jennifergib7 Posted December 23, 2011 ID:508512 Share Posted December 23, 2011 I am truly needing some help with my son's pc. Attached are some files.mbam-log-2011-12-30 (08-06-59).txtOTL.Txt Link to post Share on other sites More sharing options...
Elise Posted December 23, 2011 ID:508522 Share Posted December 23, 2011 Hello, I see you have run Combofix as well. Please post the log at c:\combofix.txtCan you give me also a description of the problem? Link to post Share on other sites More sharing options...
jennifergib7 Posted December 23, 2011 Author ID:508550 Share Posted December 23, 2011 Hello, I see you have run Combofix as well. Please post the log at c:\combofix.txtCan you give me also a description of the problem?It started with the pop-ups, XP Home Security 2012 - you have trojans, then it did something to the internet connection. When trying to connect, is stays stuck on 'acquiring the ip address'.Attached is the combofix.txt.ComboFix.txt Link to post Share on other sites More sharing options...
Elise Posted December 23, 2011 ID:508602 Share Posted December 23, 2011 Please delete any old copy of combofix you still may have and download a new one. Run it as follows.COMBOFIX---------------Please download ComboFix from one of these locations:BleepingcomputerForoSpywareDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)Double click on Combofix.exe and follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 24, 2011 Author ID:508699 Share Posted December 24, 2011 Please delete any old copy of combofix you still may have and download a new one. Run it as follows.COMBOFIX---------------Please download ComboFix from one of these locations:BleepingcomputerForoSpywareDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)Double click on Combofix.exe and follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.How do I remove the combofix.exe? Link to post Share on other sites More sharing options...
Elise Posted December 24, 2011 ID:508827 Share Posted December 24, 2011 Right click > delete. If it is no longer there, just download a new one. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 24, 2011 Author ID:508846 Share Posted December 24, 2011 Right click > delete. If it is no longer there, just download a new one.I clicked 'agree' to the End-User License Agreement. I did not get the Recovery Console pop-up or the Successful Install, therefore I could not perform the scan. I appreciate your help. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 24, 2011 Author ID:508847 Share Posted December 24, 2011 I clicked 'agree' to the End-User License Agreement. I did not get the Recovery Console pop-up or the Successful Install, therefore I could not perform the scan. I appreciate your help.I also wanted to mention, because of malware this computer cannot connect to internet because it is 'acquiring IP address', therefore the above task was performed using a flash drive. Thanks Link to post Share on other sites More sharing options...
Elise Posted December 24, 2011 ID:508880 Share Posted December 24, 2011 Just continue the scan like that, without recovery console. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 24, 2011 Author ID:508883 Share Posted December 24, 2011 Just continue the scan like that, without recovery console. I did this however it didn't produce any log..? Link to post Share on other sites More sharing options...
Elise Posted December 24, 2011 ID:508943 Share Posted December 24, 2011 In that case, try to run it once more, when asked to continue scanning, click Yes. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 24, 2011 Author ID:508970 Share Posted December 24, 2011 In that case, try to run it once more, when asked to continue scanning, click Yes.I ran again, no log this time either. When I double clicked on the icon initiate, it went immediately to scanning. Link to post Share on other sites More sharing options...
Elise Posted December 24, 2011 ID:508989 Share Posted December 24, 2011 Does it finish at all? Do you see a message that Combofix will prepare a log report? If not, do you see the different scan phases? Link to post Share on other sites More sharing options...
jennifergib7 Posted December 24, 2011 Author ID:508995 Share Posted December 24, 2011 Does it finish at all? Do you see a message that Combofix will prepare a log report? If not, do you see the different scan phases?It look like is loads something to my pc, then it shows a box with c: prompt, then it clicks off. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 24, 2011 Author ID:508997 Share Posted December 24, 2011 It look like is loads something to my pc, then it shows a box with c: prompt, then it clicks off.....never gives me an option to click yes. Link to post Share on other sites More sharing options...
Elise Posted December 25, 2011 ID:509184 Share Posted December 25, 2011 Please try to run it from Safe Mode. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 25, 2011 Author ID:509283 Share Posted December 25, 2011 did exactly as before. Link to post Share on other sites More sharing options...
