Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MBR Rootkit


  • This topic is locked This topic is locked
24 replies to this topic

#1 Mrbob2

Mrbob2

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Location:California
  • Local time:11:35 PM

Posted 01 January 2010 - 03:09 PM

I recently got a Rootkit warning on my laptop from Avast. I quarantined the files and it seemed the more i tried to get rid of the worst it got. I ran malware bytes AVAST and Rootkit removal toolsand it appeared I got rid of the infection. I rebooted the computer and I got the blue screen of death. I was able to reinstall a different version of windows because I could not find my original disks to restore the laptop. It worked for a few days until I started to get warnings again. I ran a startup scan with AVAST and it came back with a error due to the chest service not working. When I rebooted the computer it went into a loop of not wanting to restart and windows will not install without a format. It says it is missing NTDetect and NTLDR. I tried to copy those files but it did not help. During the installation of windows it is unable to install the files from the I386 folder.
I removed the drive to read it on another computer and all of the folders are now scrambled as in Marlett font I think. See attached screen shot.
I ran the program testdisk and it appears the data is all there but can not be read. All programs that I have ran MWB, Rootrepeal, stinger, removit seem to say there is a problem or nothing found is found.. Where do I go from here??? :(
Is there a way to run Hijack this on a F:\ drive???
Thanks, Bob

EDIT from AII Topic..boopme
I am infected with a virus or malware and found this forum http://www.bleepingcomputer.com/forums/t/280931/win-xp-pro-wont-boot/. It is the same problem I have. I installed Hiren's boot CD and was able to start my computer and get a internet connection. But that is were the problem is different. I can not run dds-bootcd program. It does not give a report. I moved it to the root directory and I have the same problem. All of the folders are scrambled with what I think is the Marlett font. It is full of squares and funny characters. My drive is a 60 gig drive but is only showing 10 gigs. I ran the program cleanit and can see that the files are intact they are just scrambles.
So I am unable to back up my drive. All I want to do is to save my data and then wipe this drive clean.
Thanks for your help and response.
Bob

ROOTREPEAL AD, 2007-2009
==================================================
Scan Start Time: 2010/01/01 11:19
Program Version: Version 1.3.5.0
Windows Version: Windows XP Media Center Edition SP2
==================================================

Hidden/Locked Files
-------------------
Path: Volume F:\
Status: MBR Rootkit Detected!

Path: Volume F:\, Sector 1
Status: Sector mismatch

Path: Volume F:\, Sector 2
Status: Sector mismatch

Path: Volume F:\, Sector 4
Status: Sector mismatch

Path: Volume F:\, Sector 7
Status: Sector mismatch

Path: Volume F:\, Sector 8
Status: Sector mismatch

Path: Volume F:\, Sector 10
Status: Sector mismatch

Path: Volume F:\, Sector 29
Status: Sector mismatch

Path: Volume F:\, Sector 30
Status: Sector mismatch

Path: Volume F:\, Sector 32
Status: Sector mismatch

Path: Volume F:\, Sector 50
Status: Sector mismatch

Path: Volume F:\, Sector 51
Status: Sector mismatch

Path: Volume F:\, Sector 53
Status: Sector mismatch

Path: Volume G:\
Status: MBR Rootkit Detected!

Path: Volume G:\, Sector 1
Status: Sector mismatch

Path: Volume G:\, Sector 2
Status: Sector mismatch

Path: Volume G:\, Sector 4
Status: Sector mismatch

Path: Volume G:\, Sector 7
Status: Sector mismatch

Path: Volume G:\, Sector 8
Status: Sector mismatch

Path: Volume G:\, Sector 10
Status: Sector mismatch

Path: Volume G:\, Sector 29
Status: Sector mismatch

Path: Volume G:\, Sector 30
Status: Sector mismatch

Path: Volume G:\, Sector 32
Status: Sector mismatch

Path: Volume G:\, Sector 50
Status: Sector mismatch

Path: Volume G:\, Sector 51
Status: Sector mismatch

Path: Volume G:\, Sector 53
Status: Sector mismatch

Attached Files


Edited by boopme, 02 January 2010 - 05:03 PM.


