Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infection instakilling MSE


  • This topic is locked This topic is locked
5 replies to this topic

#1 Theseos

Theseos

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 19 June 2011 - 10:02 PM

No traces of infection are left that malwarebytes, super anti-spyware, microsoft security essentials,or spybot s&d can detect but still mse will automatically close if opened in normal mode. It opens and scans fine in safe mode. So I'm guessing there is some process that's killing it that I'm just not skilled enough to eliminate. I've ran hijackthis, rkill, and rootkitrevealer (pretty much every program on Hiren's boot cd 13.2), but these tasks are slightly above my knowledge level. I don't recall the names of the infections found, I didn't think to notice it until I'd deleted them already. I'll await a response before I post any logs of anything of that nature. Thank you for your assistance if you can provide it.

PS
I should also mention the only active antivirus i have is sas. I've been running sas(free) with mse for a while now.

Edited by Blade Zephon, 20 June 2011 - 10:34 AM.
Moved to AII as no logs provided and Prep Guide not followed. ~BZ


BC AdBot (Login to Remove)

 


#2 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,704 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:04:46 AM

Posted 20 June 2011 - 10:35 AM

Hello.

Please download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

~Blade


In your next reply, please include the following:
aswMBR log

Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+


#3 Theseos

Theseos
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 20 June 2011 - 01:01 PM

(can't find the attach file button so I'll have to post)I don't think it found anything. But overnight sas found
malware.trace
trojan.agent/gen-fakealert
trojan.agent/gen-IExplorer
trojan.agent/gen-MalPE
trojan.agent/gen-PEC

Thank you for helping me. I'll standby eagerly for your response

aswMBR log
aswMBR version 0.9.7.675 Copyright© 2011 AVAST Software
Run date: 2011-06-20 12:29:04
-----------------------------
12:29:04.046 OS Version: Windows x64 6.1.7601 Service Pack 1
12:29:04.046 Number of processors: 4 586 0x402
12:29:04.046 ComputerName: ADMIN-PC UserName: admin
12:29:06.121 Initialize success
12:32:06.083 AVAST engine defs: 11061901
12:32:13.836 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-1
12:32:13.836 Disk 0 Vendor: SAMSUNG_HD103UJ 1AA01118 Size: 953869MB BusType: 3
12:32:13.836 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-2
12:32:13.836 Disk 1 Vendor: Hitachi_HDT725050VLA360 V56OA7BA Size: 476940MB BusType: 3
12:32:13.836 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP1T1L0-3
12:32:13.836 Disk 2 Vendor: Hitachi_HDT721010SLA360 ST6OA31B Size: 953869MB BusType: 3
12:32:15.864 Disk 0 MBR read successfully
12:32:15.864 Disk 0 MBR scan
12:32:15.864 Disk 0 Windows 7 default MBR code
12:32:15.864 Service scanning
12:32:16.691 Disk 0 trace - called modules:
12:32:16.691 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
12:32:16.691 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800623a060]
12:32:16.691 3 CLASSPNP.SYS[fffff8800197343f] -> nt!IofCallDriver -> [0xfffffa8005f9e580]
12:32:16.691 5 ACPI.sys[fffff88000f977a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-1[0xfffffa8005fa4060]
12:32:18.719 AVAST engine scan C:\Windows
12:50:03.108 AVAST engine scan C:\Users\admin
12:52:47.907 AVAST engine scan C:\ProgramData
12:53:09.123 Scan finished successfully
12:55:42.799 Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"
12:55:42.830 The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"

#4 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,704 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:04:46 AM

Posted 20 June 2011 - 01:24 PM

Hello.

Whatever's causing the issue on your machine is hidden well. You'll need assistance from our advanced team.

It appears that the issues on your system will require a more in-depth examination than can be performed in this forum. Please read the information in this guide, and follow all the steps beginning with step 6. After you have followed the steps in that guide, I would like you to start a new thread HERE and include a link to this thread.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient. The MRT is very busy, so it could be several days (3-5 days is the average wait right now) before you receive a reply. But rest assured, help is on the way!

~Blade

Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+


#5 Theseos

Theseos
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:46 AM

Posted 20 June 2011 - 11:39 PM

I've done as you've requested and opened a new topic in that forum. I am experiencing a strange phenomemon with rkunhooker. It ran the first time but since i was in safe mode it asked me to boot in normal. So I did and every since it will not run. I keep getting the same error in both safe and normal. I've reinstalled it a few times but to no avail.

edit:I use a torrenting service that I mistakenly hade set to boot on startup. So my theory is that the virus has been removed several times, but everytime I boot in normal mode my torrenting agent puts it right back on again. I'll keep you guys updated, and thank you for helping me.

Edited by Theseos, 21 June 2011 - 01:01 AM.


#6 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,704 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:04:46 AM

Posted 21 June 2011 - 01:17 PM

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/topic405151.html you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

~Blade
Forum Global Moderator

Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users