Elise Posted December 26, 2011 ID:509426 Share Posted December 26, 2011 Please try the following tool:Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!Double-click on TDSSKiller.exe to run the tool for known TDSS variants.Vista/Windows 7 users right-click and select Run As Administrator.If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.Click the Start Scan button.Do not use the computer during the scanIf the scan completes with nothing found, click Close to exit.If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).Copy and paste the contents of that file in your next reply. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 26, 2011 Author ID:509432 Share Posted December 26, 2011 Please try the following tool:Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!Double-click on TDSSKiller.exe to run the tool for known TDSS variants.Vista/Windows 7 users right-click and select Run As Administrator.If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.Click the Start Scan button.Do not use the computer during the scanIf the scan completes with nothing found, click Close to exit.If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).Copy and paste the contents of that file in your next reply.Found nothing...is that good? Link to post Share on other sites More sharing options...
Elise Posted December 26, 2011 ID:509529 Share Posted December 26, 2011 Yes, that is always good. It is however strange that combofix no longer runs, while it did run before.We need to scan the system with this special tool: * Please download and save:Junction.zip * Unzip it and place Junction.exe in the Windows directory (C:\Windows). * Go to Start => Run... => Copy and paste the following command in the Run box and click OK: cmd /c junction -s c:\ >log.txt&log.txt& del log.txtA command window opens starting to scan the system. Wait until a log file opens. Copy and paste the log in your next reply. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 27, 2011 Author ID:509587 Share Posted December 27, 2011 Yes, that is always good. It is however strange that combofix no longer runs, while it did run before.We need to scan the system with this special tool: * Please download and save:Junction.zip * Unzip it and place Junction.exe in the Windows directory (C:\Windows). * Go to Start => Run... => Copy and paste the following command in the Run box and click OK: cmd /c junction -s c:\ >log.txt&log.txt& del log.txtA command window opens starting to scan the system. Wait until a log file opens. Copy and paste the log in your next reply.Did as you said. The command window came open...has a flashing cursor in top left of window (with the title being C:\WINDOWS\system32\cmd.exe). It's been 17 minutes and there has been NOTHING......except flashing cursor. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 27, 2011 Author ID:509591 Share Posted December 27, 2011 Did as you said. The command window came open...has a flashing cursor in top left of window (with the title being C:\WINDOWS\system32\cmd.exe). It's been 17 minutes and there has been NOTHING......except flashing cursor.Okay took about 30 minutes and this is the log:Junction v1.06 - Windows junction creator and reparse point viewerCopyright © 2000-2010 Mark RussinovichSysinternals - www.sysinternals.comFailed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process...Failed to open \\?\c:\\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp: Access is denied....................................................................Failed to open \\?\c:\\WINDOWS\$NtUninstallKB10197$: Access is denied.............\\?\c:\\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a: JUNCTION Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\\?\c:\\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a: JUNCTION Print Name : C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e Substitute Name: C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e........................ Link to post Share on other sites More sharing options...
Elise Posted December 27, 2011 ID:509701 Share Posted December 27, 2011 That looks good. Please press Windows Key + R, type combofix /uninstall and press enter. Afterwards, redownload combofix and rerun it. Link to post Share on other sites More sharing options...
jennifergib7 Posted December 27, 2011 Author ID:509713 Share Posted December 27, 2011 That looks good. Please press Windows Key + R, type combofix /uninstall and press enter. Afterwards, redownload combofix and rerun it.This is what came back:"Windows cannot find 'combofix'. Make sure you typed the name correctly......"I then did a search of files/folders on my c: drive and this is what came back:COMBOFIX(2).EXE-2F71B7CB.pf C:\WINDOWS\Prefetch 37KB PF FileCOMBOFIX.EXE-115E40BB.pf C:\WINDOWS\Prefetch 39KB PF File Link to post Share on other sites More sharing options...
Elise Posted December 27, 2011 ID:509840 Share Posted December 27, 2011 Please right click to combofix.exe, right click on this, select Rename and change "combofix" in "uninstall". Double click on the renamed file and run it like that. Link to post Share on other sites More sharing options...
Recommended Posts