markz1 Posted December 14, 2011 ID:505032 Share Posted December 14, 2011 Hello, I seem to have the FakeAlert Trojan, I keep getting thousands of Symantec Endpoint Notifications, and many of my files were hidden. I ran the Malwarebytes software, and it didn't find anything (for reference, I had run the Mcafee Stinger program previously, and it had apparently found and quarantined the virus. However, I'm still getting these Endpoint popups. I've attached the DDS text files. Thanks for your help.DDS.txtAttach.txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 16, 2011 ID:505595 Share Posted December 16, 2011 Welcome to the forum.Please download Farbar Service Scanner and run it on the computer with the issue.Make sure "Include All Files" option remains checked. Press "Scan". It will create a log (FSS.txt) in the same directory the tool is run. Please copy and paste the log to your reply. --------------------------------Next...Please download OTL from one of the links below:http://oldtimer.geekstogo.com/OTL.exehttp://oldtimer.geekstogo.com/OTL.com (<---renamed version)Save it to your desktop.Double click on the icon on your desktop.Click the Scan All Users checkbox.Push the Quick Scan button.Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)OTL.txt <-- Will be openedExtra.txt <-- Will be minimizedMrC Link to post Share on other sites More sharing options...
markz1 Posted December 16, 2011 Author ID:505660 Share Posted December 16, 2011 Thanks for your reply. I've attached the 3 requested files.Also of note, I restarted the computer, and then I wasn't able to run any executable files, or use the internet. I started in safe mode with networking and now I can function.-MarkWelcome to the forum.Please download Farbar Service Scanner and run it on the computer with the issue.Make sure "Include All Files" option remains checked. Press "Scan". It will create a log (FSS.txt) in the same directory the tool is run. Please copy and paste the log to your reply. --------------------------------Next...Please download OTL from one of the links below:http://oldtimer.geekstogo.com/OTL.exehttp://oldtimer.geekstogo.com/OTL.com (<---renamed version)Save it to your desktop.Double click on the icon on your desktop.Click the Scan All Users checkbox.Push the Quick Scan button.Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)OTL.txt <-- Will be openedExtra.txt <-- Will be minimizedMrCFSS.txtExtras.TxtOTL.Txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 16, 2011 ID:505668 Share Posted December 16, 2011 Look through this guide and you'll see several ways to correct the .exe file problem.any .exe file that won't run can be renamed to .com and it should now run.---------------------------------Please download and run TDSSKiller as outlined in the post below:http://forums.malwarebytes.org/index.php?showtopic=100665&view=findpost&p=499595Post back the log, MrC Link to post Share on other sites More sharing options...
markz1 Posted December 16, 2011 Author ID:505677 Share Posted December 16, 2011 Here is the requested fileTDSSKiller.2.6.23.0_16.12.2011_14.24.48_log.txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 16, 2011 ID:505679 Share Posted December 16, 2011 Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingcomputer.com/combofix/how-to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Make sure you run ComboFix from your desktop. Please include the C:\ComboFix.txt in your next reply for further review.MrC Link to post Share on other sites More sharing options...
markz1 Posted December 16, 2011 Author ID:505733 Share Posted December 16, 2011 Here is the requested file.ComboFix.txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 16, 2011 ID:505737 Share Posted December 16, 2011 * Resident AV is activeDidn't ComboFix warn you about this?How's running?? MrC Link to post Share on other sites More sharing options...
markz1 Posted December 16, 2011 Author ID:505738 Share Posted December 16, 2011 I tried to shut it off, wasn't able to. I opened Symantec and it said "the program isn't running". I tried to end the task and it just pops up again. Link to post Share on other sites More sharing options...
MrCharlie Posted December 16, 2011 ID:505743 Share Posted December 16, 2011 OK, how's it running?? MrC Link to post Share on other sites More sharing options...
markz1 Posted December 16, 2011 Author ID:505745 Share Posted December 16, 2011 I just tried to reboot without safe mode. When I type in my password for my user it says "User Logon Service" unavailable, and won't let me log on. Additionally, in safe mode, none of my files and programs are present (I do have "show hidden folders" selected). Link to post Share on other sites More sharing options...
MrCharlie Posted December 16, 2011 ID:505748 Share Posted December 16, 2011 This just happened after you ran ComboFix?If so, ComboFix creates a restore point just before it runs, we can use that.It also creates a registry backup.Let me know, MrC Link to post Share on other sites More sharing options...
markz1 Posted December 16, 2011 Author ID:505756 Share Posted December 16, 2011 No, this was happening before ComboFix. Link to post Share on other sites More sharing options...
