Jump to content

lowen

Honorary Members
 View Profile  See their activity

  • Posts

    25

  • Joined

  • Last visited

 Content Type 

Posts posted by lowen

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    No need to worry. ESET only found a file in Combofix quarantine. Many security applications start nagging about "trojans", "malware" and what not, while these threads are already in quarantine of another program or in system restore. In such cases its very important to analyze the filepath before deciding if this is an actual threat or not.

    We will get rid of combofix quarantine and all old system restore points in the next few steps, so everything should be fine :)

    ALL CLEAN

    --------------

    Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :)

    Please do the following to remove the remaining programs from your PC:

    • Delete the tools used during the disinfection:
      • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
      • Delete DDS, GMER (this is a random named file) and OTL.

    Please read these advices, in order to prevent reinfecting your PC:

    1. Install and update the following programs regularly:
      • an outbound firewall
        A comprehensive tutorial and a list of possible firewalls can be found here.
      • an AntiVirus Software
        It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
      • an Anti-Spyware program
        Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
        SUPERAntiSpyware is another good scanner with high detection and removal rates.
        Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
      • Spyware Blaster
        A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
      • MVPs hosts file
        A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file

    [*]Keep Windows (and your other Microsoft software) up to date!

    I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

    Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

    [*]Keep your other software up to date as well

    Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

    [*]Stay up to date!

    The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.

    Some more links you might find of interest:

    Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

    Hi Elise

    Have had a lot of sleepless nights over the laptop. a big thank you to you for your persistence.

    How do I remove DDS (what is this?) GMER and OTL - all through add & remove programmes??

    I have a firewall on the computer and my antivirus (McAfee) updates at start up. I will keep Spybot and Malware on the computer. Do you have to manually run Malware or does it do it automatically??

    Did not know about the windows & java updates being so important. Will tell everyone I know about that!

    I will let you know how I get on tonight removing all the software.

    :)

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    That is good to hear :P

    Next I need to see the extra.txt log created by OTL

    If this was not created in earlier runs, please rerun OTL, but under Extra Registry, make sure "Use Safelist" is checked.

    Have run Spybot Malwarebyte (found Malware.Packer.gen and GenericFakeAlert!ip) Windows Defender (found Win32/FakeCog) and McAfee (which also found the Generic fake but a different version.

    http://www.microsoft.com/security/portal/T...threatid=140896

    A little paranoid as I had run all the anti malware software and they came up clear and now I have more trojans!!!!............argh!

    Extras.Txt

    OTL.Txt

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Do you still have this download problem? I am a bit confused, since you mentioned later you could download Housecall (just checking :P).

    Hi Elise

    Am able to download programmes that you choose where to put ie desktop. Cannot load any programmes to the temp folder as McAfee blocks

    have found the names of the trojans that were on the machine

    DNSchanger.as

    DNSchanger.bf

    patched-MSCVRT

    Generic FakeAlert.b

    ExploitCVE 2009 3869

    The machine seems to be working ok. I have logged on as the user that had all the problems. the only thing is that when I clear all the temp files/cookies in internet explorer when you click the down arrow on the address there is nothing there. however a while later all the sites that have been searched for appear once more.

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Hi again,

    I think its not yet time to think about a reformat/reinstall (unless you want to of course :)). We still have quite some options left.

    First of all, can you please rerun OTL, but make sure you check the All Users option (its in the top section of the OTL window).

    Second, can you please reset the router (it should have a button on the backside for that). The reason I ask is that often malware alters router settings.

    Please right click on your Internet Connection icon in the System Tray and select Status. In the Status window click the Options button.

    Look under "this connection uses the following items" and highlight Internet Protocol (TCP/IP). Click Properties.

    On the General tab, make sure "Obtain an IP address automatically" and "Obtain DNS server address automatically" are both ticked.

    On the Alternate Configuration tab, make sure "Automatic private IP address" is ticked.

    Click OK to exit the Properties and OK to exit the other windows as well.

    Now, click Start > Run and type cmd in the runbox.

    A command window will open. Type ipconfig /flushdns and press enter.

    Please run Notepad (start > All Programs > Accessories > Notepad) and copy and paste the text in the code box into a new file:

    @echo off
    (ipconfig /all
    nslookup google.com
    nslookup yahoo.com
    ping -n 2 google.com
    ping -n 2 yahoo.com
    route print) >>Log1.txt
    start notepad Log1.txt
    del %0

    Go to the File menu at the top of the Notepad and select Save as.

    Select save in: desktop

    Fill in File name: test.bat

    Save as type: All file types (*.*)

    Click save.

    Close the Notepad.

    Locate and double-click tast.bat on the desktop.

    A notepad opens, copy and paste the content it (log1.txt) to your reply.

    file as requested. I am a little concerned with the second file as it gives all the IP addresses for the work network.

    OTL._3Txt.txt

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Here's the log but I dont know if it is ok because have not uninstalled McAfee again (and still cannot disable) and I think it blocked one of the actions by OLT.

    Checked to see if I could download another virus software - Housecall (and yes it did download). Could not install F-secure because it runs directlly onto the laptop (in other words has to be downloaded via the internet and not via an external drive).

    Thanks for all your help but we dont seem to be any further on than we were at the beginning of the week. I have the reload disks for the machine but the only problem is that it is for Windows Vista and I had the operating system changed to XP when I ordered the laptop. If I reload how do I change it to XP?

    sorry forgot to say that connection via router.

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Okay, that sounds like there is more wrong than only McAfee not working properly :)

    Please rerun OTL and post me the new log so I can see how everything looks.

    Please let me know how you are connected to the internet (wired, wireless, router, cable modem...).

