Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with System Fix... An Updated Version


  • Please log in to reply
9 replies to this topic

#1 ysuleman

ysuleman

  • Members
  • 74 posts
  • OFFLINE
  •  
  • Local time:02:59 PM

Posted 19 December 2011 - 03:51 PM

Hey... I was on your tutorial for removing system fix, but it does not work for this new version of system fix. I can't do anything. Even in Safe mode I do not see Internet Explorer or Chrome.

Help me Please. I am stuck.

Thanks

Edited by ysuleman, 19 December 2011 - 04:43 PM.


BC AdBot (Login to Remove)

 


#2 ysuleman

ysuleman
  • Topic Starter

  • Members
  • 74 posts
  • OFFLINE
  •  
  • Local time:02:59 PM

Posted 19 December 2011 - 10:04 PM

Update. I managed to remove System Fix (I think), but I can't see any programs or anything on my desktop or under start menu.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8400

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

12/19/2011 8:59:39 PM
mbam-log-2011-12-19 (20-58-50).txt

Scan type: Full scan (C:\|)
Objects scanned: 302477
Time elapsed: 25 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Arcadeweb (Adware.ArcadeWeb) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KDDBMACIkSDmIg.exe (Rogue.FakeHDD) -> Value: KDDBMACIkSDmIg.exe -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\kddbmaciksdmig.exe (Rogue.FakeHDD) -> No action taken.

#3 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,924 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:59 PM

Posted 19 December 2011 - 11:29 PM

Hello, This infection family will also hide all the files on your computer from being seen. To make your files visible again, please download the following program to your desktop:

Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.


>>>>
Please Download
TDSSKiller.zip

>>> Double-click on TDSSKiller.exe to run the application.
  • Click on the Start Scan button and wait for the scan and disinfection process to be over.
  • If an infected file is detected, the default action will be Cure, click on Continue
    Posted Image
  • If a suspicious file is detected, the default action will be Skip, click on Continue
    Posted Image
  • If you are asked to reboot the computer to complete the process, click on the Reboot Now button. A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt). Please copy and paste the contents of that file here.
  • If no reboot is required, click on Report. A log file will appear. Please copy and paste the contents of that file in your next reply.


>>>>


Run RKill....


Download and Run RKill
  • Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

    Link 1
    Link 2
    Link 3
    Link 4

  • Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  • Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • If nothing happens or if the tool does not run, please let me know in your next reply

Do not reboot your computer after running rkill as the malware programs will start again. Or if rebooting is required run it again.


If you continue having problems running rkill.com, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.



Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select FULL scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

Please ask any needed questions,post logs and Let us know how the PC is running now.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#4 ysuleman

ysuleman
  • Topic Starter

  • Members
  • 74 posts
  • OFFLINE
  •  
  • Local time:02:59 PM

Posted 20 December 2011 - 12:14 PM

I ran everything, but I could not get TDSKiller to run in normal or in safe mode. It would open. When I click on it or run as administrator nothing would happen.

There are also some other little problems I am facing. For one on teh start menu I can't see my computer or control panel. Also when the computer starts there is an error. I have posted Screenshots of the problem. Also I noticed Redirects in Google Chrome.

http://imageshack.us/photo/my-images/839/24130747.jpg/
http://imageshack.us/photo/my-images/845/53417476.png/

Here is the Log For Malwarebytes

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8400

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/20/2011 10:43:09 AM
mbam-log-2011-12-20 (10-43-09).txt

Scan type: Full scan (C:\|)
Objects scanned: 301780
Time elapsed: 24 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,924 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:59 PM

Posted 20 December 2011 - 03:10 PM

OK you did run the Unhide Application and still cannot see them?

Download the FixTDSS.exe

Save the file to your Windows desktop.
Close all running programs.
If you are running Windows XP, turn off System Restore. How to turn off or turn on Windows XP System Restore
Double-click the FixTDSS.exe file to start the removal tool.
Click Start to begin the process, and then allow the tool to run.
Restart the computer when prompted by the tool.
After the computer has started, the tool will inform you of the state of infection (make sure to let me know what it said)
If you are running Windows XP, re-enable System Restore.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 ysuleman

ysuleman
  • Topic Starter

  • Members
  • 74 posts
  • OFFLINE
  •  
  • Local time:02:59 PM

Posted 20 December 2011 - 04:27 PM

The only icons that are not showing ot on the right side of the start menu. Where it should say documents, computer, music. ect....

The message it says is "Infected MBR Detected"

and it says repair or cancel...

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,924 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:59 PM

Posted 20 December 2011 - 04:38 PM

Please select the repair.

For the icon issue.

Run the one here that matches your operating system.
Windows 7 32-bit US English
http://download.bleepingcomputer.com/grinler/fakehdd/win7-32-sm-reset.exe

Windows 7 64-bit US English
http://download.bleepingcomputer.com/grinler/fakehdd/win7-x64-sm-reset.exe
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 ysuleman

ysuleman
  • Topic Starter

  • Members
  • 74 posts
  • OFFLINE
  •  
  • Local time:02:59 PM

Posted 20 December 2011 - 04:46 PM

When I returned back to the computer the blue screen of the death came on. So I turned it on again and ran that program again and it spat this out..

"Suspicious use of kernel Callback MBR appears intact. Repair not done. No infections were found."

#9 ysuleman

ysuleman
  • Topic Starter

  • Members
  • 74 posts
  • OFFLINE
  •  
  • Local time:02:59 PM

Posted 20 December 2011 - 09:08 PM

I am also receiving the blue screen of death...

#10 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,924 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:59 PM

Posted 21 December 2011 - 02:47 PM

can you use the PC ??

If so
We need a deeper look. Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
Skip GMER and move on.
Include a link back to this topic.

Let me know if that went well.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users