MrCharlie Posted December 16, 2011 ID:505760 Share Posted December 16, 2011 Is this the screen you get? Don't try the fix though.MrC Link to post Share on other sites More sharing options...
markz1 Posted December 16, 2011 Author ID:505764 Share Posted December 16, 2011 Yes, that's the error. Link to post Share on other sites More sharing options...
MrCharlie Posted December 16, 2011 ID:505771 Share Posted December 16, 2011 unhide.exe should make some of the files, etc visible, try to download and run it.http://download.bleepingcomputer.com/grinler/unhide.exe----------------Do you have any good restore points to use before all these problems started?-------------Are you familiar with the registry?Here's a link that basically explains the same procedure as the video:http://support.microsoft.com/kb/947215ComboFix makes a backup of the registry just before it runs here:Windows\ERDNT\hiv-backup\erdnt.exe<---double click on this to restore the registry.Make sure it's present incase something goes wrong.If you're unsure on the registry...don't mess with it.MrC Link to post Share on other sites More sharing options...
markz1 Posted December 17, 2011 Author ID:505809 Share Posted December 17, 2011 I tried unhide.exe, didn't do anything. Still no files.I found a restore point from 12/14, called a "critical update". I performed it, and now I can login to windows in normal (not safe) mode, and my files are present.My first question is: can I back up my files on a network drive around here? I have some very important files here that I want to backup badly, but I'm afraid of infecting the network. The following problems are now occurring:1) I'm frequently getting an error about a missing "dciman32.dll" file. 2) I can't use the search function. It pops up the error message "windows cannot find 'search:query=[what i searched for]' ". 3) I am still getting the Symantec Endpoint protection popups in large numbers.Thanks for your assistance thus far, it's much appreciated. Link to post Share on other sites More sharing options...
MrCharlie Posted December 17, 2011 ID:505817 Share Posted December 17, 2011 My first question is: can I back up my files on a network drive around here? I have some very important files here that I want to backup badly, but I'm afraid of infecting the network. Put them on a usb pen drive.-------------------------Please download SystemLook from one of the links below and save it to your Desktop. http://jpshortstuff.247fixes.com/SystemLook_x64.exeDouble-click SystemLook.exe to run it. Copy the content of the following codebox into the main textfield: :Filefinddciman32.dll Click the Look button to start the scan. When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. Note: The log can also be found on your Desktop entitled SystemLook.txt MrC Link to post Share on other sites More sharing options...
markz1 Posted December 17, 2011 Author ID:505822 Share Posted December 17, 2011 It's about 200GB worth of important stuff. I guess that means there's a possibility of infection, so I will hold off on that.Attached is the requested SystemLook file.SystemLook.txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 17, 2011 ID:505826 Share Posted December 17, 2011 Please download OTL from one of the links below:http://oldtimer.geekstogo.com/OTL.exehttp://oldtimer.geekstogo.com/OTL.com (<---renamed version)Run OTLUnder the Custom Scans/Fixes box at the bottom, paste in the following :FilesC:\Windows\System32\dciman32.dll|C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16385_none_05c80a1f743763f3\dciman32.dll /replace Then click the Run Fix button at the top Let the program run unhindered, when done it will say "Fix Complete press ok to open the log" Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.MrC Link to post Share on other sites More sharing options...
markz1 Posted December 17, 2011 Author ID:505830 Share Posted December 17, 2011 Copied below is the log requested. I am still getting the same error. ========== FILES ==========Unable to replace file: C:\Windows\System32\dciman32.dll with C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16385_none_05c80a1f743763f3\dciman32.dll without a reboot.OTL by OldTimer - Version 3.2.31.0 log created on 12162011_204935Files\Folders moved on Reboot...Registry entries deleted on Reboot... Link to post Share on other sites More sharing options...
MrCharlie Posted December 17, 2011 ID:505861 Share Posted December 17, 2011 Please Update and run a Quick Scan with MBAM, post the report. MrC Link to post Share on other sites More sharing options...
markz1 Posted December 17, 2011 Author ID:505871 Share Posted December 17, 2011 Here is the Malewarebytes logmbam-log-2011-12-16 (23-49-03).txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 17, 2011 ID:505936 Share Posted December 17, 2011 What problems still exist? MrC Link to post Share on other sites More sharing options...
MrCharlie Posted December 26, 2011 ID:509452 Share Posted December 26, 2011 How are we doing??Do you still need help or can I close this post??MrC Link to post Share on other sites More sharing options...
Recommended Posts