BC AdBot (Login to Remove)

 


#2 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,702 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:03:35 AM

Posted 10 January 2010 - 11:40 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+


#3 Mrbob2

Mrbob2
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Location:California
  • Local time:11:35 PM

Posted 11 January 2010 - 09:35 PM

Hi Thanks for your help. I can get the DDS to run. Here is what I have done or seen. When I first got the rootkit warning with AVAST I worked to get rid of through scans and the rootkit removal tool. The warnings came back and I got the blue screen of death. I was able to reload windows and fix the problem. I thought I would do a boot scan one more time and after that scan I got a virus chest error and then the computer went dead. I was not able to reload windows this time I can only reformat the drive.
I took the drive out and put it on another computer and that is how I saw the funky font on the files.
Like I said above I can only run the Hirens boot disk and the DDR does not run. It shows up the small window but it goes away and no report shows up.
When you start up the computer it gives you the NTDLR is missing.
I am here and waiting for your response. Thanks for you time and help.
Bob

#4 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:35 AM

Posted 13 January 2010 - 03:50 PM

Hello, Mrbob2
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the Posted Image button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Please reply using the Posted Image button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
  • Please set your system to show all files.
    Click Start, open My Computer, select the Tools menu and click Folder Options.
    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
    Uncheck: Hide file extensions for known file types
    Uncheck the Hide protected operating system files (recommended) option.
    Click Yes to confirm.


  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
  • Push the Quick Scan button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#5 Mrbob2

Mrbob2
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Location:California
  • Local time:11:35 PM

Posted 13 January 2010 - 09:31 PM

Hi Tom, I want to start off by thanking you for your time and help in fixing my Bleeping computer. This is the first time I have ever been hit this bad with a virus so maybe I had it coming. Anyway here are the logs.

OTL Extras logfile created on: 1/13/2010 6:20:23 PM - Run 1
OTL by OldTimer - Version 3.1.24.0 Folder = X:\Documents and Settings\Default User\Desktop
Windows XP Professional Edition (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2800.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 599.00 Mb Available Physical Memory | 67.00% Memory free
700.00 Mb Paging File | 293.00 Mb Available in Paging File | 42.00% Paging File free
Paging file location(s): NUL:#$s0#$s0 [binary data]

%SystemDrive% = X: | %SystemRoot% = X:\i386 | %ProgramFiles% = X:\Program Files
Drive C: | 10.10 Mb Total Space | 1.78 Mb Free Space | 17.59% Space Free | Partition Type: FAT
D: Drive not present or media not loaded
Drive E: | 194.63 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 117.00 Mb Total Space | 9.62 Mb Free Space | 8.22% Space Free | Partition Type: NTFS

Computer Name: MiniXP
Current User Name: SYSTEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
.hlp [@ = hlpfile] -- X:\i386\System32\winhlp32.exe File not found
.hta [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE File not found
.inf [@ = inffile] -- B:\Tools\NotePad.exe ()
.ini [@ = inifile] -- B:\Tools\NotePad.exe ()
.js [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
.jse [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
.txt [@ = txtfile] -- B:\Tools\NotePad.exe ()
.vbe [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
.vbs [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
.wsf [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found
.wsh [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [edit] -- B:\Tools\NotePad.exe %1 ()
batfile [open] -- "%1" %*
batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 File not found
chm.file [open] -- Reg Error: Key error.
cmdfile [edit] -- B:\Tools\NotePad.exe %1 ()
cmdfile [open] -- "%1" %*
cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 File not found
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- winhlp32.exe %1
hlpfile [open] -- %SystemRoot%\System32\winhlp32.exe %1 File not found
htafile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome File not found
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 File not found
htmlfile [print] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome File not found
https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome File not found
inffile [open] -- B:\Tools\NotePad.exe %1 ()
inffile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 File not found
inifile [open] -- B:\Tools\NotePad.exe %1 ()
inifile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 File not found
InternetShortcut [print] -- Reg Error: Key error.
jsfile [edit] -- Reg Error: Key error.
jsfile [open] -- Reg Error: Key error.
jsfile [print] -- Reg Error: Key error.
jsefile [edit] -- Reg Error: Key error.
jsefile [open] -- Reg Error: Key error.
jsefile [print] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [edit] -- B:\Tools\NotePad.exe %1 ()
regfile [merge] -- Reg Error: Key error.
regfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 File not found
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
txtfile [open] -- B:\Tools\NotePad.exe %1 ()
txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 File not found
txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" File not found
vbefile [edit] -- Reg Error: Key error.
vbefile [open] -- Reg Error: Key error.
vbefile [print] -- Reg Error: Key error.
vbsfile [edit] -- Reg Error: Key error.
vbsfile [open] -- Reg Error: Key error.
vbsfile [print] -- Reg Error: Key error.
wsffile [edit] -- Reg Error: Key error.
wsffile [open] -- Reg Error: Key error.
wsffile [print] -- Reg Error: Key error.
wshfile [open] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe %1 (http://www.hiren.info)
Directory [cmd] -- cmd.exe /k cd "%1" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Reset Attributes] -- ResetAttribs.cmd "%1" ()
Directory [Reset NTFS Permissions] -- ResetNTFSPermissions.cmd "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 File not found
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" File not found

