Jack&Jill

Hello SpoonBill , There is no need for any scans or logs. Some tips to help you stay clean and safe: 1. Keep your Windows up to date. Enable Automatic Updates for Windows XP, Windows Vista or Windows 7 to always update the latest security patches from Microsoft, or you can download from the Microsoft website. Otherwise, your computer will be vulnerable to new exploits or malwares. 2. Update your Antivirus program regularly, it is a must for constant protection against viruses. If you do not have one, Microsoft Security Essentials and Avast are some great and free antivirus programs that you can try. For paid versions, Avast, ESET NOD32 and Kaspersky are some good options. Please keep only one AV installed. 3. Install Malwarebytes' Anti-Malware if you haven't and use it occasionally. It is a new and powerful anti-malware tool, totally free but for real-time protection you will have to pay a small one-time fee. 4. Install WinPatrol, a great protection program that helps you monitor for unwanted files or applications. 5. Use a hosts file to block the access of bad sites from your computer. Get yourself a MVPS Hosts for this purpose. 6. Install Web of Trust (WOT). WOT keeps you from dangerous websites with warnings and blockings. 7. Protect your computer from removable or USB drive infections with MCShield, an effective method to prevent malware from spreading. 8. Keep all your softwares updated. Visit Secunia Software Inspector to find out if any updates required. 9. Install a third party firewall if you do not have one for additional defense against internet dangers. Built-in Windows firewall can only keep nasties from breaking in, but unable to protect against any malwares from sending information out. Some recommended firewalls are Online Armor, Outpost and PC Tools. More information on firewalls. Please keep only one FW installed. 10. Also look up: Computer Security - a short guide to staying safer online PC Safety and Security - What Do I Need? By Glaswegian How to prevent malware: By miekiemoes So how did I get infected in the first place? By Tony Klein Microsoft Online Safety Stay safe.

Hello SpoonBill , Did the reformatting go well?

Hello SpoonBill , How did things go with the data transfer and reformat? If there are no more issues, I would like to close this topic.

Hello and welcome to Malwarebytes. I am currently assessing your situation and will be back with a fix for your problem as soon as possible. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this, click Follow this topic near the top of the page, then ensure Receive notification is checked (ticked) and Instantly selected. Click on Follow this topic. If it shows Unfollow this topic, it means you are already subscribed. Please be patient with me during this time. Meanwhile, please make a reply to this topic to acknowledge that you have read this and is still with me to tackle the problem until the end. If I do not get any response within 3 days, this topic will be closed.

Hello SpoonBill , For data transfer, I suggest you use alternative OS such as Puppy Linux. That way you can transfer files safely to USB or CD. Reformatting is the better option. It is a good decision. Please make sure you have the Windows disc. To reformat and reinstall the OS, you may follow these steps: Windows XP Clean Installation Clean Install Windows XP

Hello SpoonBill , Welcome to Malwarebytes. I am Jack&Jill, and I will be helping you out. Before we go further, there are a few things that I would like to make clear so that we are share the same understanding. Please observe and follow these Terms of Use. Any advice is for your computer only and is taken at your own risk. Fixes sometimes will cause unexpected results, but I will do my best to assist you. Please read the instructions carefully and follow them closely, in the order they are presented to you. If you have any doubts or problems during the fix, please stop and ask. All the tools that I will ask you to download and use are safe. Please allow if prompted by any of your security softwares. Do not use or run any malware cleaning tools without supervision as they may cause more harm if improperly used. Refrain from installing any new programs except those that I request during the fix to prevent interference to my diagnosis of the problem. Lack of malware symptoms does not mean your computer is clean. Stick to this topic until I give the All Clear. If you do not reply within 3 days, this topic will be closed. If you are agreeable to the above, then everything should go smoothly . We may begin. -------------------- Your computer has/had some serious infections with rootkit/backdoor capabilities. Sorry for the bad news. Backdoors provide outsiders full access to your computer, enabling them to record key strokes, steal passwords, spread malwares, and even using it for other illegal activities. If your computer has been used for important or sensitive data such as online banking, shopping or any other financial transactions, I strongly recommend you to do the following: Disconnect from the Internet and any network immediately. Inform your financial institutions that you may be a victim of identity theft and to put a watch on all your accounts or change them. Change all your online passwords from a clean computer. Take any other steps that you may think is necessary to prevent financial distress due to identity theft. Due to the backdoor functionality, your computer is compromised and can no longer be fully trusted. Many experts in the security community believe that once tainted with this type of infections, the best course of action would be a reformat and reinstall of the OS. I too strongly recommend you to format your computer. We can still attempt to clean it if you wish, but due to the severity of the infections, I cannot guarantee it will be safe or clean afterwards. It is up to you to decide. Please let me know which course of action you wish to take. Here are some read to help you decide: How to respond to possible ID theft and Internet fraud When should I reformat?

