Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malware on my PC


  • Please log in to reply
8 replies to this topic

#1 DanLardy

DanLardy

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 20 June 2011 - 03:18 PM

Hi, looking for some much needed help!

My PC just crashed and then rebooted itself and says there is a hard drive failure.

When I boot it up a Windows XP Repair pop up appears with a PC Performance & Stability analysis report. From the start menu all programs and documents are not there. It also says the system has detected a problem with one or more installed IDE/SATA hard disks. The analysis report has five errors it cannot fix - all hard drive related, saying 39% of HDD space is unreadable, doesn't respond to system commands, boot sector is damaged, read time of HD clusters less than 500ms and Bad sectors on HD or damaged file allocation table.

I told a friend about this (lives in another city) and he reckpons it's Malware and said posting on here might help me out.

PC had been behaving oddly lately, when I booted it up it was coming up with b&w command type page where I had to run setup and/or restore default settings etc and was having to manually change the date/time each day. Maybe there is an easy fix but do I need to start from scratch and lose all my data?

Many thanks in advance for any help.

Edited by hamluis, 20 June 2011 - 03:23 PM.
Moved from XP to Am I Infected.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,914 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:38 AM

Posted 20 June 2011 - 03:33 PM

Hello,lets run thus and see how iy is after.

Please follow our Removal Guide here Remove Windows XP Repair (Uninstall Guide) .
After reading how the malware is misleading you ...
You will move to the Automated Removal Instructions

After you completed that, post your scan log here,let me know how things are.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 DanLardy

DanLardy
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 21 June 2011 - 08:50 AM

Thanks, I've gone through as much of that as I can and my PC is up and running again now, not had a chance to check what has altered.

Here is my MBAM Log report below. I also have the DDS logs but not the Gmer one as the PC kept restarting when i tried this scan. I tried Secunia too but it won't load, saying unable to retireve PSI user id from Secunia.

Here is the MBAM log:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6907

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

21/06/2011 13:35:40
mbam-log-2011-06-21 (13-35-40).txt

Scan type: Full scan (A:\|C:\|D:\|E:\|F:\|)
Objects scanned: 286329
Time elapsed: 2 hour(s), 16 minute(s), 12 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
c:\documents and settings\all users.windows\application data\hvflvhqkylnbddx.exe (Trojan.FakeHDD) -> 1544 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HVflVHqKyLnBdDx (Trojan.FakeHDD) -> Value: HVflVHqKyLnBdDx -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\all users.windows\application data\hvflvhqkylnbddx.exe (Trojan.FakeHDD) -> Delete on reboot.
c:\documents and settings\all users.windows\application data\15392548.exe (Trojan.Agent.PF) -> Quarantined and deleted successfully.
c:\documents and settings\dan.workstation\local settings\temporary internet files\Content.IE5\KOVKLYK0\info[1].exe (Trojan.FakeHDD) -> Quarantined and deleted successfully.
c:\program files\DC++\downloads\sony.soundforge7.0universell keygen(ssg)\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\sony.soundforge7.0universell keygen(ssg)\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.


Thanks in advance...

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,914 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:38 AM

Posted 21 June 2011 - 11:54 AM

Please download CKScanner and save it to your Desktop. <-Important!!!
  • Double-click on CKScanner.exe and click Search For Files.
  • If using Vista, right-click on it and Run As Administrator.
  • After a very short time, when the cursor hourglass disappears, click Save List To File.
  • A text file will be created on your desktop named ckfiles.txt.
  • Click OK at the file saved message box.
  • Double-click the ckfiles.txt icon on your desktop to open the log and copy/paste the contents in your next reply.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 DanLardy

DanLardy
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 21 June 2011 - 01:08 PM

OK thanks attached below. Incidentally my virus program picked up and removed a trojan.

CKScanner - Additional Security Risks - These are not necessarily bad
c:\documents and settings\all users.windows\application data\adobe\photoshop elements\8.0\photo creations\backgrounds\cracked paint.metadata.xml
c:\live samples\synthetic drums 2\dust kit\dust kit samples\crackedsnare.nov
c:\live samples\synthetic drums 2\kai tracid kit\kai tracid kit samples\1984 crackel tom kt.nov
c:\live samples\synthetic drums 2\kai tracid kit\kai tracid kit samples\1986 crackfuzz kt.nov
c:\program files\ableton\live 4.0.3\factory presets\vinyl distortion\crack.adv
c:\program files\dc++\downloads\sony.soundforge7.0universell keygen(ssg)\keygen.rar
c:\program files\dc++\downloads\sony.soundforge7.0universell keygen(ssg)\ssg.nfo
c:\sony.soundforge7.0universell keygen(ssg)\keygen.rar
c:\sony.soundforge7.0universell keygen(ssg)\ssg.nfo
scanner sequence 3.CF.11
----- EOF -----

Edited by DanLardy, 21 June 2011 - 01:14 PM.


