Need Help Please ! Worse Malware Ever - Random Audio/Ads !

[xxcharxx]

Hi,

I was wondering if anyone could help me with a virus that I have (unfortunately) managed to obtain on my PC [ > ]

Every time I start my PC, after around 1 or 2 minutes it decides to start playing random viral adverts and random audio & music which is driving me absolutely insane (!!)

I initially decided to restore my PC to an earlier date (the previous month) and it looked like it had worked as once rebooted, it did not play the random audio, however once I switched it back on again (the following day), it appeared to have returned. I've tried restoring my PC several times since (even as far as 2 months back) but once it's finished restoring, it displays a windows message saying "Windows was unable to complete system restore succesfully" - or something along those lines.

I've seen other members post requests for assistance for very similar virus/malware issues and thought i'd try running the malware virus scanners that those individuals were advised to run (away from my PC at the mo but think they're called something like: RSKiller, TKiller (?) [Kapersky scanner?] - one forum said run these scanners in a particular order in safe mode, so I did, but to no avail) however nothing has worked for me as yet.

I've also tried to resolve this by following the Pinned post guide ("I'm Infected - What do I do now?") & stll no joy.

I'm willing to try anything to resolve this issue as I predominantly use my PC to monitor audio, however cannot work with random audio & ads playing as well as the audio (!!) so my PC is pretty much dead to me right now !

Would greatly appreciate your assistance in resolving this issue & my apologies for the essay, it's just that I want to give as much info as possible in the hope that someone will be able to revive my PC.

I've attached both logs as per the pinned post.

Thanks in advance,

Charlotte

dds.txt

attach.txt

[MrCharlie]

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 48 hours, please send me a PM)

[xxcharxx]

Hi,

Please see attached report. FYI I ran it in Safe Mode with Networking because I tried to start my computer soon after you replied however it loaded but none of my icons on my desktop will appear & if I hit the Start menu, or anything on my taskbar the whole computer stops responding (??) Dont know if this is relevent to this virus/malware that I have (that we're currently trying to detect) My computer just wont load anything. The clock also freezes showing the time that I started the computer but not updating and it only loads up my taskbar and my wallpaper, no icons ! Therefore my computer only loads successfully through safe mode !

I appreciate your help, thank you !

RKreport1_S_12102012_02d1848.txt

[MrCharlie]

Please download and run a version of rkill:

http://www.bleepingc...download/rkill/

Then......

Run unhide:

http://www.smartestc...ted-by-a-virus/

Now see if you can run ComboFix:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[xxcharxx]

Please see attached files.

I ran Rkill, then Unhide, then ran Combofix which rebooted my computer & windows started normally (not in Safe Mode) & all of my icons on my desktop re-appeared, however when I tried to open the Internet Explorer shortcut or any other shortcut pinned to my taskbar, it displayed the following message "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item" and just an "OK" box, so I had to reboot to Safe Mode so that I could open Internet Explorer to reply to this thread, however it started Windows normally again. I entered my password and this time just displayed a black screen. Didn't load anything up whatsoever (?) So I rebooted to Safe mode in order to reply on this thread.

Hope this info helps.

Rkill.txt

unhide.txt

combofix log.txt

[MrCharlie]

If possible.......Please create a new system restore point before running Malwarebytes Anti-Rootkit.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

----------------------------

After the scan completes......

Please run the fixdamage tool in the Malwarebytes Anti-Rootkit folder and reboot.

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

MrC

[xxcharxx]

Hi,

Sorry for the late reply, I had 'email notification' set for if I had a reply to this thread, however I didn't receive an email to say you'd replied (?) Just thought I'd log on now to double-check & noticed your reply. Just to let you know, i'll be doing as you advised on your last post tomorrow & will keep you updated.

Thanks

Charlotte

[MrCharlie]

OK, let me know.....MrC

[xxcharxx]

Hi,

Ran both as advised. Please see attached. Still have to boot in Safe mode as Start Windows Normally still shows a plain black blank screen after entering my password (?)

mbar-log-2012-12-15 (16-09-41).txt

system-log.txt

[MrCharlie]

Please read the directions carefully so you don't end up deleting something that is good!!

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:

Please download the latest version of TDSSKiller from here and save it to your Desktop.

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
  
  
• Put a checkmark beside loaded modules.
  
  
• A reboot will be needed to apply the changes. Do it.
  
• TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  
• Then click on Change parameters in TDSSKiller.
  
• Check all boxes then click OK.
  
  
• Click the Start Scan button.
  
  
• The scan should take no longer than 2 minutes.
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
  
  Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
  Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  
• A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
  
• Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.
  

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.

New window that comes up.

MrC

[xxcharxx]

Hi,

As instructed, please see attached.

TDSSKiller.2.8.15.0_15.12.2012_16.43.37_log.txt

TDSSKiller.2.8.15.0_15.12.2012_16.47.48_log.txt

[MrCharlie]

Not much showing............

Please download on the Desktop the following application: Windows Repair

Next, extract and launch the Repair_Windows.exe

Click on Start repairs tab and then click on Start

Check mark following options alone

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Remove Policies Set By Infections

Checkmark Restart System When Finished option

click the Start button

System should restart after repair

Let me know.....MrC

[xxcharxx]

Hi

Ran as advised, it rebooted to Windows normally but still loaded black screen after entering my password (?)

[MrCharlie]

See if this works/applies:

http://windows.microsoft.com/en-US/windows7/why-is-my-screen-black-when-i-start-windows-7

MrC

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!