Hello and welcome to Malwarebytes. I am currently assessing your situation and will be back with a fix for your problem as soon as possible. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this, click Follow this topic near the top of the page, then ensure Receive notification is checked (ticked) and Instantly selected. Click on Follow this topic. If it shows Unfollow this topic, it means you are already subscribed. Please be patient with me during this time. Meanwhile, please make a reply to this topic to acknowledge that you have read this and is still with me to tackle the problem until the end. If I do not get any response within 3 days, this topic will be closed.

Hello peanutz1997 , Welcome to Malwarebytes. I am Jack&Jill, and I will be helping you out. Before we go further, there are a few things that I would like to make clear so that we are share the same understanding. Please observe and follow these Terms of Use. Any advice is for your computer only and is taken at your own risk. Fixes sometimes will cause unexpected results, but I will do my best to assist you. Please read the instructions carefully and follow them closely, in the order they are presented to you. If you have any doubts or problems during the fix, please stop and ask. All the tools that I will ask you to download and use are safe. Please allow if prompted by any of your security softwares. Do not use or run any malware cleaning tools without supervision as they may cause more harm if improperly used. Refrain from installing any new programs except those that I request during the fix to prevent interference to my diagnosis of the problem. Lack of malware symptoms does not mean your computer is clean. Stick to this topic until I give the All Clear. If you do not reply within 3 days, this topic will be closed. If you are agreeable to the above, then everything should go smoothly . We may begin. -------------------- Please download DDS from one of the links below and save it to your desktop. Link 1 Link 2 Link 3 Please disable any script blocker before running DDS. Double click on the dds file and a command window will appear. This is normal. Shortly after, two logs will appear: DDS.txt Attach.txt [*]A window will open instructing you to save and post the logs. [*]Save the logs to a convenient location such as your desktop. [*]Copy the contents of both logs and post them in your next reply. -------------------- Please post back: 1. the DDS logs (DDS.txt and Attach.txt)

Hello and welcome to Malwarebytes. I am currently assessing your situation and will be back with a fix for your problem as soon as possible. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this, click Watch Topic near the top of the page, then select Immediate Notification. Click on Proceed. If it shows Stop watching topic, it means you are already subscribed. Please be patient with me during this time. Meanwhile, please make a reply to this topic to acknowledge that you have read this and is still with me to tackle the problem until the end. If I do not get any response within 3 days, this topic will be closed.