#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,914 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:38 AM

Posted 21 June 2011 - 07:55 PM

Hello, sorry for the delay. It appears ther are Crcks/keygens on here that need to go or we may never get this clean,

IMPORTANT NOTE: The practice of using cracking tools, keygens, warez or any pirated software is not only considered illegal activity but it is a serious security risk.

Cracking applications are used for illegally breaking (cracking) various copy-protection and registration techniques used in commercial software. These programs may be distributed via Web sites, Usenet, and P2P networks.

trendmicro.com/vinfo

...warez and crack web pages are being used by cybercriminals as download sites for malware related to VIRUT and VIRUX. Searches for serial numbers, cracks, and even antivirus products like Trend Micro yield malcodes that come in the form of executables or self-extracting files...quick links in these sites also lead to malicious files. Ads and banners are also infection vectors...

Keygen and Crack Sites Distribute VIRUX and FakeAV

...warez/piracy sites ranked the highest in downloading spyware...just opening the web page usually sets off an exploit, never mind actually downloading anything. And by the time the malware is finished downloading, often the machine is trashed and rendered useless.

University of Washington spyware study

...One of the most aggressive and intrusive of all bad websites on the Internet are serial, warez, software cracking type sites...they sneak malware onto your system...Where do trojan viruses originate? One of the biggest malware distributors on the Internet are serial/warez/code cracking sites.

Bad Web Sites: Malware

When you use these kind of programs, be forewarned that some of the worst types of malware infections can be contracted and spread by visiting crack, keygen, warez and other pirated software sites. In many cases, those sites are infested with a smörgåsbord of malware and an increasing source of system infection. Those who attempt to get software for free can end up with a computer system so badly damaged that recovery is not possible and it cannot be repaired. When that happens there is nothing you can do besides reformatting and reinstalling the OS.

Before we can continue, I need you to remove all cracks and keygens immediately to reduce the risk of infection/reinfection. If not, then we are just wasting time trying to clean your system. Further, other tools used during the disinfection process may detect crack and keygens so we need to ensure they have been removed.

Using these types of programs or the websites you visited to get them is almost a guaranteed way to get yourself infected!!


Next run ATF and SAS:

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining
.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program
.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 DanLardy

DanLardy
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 22 June 2011 - 09:31 AM

OK thanks, log below. PC seems to work fine, internet was faster yesterday but things seem to be taking longer to open today. I'd happily uninstall any cracked software if it will help!

btw thought might be worth mentioning i always get a pop-up (for few months before Malware incident) from my anti virus saying 'Guard: Autonrun blocked. Access to the file 'G:\Autorun.inf' was blocked for security. This must be to do with external G drive, a seagate one which the Ceedo software has stopped working for simultaneously.

Also when shutting down often get pop up : USRprbdA.exe - DLL initialization failed...app failed to initialize because the station is shutting down.

Here is the latest log, didn't seem to pick anything up.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/22/2011 at 03:05 PM

Application Version : 4.54.1000

Core Rules Database Version : 7305
Trace Rules Database Version: 5117

Scan type : Complete Scan
Total Scan Time : 03:16:44

Memory items scanned : 242
Memory threats detected : 0
Registry items scanned : 4863
Registry threats detected : 0
File items scanned : 76790
File threats detected : 0

Edited by DanLardy, 22 June 2011 - 09:33 AM.


#8 DanLardy

DanLardy
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 22 June 2011 - 12:10 PM

Things are running very slowly at the moment. I tried to open my Downloads folder and up comes a 'Protection Error' Error:90 _1610612737
Trying to close or clicking ok causes the open window to crash.
Doesn't seem to good really?

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,914 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:38 AM

Posted 22 June 2011 - 01:08 PM

Appears to be an Audio or video file corruption.

First try doing a System Restore to a day or 2 ago.

Windows XP System Restore Guide


OR run
SFC

Please run SFC (System File Checker)
Please run System File Checker sfc /scannow... For more information on this tool see How To Use Sfc.exe To Repair System Files

NOTE for Vista/WIN 7 users..The command needs to be run from an Elevated Command Prompt.Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the CD when asked.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users