I'm Probably Infected, dds inside

[DanielleC]

My computer freezes and has to be restarted when I try to uninstall malwarebytes, also everything is going incredibly slowly.

If someone could help be it would be great

dds.txt

attach.txt

[MrCharlie]

Welcome to the forum.

Before we proceed further, please uninstall or disable uTorrent and any other peer-to-peer filesharing app.

Continued use of filesharing or ill-advised downloads will surely re-infect your system.

Risks of File-Sharing Technology.

P2P file sharing: Know the risks

It's also against the forums policy concerning P2P programs:

If you're using Peer 2 Peer software such as uTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

Then..................

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

http://tigzy.geekstogo.com/Tools/RogueKillerX64.exe <---use this one

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

[DanielleC]

Here is the report

RogueKiller V8.4.3 _x64_ [Jan 10 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : user [Admin rights]

Mode : Scan -- Date : 01/20/2013 15:43:25

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 7 ¤¤¤

[HJPOL] HKCU\[...]\Services\Microsoft\System : disableregistrytools (0) -> FOUND

[HJ] HKLM\[...]\Services\Microsoft\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\Services\Microsoft\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\Services\Microsoft\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\Services\Microsoft\System : EnableLUA (0) -> FOUND

[HJ DESK] HKLM\[...]\Services\Microsoft\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\Services\Microsoft\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 3dns.adobe.com

127.0.0.1 3dns-1.adobe.com

127.0.0.1 3dns-2.adobe.com

127.0.0.1 3dns-3.adobe.com

127.0.0.1 3dns-4.adobe.com

127.0.0.1 3dns-5.adobe.com

127.0.0.1 activate.adobe.com

127.0.0.1 activate.wip1.adobe.com

127.0.0.1 activate.wip2.adobe.com

127.0.0.1 activate.wip3.adobe.com

127.0.0.1 activate.wip4.adobe.com

127.0.0.1 activate-sea.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 adobe-dns.adobe.com

127.0.0.1 adobe-dns-1.adobe.com

127.0.0.1 adobe-dns-2.adobe.com

127.0.0.1 adobe-dns-3.adobe.com

127.0.0.1 adobe-dns-4.adobe.com

127.0.0.1 adobeereg.com

127.0.0.1 ereg.adobe.com

[...]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST1000DM003-9YN162 ATA Device +++++

--- User ---

[MBR] 07cf6788afff5590bbc7eaa0a225c717

[bSP] 3fb9bf4f479c9e087f690bf22a37e901 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 425000 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 870402048 | Size: 528866 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_01202013_02d1543.txt >>

RKreport[1]_S_01202013_02d1543.txt

[MrCharlie]

Not much showing, lets run some scans.......

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

[DanielleC]

It froze white initialising and now my computer will not turn back on

[MrCharlie]

Have you rebooted a couple of times?

You can try Startup Repair and System restore:

http://windows.microsoft.com/en-US/windows7/products/features/startup-repair

Let me know........MrC

[DanielleC]

I can't do either, it freezes on the welcome screen and doesn't do it automatically

[DanielleC]

I also don't have a startup or repair disk

[MrCharlie]

OK, you'll need a usb flash drive for this: (you will use the 64 bit version of the tools)

You can do them at the same time > Farbar Recovery Scan Tool and ListParts

1. Please download Farbar Recovery Scan Tool and save it to a flash drive.
   Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
   Plug the flash drive into the infected PC.
   
2. If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.
   If you are using Vista or Windows 7 enter System Recovery Options.
   To enter System Recovery Options from the Advanced Boot Options:
   
   • Restart the computer.
     
   • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
     
   • Use the arrow keys to select the Repair your computer menu item.
     
   • Select US as the keyboard language settings, and then click Next.
     
   • Select the operating system you want to repair, and then click Next.
     
   • Select your user account an click Next.
     

Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.

To make a repair disk on Windows 7 consult: http://www.sevenforu...isc-create.html

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
  
• Restart your computer.
  
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  
• Click Repair your computer.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account and click Next.
  

• On the System Recovery Options menu you will get the following options:
  
  • 
    
    • 
      Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt
      Select Command Prompt
      Once in the Command Prompt:
      

    [*]In the command window type in notepad and press Enter.

    [*]The notepad opens. Under File menu select Open.

    [*]Select "Computer" and find your flash drive letter and close the notepad.

    [*]In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter

    Note: Replace letter e with the drive letter of your flash drive.

    [*]The tool will start to run.

    [*]When the tool opens click Yes to disclaimer.

    [*]Press Scan button.

    [*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

  at the same time please do this:

• Download ListParts to a USB flash drive.
  
• Download ListParts64 to a USB flash drive.
  
• Plug the USB drive into the infected machine.
  

Boot your computer into Recovery Environment

• Restart the computer and press F8 repeatedly until the Advanced Options Menu appears.
  
• Select Repair your computer.
  
• Select Language and click Next
  
• Enter password (if necessary) and click OK, you should now see the screen below ...
  

• Select the Command Prompt option.
  
• A command window will open.
  
  • Type notepad then hit Enter.
    