Hello Mike31387 , Welcome to Malwarebytes. I am Jack&Jill, and I will be helping you out. Before we go further, there are a few things that I would like to make clear so that we are share the same understanding. Please observe and follow these Terms of Use. Any advice is for your computer only and is taken at your own risk. Fixes sometimes will cause unexpected results, but I will do my best to assist you. Please read the instructions carefully and follow them closely, in the order they are presented to you. If you have any doubts or problems during the fix, please stop and ask. All the tools that I will ask you to download and use are safe. Please allow if prompted by any of your security softwares. Do not use or run any malware cleaning tools without supervision as they may cause more harm if improperly used. Refrain from installing any new programs except those that I request during the fix to prevent interference to my diagnosis of the problem. Lack of malware symptoms does not mean your computer is clean. Stick to this topic until I give the All Clear. If you do not reply within 3 days, this topic will be closed. If you are agreeable to the above, then everything should go smoothly . We may begin. -------------------- Please download DDS from one of the links below and save it to your desktop. Link 1 Link 2 Link 3 Please disable any script blocker before running DDS. Double click on the dds file and a command window will appear. This is normal. Shortly after, two logs will appear: DDS.txt Attach.txt [*]A window will open instructing you to save and post the logs. [*]Save the logs to a convenient location such as your desktop. [*]Copy the contents of both logs and post them in your next reply. -------------------- Please post back: 1. the DDS logs (DDS.txt and Attach.txt)

Hello and welcome to Malwarebytes. I am currently assessing your situation and will be back with a fix for your problem as soon as possible. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this, click Watch Topic near the top of the page, then select Immediate Notification. Click on Proceed. If it shows Stop watching topic, it means you are already subscribed. Please be patient with me during this time. Meanwhile, please make a reply to this topic to acknowledge that you have read this and is still with me to tackle the problem until the end. If I do not get any response within 3 days, this topic will be closed.

Hello six2 , You are most welcome. To get the best AV for your machine, you will need to try out the options available because most AVs are made to be fast, but the speed will depend on your computer setup. Besides the two free AVs that I have suggested, paid ones like ESET NOD32 is also very good. I have ESET on my machine. Remember to have only one installed because more will cause conflict and slow down. I will keep this topic open for another day in case you have any questions.

Hello six2 , Congratulations, you are All Clear to go. Glad to hear everything is good and running . If you have any more problems, please let me know. Now we need to clear out the programs we have been using to clean up your computer. They are not suitable for general malware removal and could cause damage if used inappropriately. Go to Start > Run.... Copy and paste the following text into the white box: ComboFix /uninstall Click OK. Run OTL by double clicking on OTL.exe. Click on CleanUp, proceed to reboot if prompted. Delete the aswMBR, CKScanner, MiniToolBox, GMER, RogueKiller, Rootkit Unhooker, maxlook, MBRCheck and TDSSKiller files on your desktop. Delete any logs on the desktop. Some tips to help you stay clean and safe: 1. Keep your Windows up to date. Enable Automatic Updates for Windows XP to always update the latest security patches from Microsoft, or you can download from the Microsoft website. Otherwise, your computer will be vulnerable to new exploits or malwares. 2. Update your Antivirus program regularly, it is a must for constant protection against viruses. Please keep only one AV installed. 3. Install Malwarebytes' Anti-Malware if you haven't and use it occasionally. It is a new and powerful anti-malware tool, totally free but for real-time protection you will have to pay a small one-time fee. 4. Install WinPatrol, a great protection program that helps you monitor for unwanted files or applications. 5. Use a hosts file to block the access of bad sites from your computer. Get yourself a MVPS Hosts for this purpose. 6. Install Web of Trust (WOT). WOT keeps you from dangerous websites with warnings and blockings. 7. Protect your computer from removable or USB drive infections with MCShield, an effective method to prevent malware from spreading. 8. Keep all your softwares updated. Visit Secunia Software Inspector to find out if any updates required. 9. Also look up: Computer Security - a short guide to staying safer online PC Safety and Security - What Do I Need? By Glaswegian How to prevent malware: By miekiemoes So how did I get infected in the first place? By Tony Klein Microsoft Online Safety Stay safe.

Hello six2 , You are welcome. I have suggested these: Avast Microsoft Security Essentials Any more problems? If not, I will provide some security recommendations in the next step.