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- File not found


========== Last 10 Event Log Errors ==========

[ System Events ]
Error - 1/13/2010 2:10:53 PM | Computer Name = MiniXP | Source = Application Popup | ID = 877
Description = There was error [DATABASE NOT LOADED] processing the driver database.


< End of report >

OTL logfile created on: 1/13/2010 6:20:23 PM - Run 1
OTL by OldTimer - Version 3.1.24.0 Folder = X:\Documents and Settings\Default User\Desktop
Windows XP Professional Edition (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2800.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

894.00 Mb Total Physical Memory | 599.00 Mb Available Physical Memory | 67.00% Memory free
700.00 Mb Paging File | 293.00 Mb Available in Paging File | 42.00% Paging File free
Paging file location(s): NUL:#$s0#$s0 [binary data]

%SystemDrive% = X: | %SystemRoot% = X:\i386 | %ProgramFiles% = X:\Program Files
Drive C: | 10.10 Mb Total Space | 1.78 Mb Free Space | 17.59% Space Free | Partition Type: FAT
D: Drive not present or media not loaded
Drive E: | 194.63 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 117.00 Mb Total Space | 9.62 Mb Free Space | 8.22% Space Free | Partition Type: NTFS

Computer Name: MiniXP
Current User Name: SYSTEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/01/13 18:14:47 | 00,544,256 | ---- | M] (OldTimer Tools) -- X:\Documents and Settings\Default User\Desktop\OTL.exe
PRC - [2009/11/16 22:53:44 | 01,012,736 | ---- | M] (Microsoft Corporation) -- X:\i386\explorer.exe
PRC - [2009/11/16 22:53:44 | 00,779,657 | ---- | M] () -- X:\i386\System32\PENetwork.exe
PRC - [2009/11/16 22:53:44 | 00,389,120 | ---- | M] (Microsoft Corporation) -- X:\i386\System32\cmd.exe
PRC - [2009/11/16 22:53:44 | 00,045,568 | ---- | M] (Home made :() -- X:\i386\System32\PELoader.exe
PRC - [2009/11/07 20:05:24 | 00,163,840 | ---- | M] (Opera Software) -- B:\Temp\Opera\Opera.exe


========== Modules (SafeList) ==========

MOD - [2010/01/13 18:14:47 | 00,544,256 | ---- | M] (OldTimer Tools) -- X:\Documents and Settings\Default User\Desktop\OTL.exe
MOD - [2009/11/16 22:53:44 | 00,921,088 | ---- | M] (Microsoft Corporation) -- X:\i386\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\COMCTL32.DLL


