combox/dds freeze

Toshiba Equium m40x with XP SP3 + 512mb ram + 40% free hdd space + sophos antivirus, no other antimalware. System thoroughly cleaned defragged, hdd checked, sfc run. malwarebytes run twice (logs below), eset run (log attached). Dss run froze (log however retrieved). combofix freezes (after taking backup, qoobox and combofix folders created, disk activity halts at this point and system has to be hard stopped.)

Note that the HDDOK fake was manually removed first - TDSS was also identified in the first malwarebytes scan, but doesn't show in the log? Now realise that Spphos removed a number of entries relating to TDSSPack-Z & FakeAV-EA when malwarebytes identified them. I also ran TDSSkiller from Kaspersky after which showed no other infection.


System still very slow

Advice appreciated please.


PS

While waiting thought I'd try a couple of new things:

Added another 256mb ram, whilst faster, DDS still freezes, albeit leave it for 10+ minutes.

Tried running in safemode (appreciate that results may not be reflective) DDS still freezes.

Searching folders found a file DDS00 which looks like the second part of the DDS log although it has no file type associated with it - this file is from the same DDS process as the dds.txt file above.

I appreciate that you guys are very busy at the mo, expect that there has been an increase in new malware attacks recently. I know that you don't like folks changing things however I'm sure you appreciate that to sit doing nothing for days does create problems of its own.

Any I believe it is best to tell you what I have done - first I ran combofix /uninstall,then ran dss again, and then ran gmer. I attach the dss logs - in two parts as it still freezes the machine. I haven't included the gmer log as it reported zilch.

I await your kind comments indue course  DDS.txt   1.92KB   2 downloads  DDS00.txt   16.3KB   1 downloads

EDIT: Posts merged ~BP

Edited by Budapest, 16 January 2011 - 04:14 PM.

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

We need to create an OTL Report

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
• Save it to your desktop.
• Double click on the icon on your desktop.
• Click the "Scan All Users" checkbox.
• Push the button.
• Two reports will open, copy and paste them in a reply here:
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized

We also need a log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:


Why we request you disable CD Emulation when receiving Malware Removal Advice

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

Best Regards,
oneof4.

I have followed yr instructions to the letter - running gmer with all non-ms services off and all start-up progs disabled. We also ran defogger to ensure that this aspect was also complied with.

Looking foward to having some input to this gritty issue.


thank you

Hello, and sorry for the delay.

You mention you have tried to run Combofix. Did you also try it from safe mode?

Yes I did. Sequence is as follows;

1) Run combofix normally, freezes after backup stage - no log created.

2. Did not run combofix /uninstall, at this point.

3. Ran again in safe mode, with exactly the same result. noticed that albeit no log was created, two new folders were created on the C: drive - qoobox, and combofix (the latter had subfolders mirroring "my computer" resources). Left it for a good hour before forcing a reboot.

4. Tried running DSS which also froze.

5. Ran combofix /uninstall.

6. ran DSS again and it froze the PC again, left it for at least 10 mins before forcing a reboot.

Hence here I am.

Thank you for your help.

Please try to download combofix (see below), but right click on the download link and rename combofix.exe to fun.com.

COMBOFIX
---------------
Please download ComboFix from one of these locations:
Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
• Double click on Combofix.exe and follow the prompts.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

Thank you for your reply.

Combofix still freezes both in normal mode and safe mode.

here are the events as undertaken.

1. Download combofix from site recommended as above, and rename as fun.exe
2. use msconfig to ensure that Sophos and other startup services/programs do not start (we do not stop MS services!)
3. run fun.exe, starts fine, does backup and posts the recovery console message, screen changes to state that it is scanning for infected files, may take 10 mins + etc (ie Autoscan). HDD light contines to flash for maybe a minute, then freezes, and system clock stops. Leave it for 20 mins. steps 1 - 50 do not show at all, don't even start.
4. hard stop, and reboot into safe mode.
5. run combofix /uninstall
6. redownload combobfix, rename etc, and start again in safe mode. As for step 3 above, freezes again at same point, only difference is that system clock doesn't stop in this case until 17 minutes passes.
7. hard stop and reboot normally, scanned for any combofix logs, I did notice 100's of references to Combofix in the windows/prefetch folder as follows two lines repeated 100's of times

combofix-download.cfxxe-118f41f5.pf
combofix.exe-3a3a8115.pf

all references deleted

8. tried process just once again in safe mode to see if removing these items did the trick. Regret no success, same as before.

9. uninstalled combofix.

Please note previous posts regarding malware removed, hdd chkdsk done (clean), and sfc /scannow run.


Puzzled!!

I think its just one of combofix's components that freezes on your system (DDS uses the same thing). Besides this, how is your system running?

Hi there again - the reason for my posting originally was that I had exactly the same symptoms on two different PCs both running slow, both freezing with combofix, and both had the same virus - TDSSPack-Z. These PC's did not respond to the usual clean-up processes (I am a PC engineer and undertake cleanup/ virus removal on a regular basis - but I also make mistakes too!)

I have had to deactivate many of the startup programs/services to get a reaonable performance, and in the machine I am working with you on I have doubled the RAM.

I let the first go, but two with the same symptoms gives nme cause for concern. I don't believe in co-incidences!

Does your reply mean you are at a bit of a loss too?

That is indeed a bit hard to accept as a coincidence.

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
• If TDSSKiller does not run, try renaming it.
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
• Click the Start Scan button.
• Do not use the computer during the scan
• If the scan completes with nothing found, click Close to exit.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
• Copy and paste the contents of that file in your next reply.

OTL
-----

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
• Save it to your desktop.
• Double click on the icon on your desktop.
• Copy and Paste the following code into the textbox.
  

  netsvcs
  /md5start
  explorer.exe
  winlogon.exe
  /md5stop
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles

• Push
• A report will open. Copy and Paste that report in your next reply.

Hi Elise, Thanks for your help on this one.

Undertook your instructions as given. Logs attached as requested.

Many thanks, look forward to hearing again from you

Regards

Robert

There are no sings whatsoever of malware here. What you can try is uninstall/reinstall Sophos (see after uninstall if things speed up).

Thank you Elise, may take a few days as Sophos was installed under the auspices of Sussex Uni

Had a few probs with Combofix recently after several years without problems (bar one which was malware disguised in ndis.sys) - besides these freezes, had the regedit.exe false-negative yesterday on XP-SP3 which has been around for some while - just passing it on FYI.

Regards

Robert

What do you mean with regedit false-negatives?

Hi

I have now removed Sophos, and while there is some improvement, it is not significant. I did re-run Combofix after, with the same freeze.

regedit.exe: elsewhere in these forums there are reports of Combofix reporting ad nauseam that regedit.exe is infected. Combofix attempts to replace it, but the next run just repeats the action/statement. It was put down by one of your co-moderators as a false statement. Incidentally, the PC did have over 500 infected files initially, but apart from the regedit issue is now clean (hopefully)!

Edited by Rob999, 27 January 2011 - 05:59 PM.