Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Vundo, Internet Security 2010 and not sure what else.


  • Please log in to reply
9 replies to this topic

#1 sandypnaprilg

sandypnaprilg

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 01 January 2010 - 05:14 PM

This has been on going for the last two weeks with a nasty viruses on my computer. At first whatever was on my computer would erase Malwarebytes and I could not run it. So I ran Super Antispyware and got rid of enough stuff to update and run Malwarebytes. But Internet Security 2010 stuff keeps coming back on and my browser keeps getting redirected. I can not start in safemode at all I get the blue screen saying check to see if I have a virus running or do a Scandisk. Looking for someone that helpme work through this. Thanks.

BC AdBot (Login to Remove)

 


#2 sandypnaprilg

sandypnaprilg
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 01 January 2010 - 05:23 PM

In addition just check my processes running and it says that Isass.exe is running and of course it will not allow me to stop the process.

#3 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,801 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:43 PM

Posted 01 January 2010 - 09:21 PM

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,739 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:43 PM

Posted 01 January 2010 - 11:18 PM

Hello and welcome. Let's do a few things. Let me know how it's running.
  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
  • Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

  • If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
  • When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


SUPERAntiSypware has a built in "Repairs" feature to fix policy restrictions and certain Windows settings which are sometimes targeted by malware infection. To use this feature, launch SUPERAntiSypware.
  • Click the Repairs tab.
  • Click on (highlight) "Repair broken SafeBoot key" and then click the Repair button.
  • You may be asked to reboot your computer for the changes to take effect.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 sandypnaprilg

sandypnaprilg
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 02 January 2010 - 01:32 PM

I have included two logs. And thank you for the fix for the safemode. That is now properly working! After I restarted my computer I got a message that says Generic Host process for Win 32 services has encountered a problem and needs to close. That I get a pop up that says System Shutdown. The is shut down was initiated by NT AUTHORITY\SYSTEM. It shut my computer and I had to turn it back on.

12:26:16:625 1836 TDSSKiller 2.1.1 Dec 20 2009 02:40:02
12:26:16:625 1836 ================================================================================
12:26:16:625 1836 SystemInfo:

12:26:16:625 1836 OS Version: 5.1.2600 ServicePack: 2.0
12:26:16:625 1836 Product type: Workstation
12:26:16:625 1836 ComputerName: SANDRA-KZOUUL4B
12:26:16:625 1836 UserName: Sandy
12:26:16:625 1836 Windows directory: C:\WINDOWS
12:26:16:625 1836 Processor architecture: Intel x86
12:26:16:625 1836 Number of processors: 1
12:26:16:625 1836 Page size: 0x1000
12:26:16:625 1836 Boot type: Normal boot
12:26:16:625 1836 ================================================================================
12:26:16:625 1836 SetPrivilegesA: AdjustTokenPrivileges(敓敄畢偧楲楶敬敧) error 1300
12:26:16:625 1836
Set privileges error

12:26:16:625 1836 ForceUnloadDriver: NtUnloadDriver error 2
12:26:16:625 1836 ForceUnloadDriver: NtUnloadDriver error 2
12:26:16:625 1836 ForceUnloadDriver: NtUnloadDriver error 2
12:26:16:625 1836 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\Drivers\KLMD.sys) returned status 0
12:26:16:625 1836 main: Driver KLMD successfully dropped
12:26:16:625 1836 main: Driver KLMD successfully loaded
12:26:16:625 1836
Scanning Registry ...
12:26:16:640 1836 ScanServices: Searching service UACd.sys
12:26:16:640 1836 ScanServices: Open/Create key error 2
12:26:16:640 1836 ScanServices: Searching service TDSSserv.sys
12:26:16:640 1836 ScanServices: Open/Create key error 2
12:26:16:640 1836 ScanServices: Searching service gaopdxserv.sys
12:26:16:640 1836 ScanServices: Open/Create key error 2
12:26:16:640 1836 ScanServices: Searching service gxvxcserv.sys
12:26:16:640 1836 ScanServices: Open/Create key error 2
12:26:16:640 1836 ScanServices: Searching service MSIVXserv.sys
12:26:16:640 1836 ScanServices: Open/Create key error 2
12:26:16:640 1836 UnhookRegistry: Kernel module file name: C:\windows\system32\ntoskrnl.exe, base addr: 804D7000
12:26:16:640 1836 UnhookRegistry: Kernel local addr: EB0000
12:26:16:640 1836 UnhookRegistry: KeServiceDescriptorTable addr: F32700
12:26:16:640 1836 UnhookRegistry: KiServiceTable addr: EBB6A8
12:26:16:640 1836 UnhookRegistry: NtEnumerateKey service number (local): 47
12:26:16:640 1836 UnhookRegistry: NtEnumerateKey local addr: F47F20
12:26:16:640 1836 KLMD_OpenDevice: Trying to open KLMD device
12:26:16:640 1836 UnhookRegistry: Cannot get access to KLMD, error 5
12:26:16:640 1836 ScanHiddenServices: UnhookRegistry error
12:26:16:640 1836
Scanning Kernel memory ...
12:26:16:640 1836 KLMD_OpenDevice: Trying to open KLMD device
12:26:16:640 1836 DetectCureTDL3: Cannot get access to KLMD, error 5
12:26:16:640 1836 DetectCureTDL3 failed
12:26:16:656 1836
Completed

Results:
12:26:16:656 1836 Infected objects in memory: 0
12:26:16:656 1836 Cured objects in memory: 0
12:26:16:656 1836 Infected objects on disk: 0
12:26:16:656 1836 Objects on disk cured on reboot: 0
12:26:16:656 1836 Objects on disk deleted on reboot: 0
12:26:16:656 1836 Registry nodes deleted on reboot: 0
12:26:16:656 1836


Malwarebytes' Anti-Malware 1.43
Database version: 3479
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.11

1/2/2010 12:41:07 PM
mbam-log-2010-01-02 (12-41-03).txt

Scan type: Quick Scan
Objects scanned: 123605
Time elapsed: 6 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\bwsb.gio (Backdoor.Bot) -> No action taken.
C:\WINDOWS\TEMP\74F.tmp (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\flags.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\uses32.dat (Malware.Trace) -> No action taken.

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,739 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:43 PM

Posted 02 January 2010 - 02:29 PM

Hello,.. Much better. Need to check that you clicked the "Remove Selected " button after the scan. Ususally that's the reason for 'No action taken" in that log.

Now we should do a rootkit Scan.. Then an Online scan.

We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image

How is it running now?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 sandypnaprilg

sandypnaprilg
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 02 January 2010 - 10:41 PM

I was not able to run Root Repeal at all. It locked up computer and when I got it to semi run it kept giving me all kinds of errors and then crashed the program. I'm going to try and run it again. I ran the ESET Scan and have posted the log. Still seem to be having some issues though whenever I click a site from a google search it redirects me elsewhere usually to some type of advertisment. Let me know what else I can do and thanks again for all your help.

C:\Documents and Settings\Default User\My Documents\Data\all_files2.exe multiple threats deleted - quarantined
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files2.exe multiple threats deleted - quarantined
C:\Program Files\Common Files\Companion Wizard\compwiz.exe Win32/Adware.WinAntiVirus application cleaned by deleting - quarantined
C:\WINDOWS\Downloaded Program Files\popcaploader.dll probably a variant of Win32/Adware.Agent application cleaned by deleting - quarantined
Operating memory a variant of Win32/Bamital.B trojan contained infected files

#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,739 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:43 PM

Posted 03 January 2010 - 03:19 PM

Hello, let's run an alternate ARK...
Please download Sophos Anti-rootkit & save it to your desktop.
alternate download link
Note: If using the vendor's download site you will be asked to register with MySophos so an email containing an activation link can be sent to your email address.

Be sure to print out and read the Sophos Anti-Rookit User Manual and Release Notes.
  • Double-click sar_15_sfx.exe to begin the installation, read the license agreement and click Accept.
  • Allow the default location of C:\Program Files\Sophos\Sophos Anti-Rootkit and click Install.
  • A message will appear "Sophos Anti-Rootkit was successfully installed. Click 'yes' to start it now".
  • Click Yes and allow the driver and its randomly named .tmp file (i.e. F.tmp) to load if asked.
  • If the scan did not start automatically, make sure the following are checked:
    • Running processes
    • Windows Registry
    • Local Hard Drives
  • Click Start scan.
  • Sophos Anti-Rootkit will scan the selected areas and display any suspicious files in the upper panel.
  • When the scan is complete, a pop-up screen will appear with "Rootkit Scan Results". Click OK to continue.
  • Click on the suspicious file to display more information about it in the lower panel which also includes whether the item is recommended for removal.
    • Files tagged as Removable: No are not marked for removal and cannot be removed.
    • Files tagged as Removable: Yes (clean up recommended) are marked for removal by default.
    • Files tagged as Removable: Yes (but clean up not recommended) are not marked for removal because Sophos did not recognize them. These files will require further investigation.
  • Select only items recommended for removal, then click "Clean up checked items". You will be asked to confirm, click Yes.
  • A pop up window will appear advising the cleanup will finish when you restart your computer. Click Restart Now.
  • After reboot, a dialog box displays the files you selected for removal and the action taken.
  • Click Empty list and then click Continue to re-scan your computer a second time to ensure everything was cleaned.
  • When done, go to Start > Run and type or copy/paste: %temp%\sarscan.log
  • This should open the log from the rootkit scan. Please post this log in your next reply. If you have a problem, you can find sarscan.log in C:\Documents and Settings\\Local Settings\Temp\.
Before performing an ARK scan it is recommended to do the following to ensure more accurate results and avoid common issues that may cause false detections.
  • Disconnect from the Internet or physically unplug you Internet cable connection.
  • Clean out your temporary files.
  • Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
  • Temporarily disable your anti-virus and real-time anti-spyware protection.
  • After starting the scan, do not use the computer until the scan has completed.
  • When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.



Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#9 sandypnaprilg

sandypnaprilg
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:11:43 AM

Posted 04 January 2010 - 07:41 PM

Tried to turn the computer on get the Dell startup screen and then screen goes black nothing. Any suggestions? I tried to boot in safe mood and it gets hung up as well.

#10 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,739 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:43 PM

Posted 04 January 2010 - 11:45 PM

\Looks like you may need to consider a Repair install or full format and reinstall.

How to Perform a Windows XP Repair Install


Reformatting

Your decision as to what action to take should be made by reading and asking yourself the questions presented in "When Should I Format, How Should I Reinstall?" In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. Wiping your drive, reformatting, and performing a clean install of the OS or doing a factory restore removes everything and is the safest action but I cannot make that decision for you.

Reformatting a hard disk deletes all data. If you decide to reformat, you can back up all your important documents, data files and photos. The safest practice is not to backup any autorun.ini or .exe files because they may be infected. Some types of malware may disguise itself by adding and hiding its extension to the existing extension of files so be sure you take a close look at the full name. After reformatting, as a precaution, make sure you scan these files with your anti-virus prior to copying them back to your hard drive.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users