Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HELP ME !!! PLEASE!!! CANT START WINDOWS!!


  • Please log in to reply
6 replies to this topic

#1 diaz9220

diaz9220

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:42 AM

Posted 05 October 2009 - 12:12 AM

2 days ago i was on the internet and out of nowhere my computer gave me this message that i cant remember what it said. Something like taskdel.exe or something of that sort and i click ok to just remove it and it came back up instantly so i xd it out and it came back instantly. did this about 20 times and then bam my windows close and my computer shut down. so im like ok no big it just decided to shut down. So i go to turn it back on and then the windows splashscreen is up. soon after it, i get a BSOD sayin Stop C0000218
So i rebooted and nothing. I inserted my XP INstall disk to run the repair and it wouldnt let me do it. It would boot from cd press any key message and then it would say NTLDR missing. so i was stuck. So im here now at my bros computer with the infected harddrive pluged in as slave and i go in to look in the system 32 directory and i find out that there are multiple files with virus prefixes. Kungsf UAC TDSS Gasfky. i tried renameing them and deleting them but i doubt that it will work like that. Anyone know what i should use to delete infections and scan the drive through my bros computer?
please help i have alot of valuable work in this hard drive!

Edit:
Also, when the safemode screen comes up, the one that pops up after windows doesnt load properly, i cannot move my arrows to select Load last known good configuration. I tried gettin into the bios and i cant move my arrow keys in there either. but when i get into the restore console, my keyboard works.

Edited by diaz9220, 05 October 2009 - 12:14 AM.


BC AdBot (Login to Remove)

 


#2 diaz9220

diaz9220
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:42 AM

Posted 05 October 2009 - 12:53 AM

Also i forgot to mention.
When i try to do something with the recovery console i cannot use any of my keyboard. Only when im in the actual instalation process or the Dos command.
So you know, i cannot access my desktop when i insert my hard drive into my PC. I can only see and access files by slaving the drive on my brothers computer. Can i still repair the harddrive and remove the malware if i install malwarebytes or that combofix thing on this computer?

#3 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:05:42 AM

Posted 05 October 2009 - 10:58 AM

Kungsf UAC TDSS Gasfky
Your best option would be to reformat and reinstall


Please download Win32kDiag.exe by AD and save it to your desktop.
alternate download 1
alternate download 2
  • This tool will create a diagnostic report for me to review.
  • Double-click on Win32kDiag.exe to run and let it finish.
  • When it states Finished! Press any key to exit..., press any key on your keyboard to close the program.
  • A file called Win32kDiag.txt should be created on your Desktop.
  • Open that file in Notepad and copy/paste the entire contents (from Starting up... to Finished! Press any key to exit...) in your next reply.

    --------------------------------------
Go to Posted Image > Run..., then copy and paste this command into the open box: cmd
Click OK.
At the command prompt C:\>, copy and paste the following command and press Enter:
DIR /a/s %windir%\scecli.dll %windir%\netlogon.dll %windir%\eventlog.dll >Log.txt & START notepad Log.txt
A file called log.txt should be created on your Desktop.
Open that file and copy/paste the contents in your next reply.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#4 diaz9220

diaz9220
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:42 AM

Posted 05 October 2009 - 12:41 PM

Running from: C:\Documents and Settings\Lucho\My Documents\Downloads\Win32kDiag.exe

Log file at : C:\Documents and Settings\Lucho\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!

_______________________________________

That was what the log said. I didnt do the cmnd u told me to do because this isnt my computer and, again, im trying to repair my Hard drive. So im on a different computer with the infected harddrive (D:\) . The current hard drive on this computer is set to C:\ . Is there anything i can do to run that Win32diag on my infected harddrive?

#5 diaz9220

diaz9220
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:42 AM

Posted 05 October 2009 - 03:20 PM

Is it possible for my bios to be infected?
Because when i boot up with my actual HD with all my data on it. It will give me teh option to boot in normal mode, last known good config, or safemode. But i cannot select any for somereason and it will automatically just countdown when the Start in normal mode is selected. Its like my keyboard is ignored and it will not do anything for me. Aswell as when i hit my del key to enter the bios. It will enter bios but when im in there, i cannot select anything. Its like the keyboard freezes when in those screens or as if my bios screen freezes up.

#6 diaz9220

diaz9220
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:42 AM

Posted 05 October 2009 - 08:33 PM

i did a MBAM scan and this is what the log contained. it says D:\ Drive because it is hooked up to my bros computer therefor it is not the master HD. HD is SATA

Malwarebytes' Anti-Malware 1.41
Database version: 2910
Windows 5.1.2600 Service Pack 2

10/5/2009 3:12:50 PM
mbam-log-2009-10-05 (15-12-42).txt

Scan type: Full Scan (D:\|)
Objects scanned: 65876
Time elapsed: 1 hour(s), 40 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 21

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
D:\anlqrvl.exe (Rogue.Installer) -> No action taken.
D:\ehrrg.exe (Trojan.Vundo) -> No action taken.
D:\hufa.exe (Trojan.Dropper) -> No action taken.
D:\link.exe (Rootkit.TDSS) -> No action taken.
D:\Documents and Settings\UserFolder\Application Data\3435100170\3435100170.exe (Rogue.SecurityTool) -> No action taken.
D:\Documents and Settings\UserFolder\Desktop\Adobe\AdobePS4\Adobe CS4 Activation Patch\AdobeCS4.exe (Trojan.Downloader) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\UACb475.tmp (Rootkit.TDSS) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\debug.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\1BF9.tmp (Rootkit.Agent) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\ay9n327gk.exe (Trojan.Downloader) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\wrdwn15 (Rogue.AntiVirusPro) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\wrdwn18 (Rogue.AntiVirusPro) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\wrdwn21 (Rogue.AntiVirusPro) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\wrdwn27 (Rogue.AntiVirusPro) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\wrdwn5 (Rogue.AntiVirusPro) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\gasfkyjwtsibappo.tmp (Rootkit.TDSS) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\drweb.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\sdu5sq.exe (Trojan.Downloader) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\mdm.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\1980143331.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\UserFolder\Local Settings\Temp\wrdwn11 (Rogue.AntiVirusPro) -> No action taken.

Edited by diaz9220, 05 October 2009 - 08:34 PM.


#7 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:05:42 AM

Posted 05 October 2009 - 08:51 PM

you need to submit a DDS / HJT log


Please read the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". If you cannot complete a step, then skip it and continue with the next. In Step 6 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.

There will also be instructions to create a Root Repeal Log

When you have done that, post your log in the HijackThis Logs and Malware Removal forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

The HJT team is very busy and it will take awhile to get to your post
Please be patient and good luck

Edited by garmanma, 05 October 2009 - 08:52 PM.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users