    Here's the log but I dont know if it is ok because have not uninstalled McAfee again (and still cannot disable) and I think it blocked one of the actions by OLT.

    Checked to see if I could download another virus software - Housecall (and yes it did download). Could not install F-secure because it runs directlly onto the laptop (in other words has to be downloaded via the internet and not via an external drive).

    Thanks for all your help but we dont seem to be any further on than we were at the beginning of the week. I have the reload disks for the machine but the only problem is that it is for Windows Vista and I had the operating system changed to XP when I ordered the laptop. If I reload how do I change it to XP?

    OTL_2.Txt

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Dont think that this is the problem. I cannot download any programmes direct to the laptop. I have to use another machine and put in onto an external hard drive. Cannot even get the webpage open for the McAfee site.

    Hi

    Does not work because it is not the consumer version that it running. Work pays for all home laptops to have McAfee professional version.

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Do you have any other issues besides with McAfee? Or is McAfee the only program you cannot disable?

    Because, if you were able to install, you definitely have Admin rights. If not, you wouldn't have been able to install the software. I think its more likely your McAfee installation is broken somehow.

    What we can do is run a McAfee utility that completely removes any components and then reinstall.

    I have not checked again but before I could not roll back the computer to an early state.

    Let's try to uninstall McAfee and see if that works.

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Hello again, can you please let me know how things are running now?

    Your logs show you are logged in as Administrator and I do not see any policies or restrictions set. Could you please give me some examples as to what admin rights you do not have at the moment?

    I have reinstalled McAfee and because there are no administrator rights you cannot disable the software - it is greyed out. In other words the computer does not recognise you as an administrator. It is the same for any user - and even added new user and still does not work.

    Had problems downloading software as well.

    Any ideas??

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Hi please try this :) In case you have trouble with disabling AV programs, just ignore them.

    With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Go to Microsoft's website => http://support.microsoft.com/kb/310994

    Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

    Note: If you have SP3, use the SP2 package.

    here it is

    ---------------------------------------------------------------------

    Transfer all files you just downloaded, to the desktop of the infected computer.

    --------------------------------------------------------------------

    Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

    RC1-4.gif

    • Drag the setup package onto ComboFix.exe and drop it.
    • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
      whatnext.png
    • At the next prompt, click 'Yes' to run the full ComboFix scan.
    • When the tool is finished, it will produce a report for you.

    Please post the C:\ComboFix.txt in your next reply.

    COMBIlog.txt

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Hi Elise

    Ran Combo last night but would not allow connection to the internet. Had internet connection before running Combo but as soon as you run it it closes the connection and does not work until a reboot- and therefore unable to download recovery console from Microsoft. Tried to find the download from the Microsoft site to put in on manually but can't find it. :) Have had to remove all virus software as could not disable (as no administrator rights)

    Unable to download any programs from internet to computer now. I get the feeling that it might be just worth reloading windows onto the machine and over-write everything. What do you think??

    Have attached the log file

    log.txt

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Hello again,

    COMBOFIX

    ---------------

    Please download ComboFix from one of these locations:

    Bleepingcomputer
    ForoSpyware

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
    • Double click on Combofix.exe and follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

    Query_RC.gif

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    RC_successful.gif

    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Sorry, but this is not the log I need to see :)

    Rerun GMER, and on the main tab (do not change the tab!), make sure the Sections option is checked and click Scan.

    Once done, post me the log.

    Ran GMER in Safemode and at the end of the scan there was nothing on the screen. It took about 9 hours to run.

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Most likely that means the download was not complete. Please try to redownload GMER, and try to run it again.

    Please reply using the "add reply" button, not the "quote" button, that makes things easier to read for me, thanks :)

    HI Elise

    Thanks for the quick response. I have downloaded the program to an external drive and it has now run. Here is the file.

    gmer_.txt

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Hi Elise

    Have run the first program and attached the logs. However cannot run second program as it comes up with error not a Win 32 programme.

    Hope you can help!

    Have tried to run in Safe mode but still comes up with error not a valid Win32 application. Yes proxy is correct. Sorry to have sent a couple of times - new to this!!

    removed administrator rights

    in Resolved Malware Removal Logs

    Posted

    Hello ,

    And :) My name is Elise and I'll be glad to help you with your computer problems.

    I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

    Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

    • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
    • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
    • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
    • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

    You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

    -----------------------------------------------------------

    If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

    If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

    If you have already posted a log, please do so again, as your situation may have changed.

    Use the 'Add Reply' and add the new log to this thread.

    We need to see some information about what is happening in your machine. Please perform the following scan:

    • Please download OTL from one of the following mirrors:

      [*]Save it to your desktop.

      [*]Double click on the otlDesktopIcon.png icon on your desktop.

      [*]Click the "Scan All Users" checkbox.

      [*]Push the runscanbutton.png button.

      [*]Two reports will open, copy and paste them in a reply here:

      • OTListIt.txt <-- Will be opened
      • Extra.txt <-- Will be minimized

    Please download GMER from one of the following locations and save it to your desktop:

    • Main Mirror
      This version will download a randomly named file (Recommended)
    • Zipped Mirror
      This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

    • Disconnect from the Internet and close all running programs.
    • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
    • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
    • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
      gmer_zip.gif
    • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
    • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
    • Now click the Scan button. If you see a rootkit warning window, click OK.
    • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
    • Click the Copy button and paste the results into your next reply.
    • Exit GMER and re-enable all active protection when done.

    -- If you encounter any problems, try running GMER in Safe Mode.

    -------------------------------------------------------------

    In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

    If you still need help, please include the following in your next reply

    • A detailed description of your problems
    • A new OTL log (don't forget extra.txt)
    • GMER log

    OTL.Txt

    OTL.Txt

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.