Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Parasite or Not?


  • This topic is locked This topic is locked
4 replies to this topic

#1 fred3

fred3

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:01:51 AM

Posted 10 December 2010 - 03:51 PM

Attached File  OTL1.Txt   58.06KB   2 downloads
I'm cleaning up a computer as I do quite often.
This one started because the computer was being sluggish and the sounds are coming out slowly and broken up.
I ran Anti Malwarebytes as usual and removed a few parasites (that's what I call all of them).
I ran CCleaner cleanup tools.
I ran HiJackThis! and removed unecessary stuff.
I fixed the sound problem by removing the device and letting it reinstall. But after a reboot, the sound problem reappeared.
So for whatever reason I decided maybe a rootkit or other hard thing to remove....
I downloaded DDS, GMER and ComboFix as I do in this situation.
DDS started but would not run - pretty much froze up the computer except the mouse cursor.
GMER started but would not run - ditto
ComboFix starts but stops after saying this should take 10 minutes or more.
Not on normal mode. Not in Safe Mode.
I've not seen this problem before....

I ran a collection of Root Kit programs: McAfee, Sophos, RootKitRevealer, RootRepeal, etc. I didn't find anything that seemed compelling. And, none of these tools seemed to be able to *do* anything but generate a list!! Bummer (or maybe not, eh?).


So, I'm still unsure if thiss machine has a parasite remaining but I'm concerned because all those tools don't run.
And, I still have to fix the sound problem.

Thanks

Per boopme here is an OTL log:

Extras file

Attached File  Extras.Txt   35.68KB   1 downloads

BC AdBot (Login to Remove)

 


#2 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:51 AM

Posted 18 December 2010 - 09:57 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Please also continue to work with me until I give you the all clear. Even if your computer appears to act better, you may still be infected.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.

Once we start working together, please reply back within 3 days or this thread may be closed so we can help others who are waiting.

We need to create an OTL report,
  • Please download OTL from this link.
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Under the Custom Scan box paste this in:

    netsvcs
    msconfig
    drivers32 /all
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\system32\*.sys /90
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\*. /mp /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    CREATERESTOREPOINT

  • Click the Quick Scan button.
  • The scan should take a few minutes.
  • Please copy and paste both logs in your reply.

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new OTL log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


In your reply, please post both OTL logs and the GMER log.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#3 fred3

fred3
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:01:51 AM

Posted 18 December 2010 - 12:21 PM

I had already included the OTL and other log files.....
I'd be interested in knowing if they show anything interesting / useful because this was a particularly difficult and strange-acting problem.

Because of the elapsed time I was forced to reinstall Windows from scratch and the work is now completed.
So, you don't *have* to look at the OTL file now but it would be appreciated for future reference - as I do this sort of cleanup quite often.

So - "case closed" ... sorta, eh?

Thanks

#4 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:51 AM

Posted 19 December 2010 - 07:40 AM

There is nothing obvious in the logs, but many things hide from a standard OTL or DDS scan. WIthout having access to the original system state, not much we can do to diagnose.

Glad you were able to complete the work.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#5 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:51 AM

Posted 22 December 2010 - 07:19 PM

Since this issue appears to be resolved ... this Topic has been closed.

If you are the topic starter, and need this topic reopened, please contact me via PM with the address of this thread.

Everyone else please begin a new topic.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users