Hello six2 , Please delete these: C:\Documents and Settings\Root\My Documents\Downloads\winamp5581_full_emusic-7plus_en-us.exe C:\Documents and Settings\Root\My Documents\Downloads\winamp5621_full_emusic-7plus_all.exe Reset security registry keys Open Notepad. Copy and paste the following text into it: REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled"=dword:00000000 "AntiVirusOverride"=dword:00000000 "FirewallOverride"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall"=dword:00000001 "DisableNotifications"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=dword:00000001 "DisableNotifications"=dword:00000000 Note: Copy exactly everything in the code box. Make sure there is no empty lines at the beginning, and have one empty line at the end of the codes. Save it as Fix.reg on the desktop. Make sure the Save as type: is All Files (*.*). Double click on Fix.reg. When it asks you to merge the information to the registry, click Yes. -------------------- The remainder of the online scan's findings include backups that were created during the course of this fix, and items located in C:\System Volume Information\ where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be taking care of both, during the final cleanup. I see a lot of items disabled or customized in msconfig. You might want to take a look to enable back them if necessary. As for your other problems, maybe you could describe them and see if I could help or I can point you to a more appropriate forum dealing with non-malware issues. -------------------- I do not see any Antivirus (AV) installed on your machine. AV is a very critical part of your system to keep the it safe and clean. Without it, a computer can easily get infected. Please download and install an AV from one of the links below: Avast Microsoft Security Essentials You should only select one of these two, and keep only one installed. -------------------- Your Adobe Reader is outdated. Older versions have security vulnerabilities that can be exploited. Please update your Adobe Reader to the latest. It is important that you uninstall any previous versions by using Add/Remove Programs in your Control Panel before installing a newer version. Please uninstall: Adobe Reader 9.4.6 Go to the Adobe download page. Click here. If your OS is not the same as stated, click on Do you have a different language or operating system? link. Under the Select an operating system title, choose the OS that you have. Change the language at the Select a language title. Next, select the version of the reader at the Select a Version title. Uncheck (untick) to opt out of Google Chrome installation. Click the Download now button to proceed. Allow if prompted and save the file to a convenient location. Run the downloaded file to continue with the installation. [*]If your OS is the same, uncheck (untick) to opt out of McAfee Security Scan Plus installation. [*]Click Download to proceed. Allow if prompted and save the file to a convenient location. [*]Run the downloaded file to continue with the installation. Alternatively, you can try Foxit Reader Portable or Nuance PDF Reader. -------------------- Your Java Runtime Environment is outdated. Older versions have security vulnerabilities that can be exploited. Please update JRE to the latest. It is important that you uninstall any previous versions by using Add/Remove Programs in your Control Panel before installing a newer version. Please uninstall: Java™ 6 Update 14 Go to the Java SE download page. Click here. Look for Java SE 7. Click the Download button to the right below JRE. Click on Accept License Agreement after reading Oracle Binary Code License Agreement for Java SE. From a list of files for download, click on the link which says jre-7-windows-i586.exe besides Windows x86 Offline and save the file to your desktop. For 64-bit machines, the file to download is jre-7-windows-x64.exe besides Windows x64. Close any programs you may have running, especially your web browser. Then, from your desktop, double click on the download to install the newest version. Reboot your computer. -------------------- Please post back: 1. if you have succesfully completed the above

Hello six2 , Do an online scan with ESET Online Scanner. Please be patient as scanning will take quite some time. If you have problem running the scan, you might want to disable any real time protection that you have. Click here to go to ESET Online Scanner page. Click on Run ESET Online Scanner. A new window will open. For FireFox user, you will need to download and install esetsmartinstaller_enu.exe. Click on it and save the file to a convenient location. Double click on it to install and a new window will open. After reading through the Terms of Use, check YES, I accept the Terms of Use and click Start to begin scan. You will be prompted to install an ActiveX Control from ESET. Please install. At the Computer scan settings section, uncheck (untick) Remove found threats. <-- Important, do not remove anything yet. Then, check Scan archives. Now, click on Advanced settings and make sure all these are checked: Scan for potentially unwanted applications Scan for potentially unsafe applications Enable Anti-Stealth technology [*]Click on Scan to proceed. [*]When done, the scan result will be shown. Look for C:\Program Files\ESET\ESET Online Scanner\log.txt and open the file. [*]Post the contents in your reply. If the contents of log.txt do not reflect what is shown in the result window, click on List of found threats, then Export to text file..., save a file and post that instead. -------------------- Please post back: 1. ESET online scan result 2. how is the computer behaving?