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (VSS)
SRV - File not found [On_Demand | Stopped] -- -- (UPS)
SRV - File not found [On_Demand | Stopped] -- -- (SysmonLog)
SRV - File not found [On_Demand | Stopped] -- -- (Spooler)
SRV - File not found [On_Demand | Stopped] -- -- (SCardSvr)
SRV - File not found [Auto | Stopped] -- -- (RemoteRegistry)
SRV - File not found [Disabled | Stopped] -- -- (NetDDEdsdm)
SRV - File not found [Disabled | Stopped] -- -- (NetDDE)
SRV - File not found [Disabled | Stopped] -- -- (ClipSrv)
SRV - File not found [On_Demand | Stopped] -- -- (CiSvc)
SRV - [2009/11/16 22:53:44 | 00,010,240 | ---- | M] (Olof Lagerkvist) [On_Demand | Stopped] -- X:\i386\System32\imdsksvc.exe -- (ImDskSvc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========





Hosts file not found
O4 - HKLM..\Run: [BroadcastEnvChange] X:\i386\System32\hiderun.exe ()
O4 - HKLM..\Run: [hiren] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: nosmmydocs = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoThemesTab = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyDocs = 1
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - X:\i386\Network Diagnostic\xpnetdiag.exe File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - X:\i386\System32\rsvpsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - X:\i386\System32\rsvpsp.dll File not found
O13 - ftp Prefix: missing
O13 - gopher Prefix: missing
O13 - home Prefix: missing
O13 - mosaic Prefix: missing
O13 - www Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - X:\i386\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (X:\i386\system32\userinit.exe) - X:\i386\System32\userinit.exe File not found
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - File not found
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - X:\i386\System32\dimsntfy.dll File not found
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - File not found
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - File not found
O32 - Unable to read "AutoRun" value or value not present!
O32 - AutoRun File - [2009/11/19 18:09:46 | 00,000,199 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: EventSystem - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: LanmanServer - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Rasauto - File not found
NetSvcs: Rasman - File not found
NetSvcs: Remoteaccess - File not found
NetSvcs: Schedule - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: winmgmt - File not found
NetSvcs: wscsvc - File not found
SystemRestore not available.

========== Files/Folders - Created Within 14 Days ==========

[2010/01/13 18:19:50 | 00,000,000 | -HSD | C] -- X:\RECYCLER
[2010/01/13 18:14:47 | 00,544,256 | ---- | C] (OldTimer Tools) -- X:\Documents and Settings\Default User\Desktop\OTL.exe
[2010/01/13 18:10:41 | 00,000,000 | --SD | C] -- X:\Documents and Settings\Default User\History
[2010/01/13 18:10:41 | 00,000,000 | --SD | C] -- X:\Documents and Settings\Default User\Cookies
[2010/01/13 18:10:19 | 00,000,000 | ---D | C] -- X:\i386\debug
[2010/01/13 18:10:19 | 00,000,000 | ---D | C] -- X:\i386\System32\CatRoot2
[2010/01/13 18:10:19 | 00,000,000 | ---D | C] -- X:\i386\System32\CatRoot
[2010/01/13 18:09:21 | 00,316,800 | ---- | C] (Sysinternals - www.sysinternals.com) -- X:\i386\System32\taskmgr.exe
[2010/01/13 18:09:13 | 00,000,000 | RH-D | C] -- X:\Documents and Settings\Default User\Recent
[2010/01/13 18:09:13 | 00,000,000 | R--D | C] -- X:\Documents and Settings\Default User\Favorites
[2009/11/16 22:54:18 | 00,032,221 | ---- | C] ( ) -- X:\i386\System32\drivers\tx100nd5.sys
[2009/11/16 22:54:16 | 00,066,464 | ---- | C] ( ) -- X:\i386\System32\drivers\cb100nds.sys

