Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Clearing up after effects of a Malware attack


  • Please log in to reply
4 replies to this topic

#1 pipling

pipling

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:48 PM

Posted 16 October 2013 - 07:26 PM

I’m looking for some advice on dealing with some after effects of a malware attack that I have been able to rectify using the tools and techniques from the good folks on this site. Don’t worry, I won’t post any HijackThis etc logs, I have a clue about what I’m doing, but would like an opinion on the best way to proceed. I am running Win XP Pro SP3.

 

First of all, I do run a slate of anti-viral programs so it is very unusual for me to get a problem, but some sneaky thing did somehow get through. It showed no signs of immediate infection, but it did latch onto my boot routine. I normally put my machine on standby, so it is possible that I was infected for quite sometime before the gremlin was activated.

 

Before I did the reboot, I cloned my c drive to my d drive so I have a perfect snapshot of my system before infection. The infection appears to be of the rogue type that deletes files in various applications, including anti-virus software, though they don’t appear to be renamed or put into temp folders like some I have read about here. It also completely mucked my user profile. I was soon able to figure out which program files had been hit, plus a whack of dlls missing from \windows\system32 folder.

 

I was able to synch the effected folders to my d drive and recovered around 1500 files, then scrubbed the system using tools recommended on this website. All went well and I am satisfied that the infection has been purged. I figured I would run the system for a while and see if I missed anything or if there were any other problems. Everything has been fine with two exceptions. I am no longer able to perform any Windows updates. They run for a while, then hang and finally simply say “Some updates could not be installed”. I am also unable to print anything to my network printer. I tried stopping and restarting the spooler, then I tried to reinstall the drivers, I was able to uninstall, but the reinstall blew up with an unhelpful error message.

 

Evidentially some windows configuration files and/or the registry has been compromised. At this point I see two avenues of attack. First, I could try doing an xp repair install. I’m somewhat reluctant, haven’t done one of those in many years, I’m afraid if it fails it might leave my system unusable. Perhaps I’m being unduly pessimistic.

 

The other option is to back up my data to a stick, purge the malware from my mirror d drive, swap drives, reboot, restore my data and in theory I should be exactly where I left off, even my user profile should be faithfully restored. The problem is that if I have unsuccessfully removed the malware, then the moment I reboot it will again trash my files, and this time I will have lost my good backup forever. I have no idea if booting in safe mode would make a difference or not.

 

Which of these approaches do you prefer, or perhaps you have a third way that I haven’t thought of?

 

Many thanks.



BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,072 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:48 PM

Posted 16 October 2013 - 08:08 PM

Hello pipling, I say
Download [url=http://[url="Windows Repair (All in One)[/url]from site
Install the program then run it.
NOTE 1. In Windows Vista, 7 and 8 right click on the program, click "Run As Administrator".
NOTE 2. Disable your antivirus program before running Windows Repair.

Go to Step 2 and allow it to run CheckDisk by clicking on Do It button:
p22002979.gif
 
Once that is done then go to Step 3 and allow it to run System File Check by clicking on Do It button:
p22002980.gif

Go to Step 4 and under "System Restore" click on Create button:
p22002982.gif

Go to Start Repairs tab and click Start button.
Leave all checkmarks as they're.
NOTE for Windows 8 users. Reset Registry Permissions is NOT checked by design.
Click on Start button.
p22003030.gif
Post Windows Repair log (_windows_repair_log.txt) which is located in the following folder:
64-bit systems - C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Logs
32-bit systems - C:\Program Files\Tweaking.com\Windows Repair (All in One)\Logs

Edited by boopme, 16 October 2013 - 08:26 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 pipling

pipling
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:48 PM

Posted 18 October 2013 - 10:31 PM

I downloaded the tool you suggested and followed the directions. In the pre-process it ran windows sfc, which asked me to put in the  XP SP3 CD, I put in my original XP disk and it took a long while to run and seemed to be copying at times but towards the end it failed and the window closed before I could see the error message.

 

After running the tool I again tried to install the windows updates that are waiting, they failed in the same way as before.

