.


BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,947 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:05:28 AM

Posted 02 September 2009 - 05:55 PM

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:05:28 AM

Posted 02 September 2009 - 06:18 PM

We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#4 535cheetah

535cheetah
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:28 AM

Posted 03 September 2009 - 12:14 AM

downloaded, followed instructions, worked for 5 seconds then dissapeared. in the 5 seconds it listed one thing only thing i remember was "api" at the end. tried to run program again and get message

"windows cannot access the specified device,path,or file. you may not have the appropriate permissions to access the item."

#5 tomp999

tomp999

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:02:28 AM

Posted 03 September 2009 - 12:46 AM

Hello from TOMP,
I was having similar symptoms, along with the error "windows cannot access the specified device, path, or file"
scanners would start, but go away after a few moments. Then they wouldn't ever run again. (many EXE files had this problem)
Booting in Safe Mode I was able to reset the security on EXE files back to Administrators - Full Control, to avoid getting the "cannot access the specified device...", but still it would stop during the scan, and then wouldn't run again (it got reset back to no permissions).

Eventually I found that I could REName EXE files to CMD extension and double-click Run them.

I copied the latest combofix.exe to the desktop from a flash drive.
Then I copied combofix.exe to runner.cmd, also on the desktop, and ran runner.cmd.
It ran all the way through rebooted, went thru it's stages and cleaned the rootkit that was causing the "cannot access" errors.
(note that I left combofix.exe on the desktop also, in case it was called out by it's original name on future auto-restarts during it's process, I dunno)

Then I went to C: root and reset permissions on all child objects so all the EXE files would get the permissions back so I could run them again (instead of doing each one by hand)
Then I went through MalwareBytes, SAS, etc scans, and cleaned off all the "little" viri that were still there.
Tonight I'm clean again :thumbsup:
Good luck!
TOMP

Edited by tomp999, 03 September 2009 - 12:54 AM.


#6 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:05:28 AM

Posted 03 September 2009 - 10:15 AM

Combofix is not to be used, or logs posted, in this forum

See if you can run this:



1. Download Win32kDiag from any of the following locations and save it to your Desktop

http://ad13.geekstogo.com/Win32kDiag.exe

http://download.bleepingcomputer.com/rootr.../Win32kDiag.exe

2. Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
3. When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.
4. Start a new topic in the HJT forum: http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/
Give a brief description of your problem and tell the you could not run the DDS scan
5. Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log in your post
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#7 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,947 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:05:28 AM

Posted 03 September 2009 - 09:59 PM

@ tomp999

Every mix of malware and computer software is unique. What will solve one computer's issues may not solve another's. Further, just because symptoms are gone does not mean that the infection is gone.

Please note: ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert." It is NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Running ComboFix by yourself is like performing open heart surgery on yourself--the scalpel and other surgical tools that is ComboFix is meant to be wielded by a highly trained surgeon only in emergencies or dire circumstances. When the surgeon is thru s/he leaves the room. So combofix should be removed from a system once it has accomplished its job, unlike an AV that is there to protect you from future infections.

. . . CF does make some alterations to your system if you run it. Even if you had no malware removed and run the uninstall command, some things may be different now on your system. I can tell you that one thing is that all your restore points will be flushed out and a new one created. There is a good reason to do that when you have a severe infection--but if you aren't infected you might need those restore points.

Read and abide by the disclaimer people. It's there for a reason. Stick to running and protecting yourself with a good AV and firewall and an anti-malware scanner or two. If you feel you need a second opinion, try running online scans. If you feel you might need surgery, come here to BC and ask for help--that is what we're here for.


From: http://www.bleepingcomputer.com/forums/ind...t&p=1159014


@ 535cheetah

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/254900/unknown-infection/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days, perhaps less, to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users