========== Files - Modified Within 14 Days ==========

[2010/01/13 18:14:47 | 00,544,256 | ---- | M] (OldTimer Tools) -- X:\Documents and Settings\Default User\Desktop\OTL.exe
[2010/01/13 18:10:39 | 00,001,421 | ---- | M] () -- X:\Documents and Settings\Default User\Desktop\HBCD Menu.lnk
[2010/01/13 18:10:19 | 00,001,297 | ---- | M] () -- X:\Documents and Settings\Default User\Desktop\Network Support.lnk
[2010/01/13 18:09:12 | 00,000,185 | ---- | M] () -- X:\i386\System32\24hrlimit.cmd
[2010/01/13 18:09:12 | 00,000,063 | ---- | M] () -- X:\i386\System32\erdcompmg.cmd
[2010/01/13 18:09:12 | 00,000,058 | ---- | M] () -- X:\i386\System32\erdsysrest.cmd
[2010/01/13 18:09:12 | 00,000,053 | ---- | M] () -- X:\i386\System32\erdexp.cmd
[2010/01/13 18:09:12 | 00,000,048 | ---- | M] () -- X:\i386\System32\hexd.cmd
[2010/01/13 18:09:12 | 00,000,042 | ---- | M] () -- X:\i386\System32\hbcdtools.cmd
[2010/01/13 18:09:02 | 00,089,496 | ---- | M] () -- X:\i386\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2010/01/13 18:09:21 | 00,033,673 | ---- | C] () -- X:\i386\System32\compmgmt.msc
[2010/01/13 18:09:12 | 00,000,185 | ---- | C] () -- X:\i386\System32\24hrlimit.cmd
[2010/01/13 18:09:12 | 00,000,063 | ---- | C] () -- X:\i386\System32\erdcompmg.cmd
[2010/01/13 18:09:12 | 00,000,058 | ---- | C] () -- X:\i386\System32\erdsysrest.cmd
[2010/01/13 18:09:12 | 00,000,053 | ---- | C] () -- X:\i386\System32\erdexp.cmd
[2010/01/13 18:09:12 | 00,000,048 | ---- | C] () -- X:\i386\System32\hexd.cmd
[2010/01/13 18:09:12 | 00,000,042 | ---- | C] () -- X:\i386\System32\hbcdtools.cmd
[2010/01/13 18:09:02 | 00,089,496 | ---- | C] () -- X:\i386\System32\FNTCACHE.DAT
[2009/11/16 22:54:20 | 00,000,000 | ---- | C] () -- X:\i386\System32\wdfcoinstaller01005.dll
[2009/11/16 22:54:19 | 00,005,120 | ---- | C] () -- X:\i386\System32\ShutdownRes.dll
[2009/11/16 22:54:18 | 00,026,976 | ---- | C] () -- X:\i386\System32\drivers\eh10nds.sys
[2009/11/16 22:54:18 | 00,018,415 | ---- | C] () -- X:\i386\System32\drivers\AX88140.sys
[2009/11/16 22:54:17 | 00,037,888 | ---- | C] () -- X:\i386\System32\msgina.dll
[2009/11/16 22:54:16 | 00,120,832 | ---- | C] () -- X:\i386\System32\drivers\3wareDrv.sys
[2009/11/16 22:54:16 | 00,072,192 | ---- | C] () -- X:\i386\System32\drivers\3wareDr2.sys
[2009/11/16 22:54:16 | 00,069,632 | ---- | C] () -- X:\i386\System32\vuins32.dll
[2009/11/16 22:54:16 | 00,069,632 | ---- | C] () -- X:\i386\System32\BCM42DB0.DLL
[2009/11/16 22:54:15 | 00,155,741 | ---- | C] () -- X:\i386\System32\HardlinkShellExt.dll

========== LOP Check ==========


========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AHCIX86.SYS >
[2009/11/16 22:53:44 | 00,174,600 | ---- | M] (AMD Technologies Inc.) MD5=15DA079FF09BE5FA6602041EE286DE80 -- X:\i386\System32\drivers\ahcix86.sys

< MD5 for: ATAPI.SYS >
[2009/11/16 22:53:44 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- X:\i386\System32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2009/11/16 22:53:44 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- X:\i386\System32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2009/11/16 22:53:44 | 00,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- X:\i386\System32\drivers\IaStor.sys

< MD5 for: NETLOGON.DLL >
[2009/11/16 22:53:44 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- X:\i386\System32\netlogon.dll

< MD5 for: NVATA.SYS >
[2009/11/16 22:53:44 | 00,105,344 | ---- | M] (NVIDIA Corporation) MD5=DC1F9954B5EDDD147AF7E5C420BE7B93 -- X:\i386\System32\drivers\nvata.sys