 

Here is the listing from the repair log:

Starting Repairs...
   Start (2013-10-17 2:57:03 PM)

01 - Reset Registry Permissions 01/03
   HKEY_CURRENT_USER & Sub Keys
   Start (2013-10-17 2:57:03 PM)
   Running Repair Under Current User Account
   Done (2013-10-17 2:57:09 PM)

01 - Reset Registry Permissions 02/03
   HKEY_LOCAL_MACHINE & Sub Keys
   Start (2013-10-17 2:57:09 PM)
   Running Repair Under System Account
   Done (2013-10-17 2:58:00 PM)

01 - Reset Registry Permissions 03/03
   HKEY_CLASSES_ROOT & Sub Keys
   Start (2013-10-17 2:58:00 PM)
   Running Repair Under System Account
   Done (2013-10-17 2:58:28 PM)

03 - Register System Files
   Start (2013-10-17 2:58:28 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:00:57 PM)

04 - Repair WMI
   Start (2013-10-17 3:00:57 PM)
   Running Repair Under Current User Account
   Done (2013-10-17 3:09:02 PM)

05 - Repair Windows Firewall
   Start (2013-10-17 3:09:02 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:09:16 PM)

06 - Repair Internet Explorer
   Start (2013-10-17 3:09:16 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:13:01 PM)

07 - Repair MDAC/MS Jet
   Start (2013-10-17 3:13:01 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:13:18 PM)

08 - Repair Hosts File
   Start (2013-10-17 3:13:18 PM)
   Running Repair Under System Account
   Done (2013-10-17 3:13:20 PM)

09 - Remove Policies Set By Infections
   Start (2013-10-17 3:13:20 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:13:25 PM)

10 - Repair Missing Start Menu Icons Removed By Infections
   Start (2013-10-17 3:13:25 PM)
   Running Repair Under System Account
   Done (2013-10-17 3:13:27 PM)

11 - Repair Icons
   Start (2013-10-17 3:13:27 PM)
   Running Repair Under System Account
   Done (2013-10-17 3:13:29 PM)

12 - Repair Winsock & DNS Cache
   Start (2013-10-17 3:13:29 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:13:38 PM)

14 - Repair Proxy Settings
   Start (2013-10-17 3:13:38 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:13:42 PM)

16 - Repair Windows Updates
   Start (2013-10-17 3:13:42 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:14:29 PM)

17 - Repair CD/DVD Missing/Not Working
   Start (2013-10-17 3:14:29 PM)
   Done (2013-10-17 3:14:29 PM)

18 - Repair Volume Shadow Copy Service
   Start (2013-10-17 3:14:29 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:14:55 PM)

20 - Repair MSI (Windows Installer)
   Start (2013-10-17 3:14:55 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:10 PM)

22.01 - Repair bat Association
   Start (2013-10-17 3:15:10 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:14 PM)

22.02 - Repair cmd Association
   Start (2013-10-17 3:15:14 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:19 PM)

22.03 - Repair com Association
   Start (2013-10-17 3:15:19 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:24 PM)

22.04 - Repair Directory Association
   Start (2013-10-17 3:15:24 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:28 PM)

22.05 - Repair Drive Association
   Start (2013-10-17 3:15:28 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:33 PM)

22.06 - Repair exe Association
   Start (2013-10-17 3:15:33 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:37 PM)

22.07 - Repair Folder Association
   Start (2013-10-17 3:15:37 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:42 PM)

22.08 - Repair inf Association
   Start (2013-10-17 3:15:42 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:46 PM)

22.09 - Repair lnk (Shortcuts) Association
   Start (2013-10-17 3:15:46 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:51 PM)

22.10 - Repair msc Association
   Start (2013-10-17 3:15:51 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:15:55 PM)

22.11 - Repair reg Association
   Start (2013-10-17 3:15:55 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:16:00 PM)

22.12 - Repair scr Association
   Start (2013-10-17 3:16:00 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:16:04 PM)

23 - Repair Windows Safe Mode
   Start (2013-10-17 3:16:04 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:16:09 PM)

24 - Repair Print Spooler
   Start (2013-10-17 3:16:09 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:16:21 PM)

25 - Restore Important Windows Services
   Start (2013-10-17 3:16:21 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:16:32 PM)

26 - Set Windows Services To Default Startup
   Start (2013-10-17 3:16:32 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2013-10-17 3:16:52 PM)

Cleaning up empty logs...

All Selected Repairs Done.
   Done (2013-10-17 3:16:52 PM)
   Total Repair Time: 00:19:49


...YOU MUST RESTART YOUR SYSTEM...
   Running Repair Under Current User Account

----

 

System continues to run fine in all other ways, I suspect I'm still missing some isolated windows files that the repair tool is unable to recover.



#4 pipling

pipling
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:48 PM

Posted 19 October 2013 - 10:21 PM

Anybody with an opinion on my original question?



#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,072 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:48 PM

Posted 20 October 2013 - 08:36 PM

Try the Fix-It button here


How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users