  • Notepad will open.
    
    • Click File > Open then select Computer.
      
    • Note down the drive letter for your USB Drive.
      
    • Close Notepad.
      

  [*]Back in the command window ....

  • Type e:\listparts.exe and hit Enter (where e: is replaced by the drive letter for your USB drive)
    
  • Type e:\listparts64.exe and hit Enter (where e: is replaced by the drive letter for your USB drive)
    
  • ListParts will start to run.
    
    • Press the Scan button.
      
    • When finished scanning it will make a log Result.txt on the flash drive.
      

  [*]Close the command window.

  [*]Boot back into normal mode and post me the Result.txt log please.

MrC

[DanielleC]

I have attached the files

FRST.txt

Result.txt

[MrCharlie]

Can you get to this screen and try: Last Known Good Configuration

http://spywarepreven...ptions-menu.gif

If not try this at the Command Prompt as before when you used FRST and ListParts:

Step 1: Type the word "explorer" in black screen > enter

Step 2: Then Navigate to:

Win Vista/Seven: C:\windows\system32\rstrui.exe and press Enter (double click rstrui.exe)

Step 3: Restore Computer to Date you know you were virus free

or

Step 1: Type the word "rstrui.exe" in black screen > enter

Step 2: See if system restore starts

Step 3: Restore Computer to Date you know you were virus free

Let me know, MrC

[DanielleC]

Can't do the first or second and the third one I get error 0X80000ffff

:/ Thankyou for all your help by the way, I appreciate it all

[MrCharlie]

OK, hang on while I consult with others on this problem, I'll get back to you asap. MrC

[DanielleC]

okay thanks

[DanielleC]

Just thought I should mention some things:

I do not have a copy of windows or a disk big enough to burn it, I also only have a 2gb usb, hopefully that saves you some time

[MrCharlie]

OK, I'm having Farbar (the creator of FRST and ListParts) look over the two reports you posted for me.

He's the expert on things like this, so like I said I'll get back to you asap with a fix. MrC

[DanielleC]

Thanks a lot, again

[MrCharlie]

OK, here you go......Please carefully carry out this procedure!!!!!!

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now.

If it doesn't and just freezes, let it sit for a while like that > if you can at least a half hour.

MrC

[DanielleC]

I've done all that and the log is in my reply, the computer started then crashed but as I was typing this it just loaded the desktop.

Fixlog.txt

[DanielleC]

Just waiting at my desktop, utorrent is back on and it told me my system has restored

I'll uninstall utorrent now.

[MrCharlie]

OK, so it's up and running now??

Is this a laptop or desktop?

Are you sure it's not overheating, since this was your original problem > "freezing" > which can be caused by that.

MrC

[DanielleC]

I'm almost positive it isn't overheating, it's a desktop and its extremely well ventilated and has a good CPU fan too, not stock.

Also it oly freezes when I do things associated with malwarebytes, also my CPU is extremely slow, It's a new computer and could run games at a good speed but now it doesn't

[DanielleC]

Any ideas? It's just everything in me thinks this is a virus, if it isn't i wouldnt know where to look for the problem lol

[DanielleC]

Just attempted to remove malwarebytes and it froze again

[MrCharlie]

OK, I just saw your post....try it in safe mode and use the cleaner as listed below.

~~~~~~~~~~~~~~~~~~~~~~

If you can please create a new system restore point now

Make sure you only have on anti-virus running on the system, looks like you recently install AVG 2013.

In you logs it also shows that you have Windows Defender enabled, if this is true please disable it:

http://www.howtogeek...ow-turn-it-off/

When this all started did you happen to install any new software??

From your logs I don't see any malware but we really didn't run any scans except RogueKiller which came up clean.

These wouldn't be on my computer:

RegistryDefragBootTime.exe

Advanced SystemCare Service

Search & Destroy

IObit

I'm not sure what these folders are from:

C:\Users\user\AppData\Local\dxhr

C:\Users\user\AppData\Local\28050

--------------------

If there's no improvenment......lets uninstall and then reinstall MB:

If you have the pro version of MB....make sure you have your license key

-----------------------

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Go to your control panels add/remove programs and uninstall MalwareBytes Anti-Malware > reboot

Download and run this cleaner:

mbam-clean.exe

Reboot <---very important

Now download and see if you can install the latest version of MB from here: (disable any malware/anti-virus programs running first)

http://www.malwareby...am-download.php

---------------------------------------

Then...........clean out temp files:

Download TFC to your desktop

Close any open windows.

Double click the TFC icon to run the program

TFC will close all open programs itself in order to run,

Click the Start button to begin the process.

Allow TFC to run uninterrupted.

The program should not take long to finish it's job

Once its finished it should automatically reboot your machine,

if it doesn't, manually reboot to ensure a complete clean

Let check you disk for any errors.

Use F8 at startup or your to get to Advanced Boot Options.

Select "Repair your computer".

On the system recovery options select command prompt. Type the following and press Enter:

chkdsk c: /f

(note spaces between chkdsk and /f and c:)

Please wait until the check is done.

Let me know.....MrC