< MD5 for: VIAMRAID.SYS >
[2009/11/16 22:53:44 | 00,092,672 | ---- | M] (VIA Technologies inc,.ltd) MD5=FBF18F9F5FB852C2976723587B44F346 -- X:\i386\System32\drivers\viamraid.sys

< %systemroot%\*. /mp /s >
< End of report >

This thing looks like it made a new 10 meg partion and the rest of my 60 gigs are hidden???? I will be waiting for your next instructions.
Bob

#6 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:35 AM

Posted 15 January 2010 - 12:45 PM

Hi,

Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2



--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#7 Mrbob2

Mrbob2
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Location:California
  • Local time:11:35 PM

Posted 16 January 2010 - 12:59 PM

i, I could not run Combo Fix. It comes up with a error. Not enough disk space and it can not find the dll files. If i say ignore it will ask for ever file and then errors out. When I boot with real windows disk I can go to the recovery console. Can I run combo fix in the recoevery console?
Bob

#8 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:35 AM

Posted 16 January 2010 - 01:10 PM

Hi,

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#9 Mrbob2

Mrbob2
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Location:California
  • Local time:11:35 PM

Posted 16 January 2010 - 09:00 PM

Hi, Again I can not run this program because there is not enough disk space. The C drive which is a 60 gig drive shows used space of 8.41 mb and free 1.69 mb. Can I run this drive as a slave on my desktop and scan it that way. Somehow I got to get ride of the funky drive to get back to where all my files are.
Bob

#10 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:35 AM

Posted 17 January 2010 - 04:15 PM

Hi,

Strange thing.

Please explain me how many harddrives and partitions you have.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#11 Mrbob2

Mrbob2
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Location:California
  • Local time:11:35 PM

Posted 19 January 2010 - 12:42 AM

I started with one partition of 60 gigs. Some how this virus now shows my drive with two partitions. The first one C of 10 megs and the second E of 198 megs. I had about 10 gigs of free space on the drive before it went down. I do know that all of data is still on my drive too.

Bob

#12 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:35 AM

Posted 20 January 2010 - 12:47 PM

Hi,


* Clean your Cache and Cookies in IE:
  • Close all instances of Outlook Express and Internet Explorer
  • Go to Control Panel > Internet Options > General tab
  • Click the "Delete Cookies" button
  • Next to it, Click the "Delete Files" button
  • When prompted, place a check in: "Delete all offline content", click OK
* Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):
  • Go to Tools > Options.
  • Click Privacy in the menu on the left side of the Options window.
  • Click the Clear button located to the right of each option (History, Cookies, Cache).
  • Click OK to close the Options window
    Alternatively, you can clear all information stored while browsing by clicking Clear All.
    A confirmation dialog box will be shown before clearing the information.
* Clean other Temporary files + Recycle bin
  • Go to start > run and type: cleanmgr and click ok.
  • Let it scan your system for files to remove.
  • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
  • Press OK to remove them.



PLease post back with a fresh OTL logfile.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#13 Mrbob2

Mrbob2
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Location:California
  • Local time:11:35 PM

Posted 21 January 2010 - 09:59 PM

Hi, I am not to sure that you understand the way my computer is running right now. I can not boot to my original Windows XP. I am using a mini Windows XP that i got from a website called Hiren's. My original will not boot because or the NTDLR and NT???. So there is no way I can do what you are asking because I can not get to those files. All I can see is a bunch of garbage. Like I said earlier if I use another disk called Test disk.
Thanks, Bob

#14 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:08:35 AM

Posted 22 January 2010 - 03:05 PM

Hi,

Do you have a full Windows CD?
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#15 Mrbob2

Mrbob2
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Location:California
  • Local time:11:35 PM

Posted 22 January 2010 - 04:10 PM

Yes I do but I can not use the repair Windows option anymore because of the missing NTDLR and NT???. I also believe that the MBR is corrupted and it is showing a fat 12 hard drive. It will not install windows without formatting the drive.
MY only disire is to recovery the files I want to keep and re-format the drive.
Bob




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users