Hello six2 , Good to hear that. Please delete the ComboFix copy that you have and get a new copy. Link 1 Link 2 Do not mouse click on ComboFix while it is running. That may cause it to stall. ComboFix is a powerful tool and must not be used without supervision. Install Recovery Console and run ComboFix Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily when running ComboFix. They will interfere and may cause unexpected results. If you need help to disable your protection programs see here and here. Double click on ComboFix.exe and follow the prompts. Please run it in Normal Mode. As part of its process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. You will be asked to install it if it is not present in your computer. Click Yes to proceed. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, click on Yes to continue scanning for malware. When finished, a log will be produced as C:\ComboFix.txt. Please post this log in your next reply. If you lose Internet connection after running ComboFix, right click on the network icon at the system tray and select Repair, or you can reboot the computer. Enable back your security softwares as soon as you completed the ComboFix steps. A detailed step by step tutorial to run ComboFix can be found here if you need help. -------------------- Please post back: 1. the ComboFix log

Hello six2 , Please get into the Recovery Console again. Then, type fixmbr. Reboot normally and have a feel of how is the computer doing. Give aswMBR a shot and post back the results.

Hello six2 , In the xPUD instruction, I requested for MBR dump. Please attach it. Thanks.

Hello six2 , Please upload this file to VT and post back the results: c:\windows\maxdrive\fbd.sys Please download Unhide© by Grinler and save it to your desktop. Click here. Double click on Unhide.exe and allow it to run. -------------------- Please have these instructions handy (printed or written down) as you will not be able to see them on the computer when we go through them. Collect offline MBR Please download dumpit and save it to your USB drive. Click here (you may need to use right click and Save Target As...). Please download driver.sh and save it to your USB drive. Click here (you may need to use right click and Save Target As...). Please boot from the xPUD CD or USB that you created earlier by setting up the BIOS to do so. Depending on the computer, the key that you need to press to enter BIOS may be different. It could be either F1, F2, F10, F12, DEL or ESC. Tap the key repeatedly when the computer is booting. You can also try pressing the Pause/Break key to freeze the startup screen temporarily to identify which key should be used as it is usually displayed. To resume, press Enter. Follow the prompts. A Welcome to xPUD screen will appear. Press File. Expand mnt. Click on sdb1 (sdb1 represents the USB drive). Double click on the dumpit file. A black window will pop up and it will dump and zip the MBR to your USB drive. Press Enter to exit the black window. In the USB, you should also see the driver.sh file. Click on Tool at the top and choose Open Terminal. Type bash driver.sh, then press Enter. After it has finished, a report will be created in your USB drive as report.txt. Click on the Home tab and choose Power Off to turn off xPUD. Reboot normally and attach mbr.zip from the USB in your reply and please post the contents of report.txt. -------------------- Please post back: 1. VT result 2. mbr.zip as attachment 3. xPUD report

Hello six2 , The driver file should not be the cause of the problem. Please delete C:\fbd.sys. What other things are hidden? -------------------- Please download MBRCheck© by a_d_13 from one of the links below and save it to your desktop. Link 1 Link 2 Link 3 Preliminary scan Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily when running MBRCheck. They will interfere and may cause unexpected results. If you need help to disable your protection programs see here and here. Double click on MBRCheck.exe to run it (Vista and Windows 7 users will have to confirm the UAC prompt). A command prompt window will open. When you see Enter 'Y' and hit ENTER for more options, or 'N' to exit:, enter N at the prompt and press Enter twice. Otherwise, just press Enter. A log file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop. Please post the contents of that file. -------------------- Delete the TDSSKiller copy that you have. Please download TDSSKiller© from Kaspersky and save it to your desktop. Click here. Alternatively, you may get the zip version and extract the file to the desktop. Double click on TDSSKiller.exe to execute it. Press Start scan to begin. If anything is found, please change all the actions to Skip only. <-- Important, please select Skip only, DO NOT proceed other actions. Then click on Continue at the lower right corner. You may be prompted to reboot your computer, please consent. Once complete, a log will be produced at C:\. It will be named TDSSKiller.Version_Date_Time_log.txt, for example, C:\TDSSKiller.2.4.12.0_26.12.2010_23.12.11_log.txt. Please post the contents of this log. -------------------- Please post back: 1. information about hidden items 2. MBRCheck log 3. TDSSKiller log

