Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

TDL4: custom:26000022 malware?


  • This topic is locked This topic is locked
61 replies to this topic

#1 robin983

robin983

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:28 AM

Posted 05 December 2012 - 12:28 PM

Please help. I'm not very tech savvy. I have a dell laptop running windows 7. A nice person at major geeks site was trying to help me, but apparently we are on different time zones and the fix didn't work.

I ran frst64.exe scan today and the log is attached. Please see multiple "attentions" My prior log run yeaterday, showed zeroaccess infection . I obtained a fix log from that nice person at major geeks and used it but it didn't work. also attached is the fix log I used and the first FRST scan.

Thank you in advance!!
Robin

Attached Files



BC AdBot (Login to Remove)

 


#2 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:08:28 AM

Posted 05 December 2012 - 01:19 PM

Hello robin983,

Welcome to the forum.

  • Please inform the helper at MojorKeeks forum to close your topic there. Also give me a link to that topic.
  • We will remove the infection and bring the system back to full functionality. Please refrain from doing any fix or making any changes to the system from now on until we are done unless you decide you can do the rest on your own. Thank you.
  • We might be on different time zones but we will resolve the issue anyway.
  • Finally, please copy and paste the logs instead of attaching them.
  • There were two different rootkit/bootkit infections. One of them is removed but the other one is still there. Give me a description of the current condition of the computer. Is it bootable or not?


#3 robin983

robin983
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:28 AM

Posted 05 December 2012 - 04:41 PM

Hello there-yes the computer is bootable. thanks for your help!

#4 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:08:28 AM

Posted 05 December 2012 - 04:45 PM

Than you for the short feedback.

Please read all my post, then tell me if you have any problem doing the first step.

#5 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:08:28 AM

Posted 05 December 2012 - 04:46 PM

Please don't miss my previous post.

FYI: When we are both online and you remain viewing the topic, to see my reply you have to use F5 key to refresh the web page otherwise you continue to see your own reply until you exit viewing the topic. The site doesn't automatically refreshes the page when a reply is posted.

#6 robin983

robin983
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:28 AM

Posted 05 December 2012 - 05:04 PM

http://forums.majorgeeks.com/showthread.php?t=270247

#7 robin983

robin983
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:28 AM

Posted 05 December 2012 - 05:08 PM

Hello, the link is above and I thanked the other nice computer helper at Major Geeks. My computer is bootable, please advise. thank you for your help! Robin

#8 robin983

robin983
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:28 AM

Posted 05 December 2012 - 05:17 PM

Thank you robin983for posting the log again. But I meant copy and and paste the future logs. I deleted them. :)

Farbar

Edited by Farbar, 05 December 2012 - 05:24 PM.


#9 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:08:28 AM

Posted 05 December 2012 - 05:21 PM

  • Please download Listparts
    Your version is x64 version. Save it to the flash drive.
  • Download Attached File  fix.txt   118bytes   29 downloads
    Save it to the flash drive.
    The fix.list should be saved in the same directory as ListParts.
    Run ListParts, click Fix.
    When it is finished click Scan and post the log (Result.txt) it makes.
  • I read on that topic that you can't run tools in normal mode and have no internet access. After doing the fix I would like you to give me a short description of the current condition of your computer. We are not done yet but I would like you to give me some feedback so that I make priorities in dealing with them.

Edit: Please read the next post.

Edited by Farbar, 05 December 2012 - 05:36 PM.


#10 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:08:28 AM

Posted 05 December 2012 - 05:33 PM

I'm sorry my instruction is not complete, to run ListParts you should run it recovery environment like FRST64.

First boot to System Recovery Options, select Command Prompt, type e:\listparts64 and press Enter.

#11 robin983

robin983
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:28 AM

Posted 05 December 2012 - 05:39 PM

Thank you. The way I ran the tolls previously was from the command prompt in the recovery mode. Is that how you want me to do this (sorry not tech savvy)
Thank you! Robin

#12 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:08:28 AM

Posted 05 December 2012 - 05:41 PM

Yes please.

#13 robin983

robin983
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:28 AM

Posted 05 December 2012 - 06:07 PM

here is my result log & thank you for the help!


istParts by Farbar Version: 30-10-2012
Ran by SYSTEM (administrator) on 05-12-2012 at 11:03:42
Windows 7 (X64)
Running From: E:\
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 12%
Total physical RAM: 3892.51 MB
Available physical RAM: 3398.56 MB
Total Pagefile: 3890.66 MB
Available Pagefile: 3384.78 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:451.01 GB) (Free:402.39 GB) NTFS
2 Drive d: (Repair disc Windows 7 64-bit) (CDROM) (Total:0.15 GB) (Free:0 GB) UDF
3 Drive e: (PATRIOT) (Removable) (Total:3.73 GB) (Free:3.71 GB) FAT32
4 Drive f: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:5.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 465 GB 0 B
Disk 1 No Media 0 B 0 B
Disk 2 Online 3824 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 100 MB 1024 KB
Partition 2 Primary 14 GB 101 MB
Partition 3 Primary 451 GB 14 GB

======================================================================================================

Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 FAT Partition 100 MB Healthy Hidden

======================================================================================================

Disk: 0
Partition 2
Type : 07

#14 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,707 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:08:28 AM

Posted 05 December 2012 - 06:09 PM

Thank you. Please post the whole log, that is a part of it.

#15 robin983

robin983
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Local time:01:28 AM

Posted 05 December 2012 - 06:09 PM

oh sorry I didn't read entirely. Would you like me to try and boot normally? Thanks!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users