Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

security and other turned off, can't turn them on


  • This topic is locked This topic is locked
28 replies to this topic

#1 DottieR

DottieR

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 23 September 2011 - 08:50 AM

I was on a real estate web site when the no-security balloons came up.
I can't turn them on. The services list in msconfig shows all boxes checked but I can't start them. Browser, sound. wireless zero config and others. Takes longer than usual to boot up.

When I ran GMER, the scan started automatically. After about 5 min it stopped writing anything but ran for another 2 hrs or more then turned off and disappeared. I redid it and just saved after it had written what was apparently everything. So I hope this is what you need.

No problems noted lately. Nothing new except downloading Skype a couple days ago.

Will have to try to upload GMER log in another email. Maybe the browser in this old computer is not up to date.

Rest of files.

Merged posts. ~ OB

Attached Files


Edited by Orange Blossom, 23 September 2011 - 05:15 PM.


BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:44 PM

Posted 28 September 2011 - 08:55 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/420120 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 DottieR

DottieR
  • Topic Starter

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 28 September 2011 - 11:12 PM

Last week my security was suddenly turned off and I couldn't turn it back on. Eventually my wireless went out also. msconfig/services showed a number of services stopped, audio, Avast, security, wireless zero config and other stuff. The boxes were checked but they were stopped. After almost a week of waiting for you guys to read my scans I started running antivirus stuff. SuperAntiSpyware found "Browser Hijacker.Tubby", "Trojan.Agent/Gen-Falcap[Rt]" and "Trojan.Agent/Gen-Cryptor[Egun]".

SpyBot found "Huntbar.Stoolbar" and "msWindowsSecurityCenter AntiVirus OverRide".

Kapersky didn't find much, "8fccc208" and "Imapi", which it thought should be removed.

After that I could get on the internet, but still no Avast or MSSE. So I finally uninstalled and reinstalled them today and so far they are working.

I found "Updater" in my startup file. That seems to be a problem. I unchecked it and it is still unchecked after reboot.

Had a couple of pop-ups lately, but not since I debugged.

Hijackthis didn't find anything today.

visscan.org found "C:\WINDOWS\System32\ws2-32.dll". I am not sure what that is all about.

Tubby seems to be, from what I read, hard to get rid of.
So what do I have left? although everything seems OK at the moment.

I have my XP installation CD.

Attached Files



#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,247 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:44 PM

Posted 29 September 2011 - 01:43 AM

Hello, my name is Elise and I'll assist you with this issue.

Unfortunately you have a nasty rootkit on your computer. Please read the following first.

BACKDOOR WARNING
------------------------------
One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.


COMBOFIX
---------------
Please download ComboFix from one of these locations:
Bleepingcomputer
ForoSpyware
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 DottieR

DottieR
  • Topic Starter

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 29 September 2011 - 10:48 AM

I will be happy to reinstall the OS. Will that take care of the problem or are my documents suspect?

A tech from MS wants to take control of my computer and thinks he can solve the problem in a few minutes. Is it possible for him to do that with good results?

#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,247 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:44 PM

Posted 29 September 2011 - 10:53 AM

If he's real lucky he could solve it, but this rootkit has usually a few nasty surprises. I've cleaned it a lot lately, it really depends on the version. Minutes is quite exaggerated though.

A reformat will take care of this too, although if you want to back up data, better go through with the cleaning first so you will be sure all backed up data is clean.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 DottieR

DottieR
  • Topic Starter

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 29 September 2011 - 11:18 AM

Thank you.

Do you mean to run combofix first then redo the OS?

#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,247 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:44 PM

Posted 29 September 2011 - 11:21 AM

Yes, run combofix first, once everything is confirmed clean, you can then backup and reinstall. If you don't have a lot to backup and you want to reformat/reinstall, you can of course also format directly.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#9 DottieR

DottieR
  • Topic Starter

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 29 September 2011 - 11:23 AM

Now you are saying to run combofix, then wipe the disk not just the OS?

#10 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,247 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:44 PM

Posted 29 September 2011 - 11:38 AM

The only way to be sure the backdoor is gone is a reformat followed by a reinstall, yes, as outlined also in my original warning. :)

Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:


regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#11 DottieR

DottieR
  • Topic Starter

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 29 September 2011 - 11:42 AM

"a reformat and reinstall of the OS" is not the same as reformatting the whole hard disk. I am willing to reformat the disk, but not if reinstall of the OS is sufficient.

#12 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,247 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:44 PM

Posted 29 September 2011 - 12:58 PM

If by that you mean a reformat only of the partition that contains your windows installation, then yes, it will suffice, as this is not an MBR rootkit.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#13 DottieR

DottieR
  • Topic Starter

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 29 September 2011 - 03:17 PM

I am still not sure what that means. My disk is not partitioned. If I have to reinstall more that the OS that means reformat the disk. I am still not sure if you are talking about wiping the disk or reinstalling the OS.

I switched to my old computer. I downloaded combofix and a malware update and my internet connection went out. Combofix restored it, So this combofix file is for my old computer, not the one I originally wrote about. I will now run combofix on the other one and send it.

Attached Files



#14 DottieR

DottieR
  • Topic Starter

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 29 September 2011 - 03:19 PM

Now I have the problem of an obviously infected USB stick with my backups. How do I clean that. There are a couple of docs that I really don't want to lose.

Thanks.

#15 DottieR

DottieR
  • Topic Starter

  • Members
  • 278 posts
  • OFFLINE
  •  
  • Local time:01:44 PM

Posted 29 September 2011 - 06:00 PM

This is the combofix scan on my regular computer. I was unable to turn off MS security essentials.

Attached Files






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users