Hello six2 , The Windows CD, could you please check it and let me know if it is a reinstallation disc and what is service pack? Very likely we will make use of it. Copy file(s) Go to Start > Run.... Copy and paste the following text into the white box: cmd /c copy C:\WINDOWS\System32\drivers\fbd.sys c:\fbd.sys Click OK. -------------------- Search for driver Go to Start > Run.... Copy and paste the following text into the white box: maxlook -driver Click OK. You will be prompted to enter a file name. Please type in the following: fbd.sys A log will be produced on the desktop named looklog.txt. Please post the contents of this log. -------------------- Please post back: 1. the maxlook log

Hello six2 , Check some files with OTL Double click on OTL.exe to run it. Make sure all the None options is checked (selected). There are eight of them. Copy and paste the following into the white box under Custom Scans/Fixes: %SYSTEMDRIVE%\fbd.* /s /md5 %SYSTEMDRIVE%\*.* /lockedfiles Click on Run Scan at the top left hand corner. This might take a while. When done, the OTL.txt file will open. Please post back the contents of this log. -------------------- Upload file(s) to VirusTotal (VT) for an online scan. Click here. Click on the Browse button or the white box beside it. A File Upload prompt will open. Copy and paste the following file and its path to upload: C:\WINDOWS\System32\drivers\fbd.sys Press Open, then Send file. The file will be uploaded for testing. If there is any indication or prompt that the file has been scanned before, please proceed to have the file rescanned or reanalyzed. Please wait for all the scanners to finish, then copy and paste the result into Notepad and save it to a convenient place. Post the result in your next response. Alternatively, if VirusTotal is busy or inaccessible, you may try Jotti or VirScan (VS) with similar steps. A result from either one of the above scanners would be sufficient. -------------------- Please post back: 1. the OTL log (OTL.txt only) 2. VT result

Hello six2 , Looking at unsigned files Go to Start > Run.... Copy and paste the following text into the white box: maxlook -sig Click OK. A log will be produced on the desktop named looklog.txt. Please post the contents of this log. -------------------- Please download OTL© by OldTimer from one of the links below and save it to your desktop. Link 1 Link 2 Scan with OTL Double click on OTL.exe to run it. Make sure all the Use SafeList options is checked (ticked). There are five of them. Under the Modules section, please select No Company Name. Check Scan All Users. At the lower right corner, check LOP Check and Purity Check. Click on Run Scan at the top left hand corner. This might take a while. When done, two Notepad files will open. Please post the contents of these 2 Notepad files in your next reply. One log per reply please. Note: These files are saved as OTL.txt and Extras.txt on the desktop. -------------------- Please post back: 1. the maxlook log 2. the OTL logs (OTL.txt and Extras.txt)

Hello six2 , Please download maxlook and save it to your desktop. Click here. The first step is to ensure you can get into Recovery Console. It was installed via ComboFix just now, so please check if it works. How to install and use the Windows XP Recovery Console. To start the computer and use the Recovery Console Double click on maxlook.exe to execute it. <-- You must run it only once. As instructed when the tool runs, restart the computer and log on to the Recovery Console. At the command prompt window, please type the following: batch look.bat You will see 1 file(s) copied. many times. When done, type Exit to restart the computer into Normal mode. Please run maxlook.exe again. <-- You must run it only once. A log will be produced on the desktop named looklog.txt. Please post the contents of this log. -------------------- Please post back: 1. maxlook log