wonder_son Posted August 7, 2012 ID:581734 Share Posted August 7, 2012 This computer behaves badly imediatly after startup, seems to be stopping norton from installing properly amoung other things.Spams virus cleaner popups if I start it in normal mode.please see attached logsthanks for your helpDDS.txtAttach.txthijackthis.log Link to post Share on other sites More sharing options...
MrCharlie Posted August 7, 2012 ID:581776 Share Posted August 7, 2012 @wonder_son...Welcome to the forum.Please remove any usb or external drives from the computer before you run this scan!Please download and run RogueKiller to your desktop.For Windows XP, double-click to start.For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.Click Scan to scan the system.When the scan completes > Close out the program > Don't Fix anything!Don't run any other options, they're not all bad!!!!!!!Post back the report which should be located on your desktop.MrC Link to post Share on other sites More sharing options...
wonder_son Posted August 7, 2012 Author ID:581958 Share Posted August 7, 2012 I followed your instructions and removed any memory sticks.So I tried to run rougeKiller and it did not complete. I ran for a while then windows popup told me that it had stopped working and I had no choice but to close it.FYI : I haved taken the infected PC off the Inet and am using a memory stick to copy exceutables/logs back and forth. THe PC is considerably slower and more unstable when connected to the Inet.I am helping a friend with their computer and have limited times to access it. In order to speed things up I wanted to try to get rougkiller to work by stopping the virus with rkill.exe long enough to run it; which I did.rkill inidicated their was a virus and I have attached its log.I tried to run rouge killer after rkill, but it failed to complete with the same message above.Rkill.txt Link to post Share on other sites More sharing options...
wonder_son Posted August 7, 2012 Author ID:581967 Share Posted August 7, 2012 also FYI:The DDS and hijackthis logs attached above where made while the PC was in safe mode. Link to post Share on other sites More sharing options...
MrCharlie Posted August 7, 2012 ID:581970 Share Posted August 7, 2012 Please do this instead...............Please download and run TDSSKiller to your desktop as outlined below:Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.-------------------------Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.------------------------Click the Start Scan button.-----------------------If a suspicious object is detected, the default action will be Skip, click on ContinueIf you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please chooseSkip and click on Continue----------------------If malicious objects are found, they will show in the Scan results and offer three (3) options.Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.--------------------A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply. MrC============================================Please download and run TDSSKiller to your desktop as outlined below:Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.-------------------------Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.------------------------Click the Start Scan button.-----------------------If a suspicious object is detected, the default action will be Skip, click on ContinueIf you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please chooseSkip and click on Continue----------------------If malicious objects are found, they will show in the Scan results and offer three (3) options.Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.--------------------A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply. MrC Link to post Share on other sites More sharing options...
wonder_son Posted August 8, 2012 Author ID:582074 Share Posted August 8, 2012 I have followed your instructions, and run TDSSKiller. There was a rootkit found that it "cured" and then rebooted.I have attached the log files.I am still worried tough. After logging into windows after reboot there is still a "System Error: Hard disk failure detected" message box and many "System message: write fault error" pop ups.I can close the write fault error message pop ups to clean up the desktop, but if I close the hard disk falure dialog (or chose scan and repair) the pc imeadiatly reboots.These message boxes existed before the TDSSKiller and still exist. I think they where part of the virus because clicking the scan option never actually scaned, it just rebooted the PC.TDSSKiller.2.7.48.0_07.08.2012_18.03.14_log.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 8, 2012 ID:582076 Share Posted August 8, 2012 18:06:09.0655 0900 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user18:06:09.0655 0900 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: SkipRun it again and just choose Delete for this one only.-------------------------Then................Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingc...to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
wonder_son Posted August 8, 2012 Author ID:582087 Share Posted August 8, 2012 I ran tdsskiller and it did not detect the two entries you quoted in your last set of instructions. I am not sure where they went.I have run comboFix and attached the log.ComboFix.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 8, 2012 ID:582177 Share Posted August 8, 2012 Looks Good.....Please Update and run a Quick Scan with MBAM, post the report.Make sure that everything is checked, and click Remove Selected.Please let me know how computer is running now, MrC Link to post Share on other sites More sharing options...
MrCharlie Posted August 10, 2012 ID:583180 Share Posted August 10, 2012 How are we doing??Do you still need help or can I close this post??MrC Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 11, 2012 ID:583700 Share Posted August 11, 2012 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts