lhmogensen Posted March 18, 2009 ID:65559 Share Posted March 18, 2009 After posting in the forum last night I got a responce to install Hijack this by Pcillen. I was unable to run hijack this. I have been working in safe mode. below is my post from yesterday for more detail.I noticed after browsing around in my search engine yesterday (FireFox, yahoo search) My yahoo search looked messed up. when u search a site it takes you to a advertising site. I had this issue once before, I was told it was Malware infecting my browser..I was instrued to DL Malwarebytes & disable 3rd party sites. That worked for that issue. But this time I wasnt even able to OPEN malwareBytes. I was able to do virus check with my Pclllen software & pulled up nothing both in normal & safe mode. I have done a system restore, that did not work. I eventually found how to open Malware bytes by creating a short cut & changing its name(seems this virus affects certain programs u try & lanuch). I ran a full scan with malwareBytes with no success of catching the virus. When I am in Normal mode, my PC will shut down & I get the horrible blue screen of death that reads: River_Irql_not_less_or equal. So i know there is still something invading my PC even though my virus software is not picking it up. I really dont want to go through the trouble of uninstalling windows & re loading windows..Any advice?? Please help. Link to post Share on other sites More sharing options...
lhmogensen Posted March 18, 2009 Author ID:65564 Share Posted March 18, 2009 Also i was told to try Avira System Rescue. I got the program on a disc & tried to launch it at start up..But it didnt work. they had said u have to make sure when the PC starts up, the disc runs first..I am unsure how to change the order. Link to post Share on other sites More sharing options...
grandpaG Posted March 18, 2009 ID:65572 Share Posted March 18, 2009 .I am unsure how to change the order.To change the boot order, you must enter the BIOS. Reboot your computer and just after the initial screen, start tapping the Delete key (most of the time).Using your arrow keys, you can select the category Usually the first of second one on the left) you want and hit Enter.Make you changes, then Exit/Save changes Link to post Share on other sites More sharing options...
lhmogensen Posted March 18, 2009 Author ID:65593 Share Posted March 18, 2009 UPDATE:I was able to change the order of booting. I had USB CD/ROM first and when it loaded with the Avir resuce disk..I got the Blue Screen of Death, that said it had to shut down. I am still able to work from safe mode/networking. Link to post Share on other sites More sharing options...
lhmogensen Posted March 18, 2009 Author ID:65594 Share Posted March 18, 2009 UPDATE: I noticed my Malware bytes was out of date. When i clicked to update it said it was going to install the latest verison , close & re open. It did not re open and when I reopened it the update did not take affect. Link to post Share on other sites More sharing options...
Fatdcuk Posted March 18, 2009 ID:65596 Share Posted March 18, 2009 Hi,Please try the following walkthrough to see if CLB driver is the culprit behind the issue's you are experiencing.http://www.malwarebytes.org/forums/index.php?showtopic=12709 Link to post Share on other sites More sharing options...
lhmogensen Posted March 18, 2009 Author ID:65678 Share Posted March 18, 2009 Thank you so much for the advice I found the .sys file & wiped it out followed by a scan & found 10 dirty files. I think I am clean!! System seems to be working great again. Below are my logs..Thanks again!! you saved my pc!ROOTREPEAL © AD, 2007-2008==================================================Scan Time: 2009/03/18 18:56Program Version: Version 1.2.3.0Windows Version: Windows XP Media Center Edition SP3==================================================Hidden/Locked Files-------------------Path: C:\WINDOWS\system32\UACbdveiqxf.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\UACbekvpphb.dbStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\uacinit.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\UACjbvwuwsf.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\UACmhlvdmpr.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\UAColwmqhin.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\uactmp.dbStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\UACubrxdksf.datStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\UACvwubkrwx.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\UACymverqpm.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\UACysiullop.logStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\UAC66a4.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\UAC83f5.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\drivers\UACmfxylkya.sysStatus: Invisible to the Windows API!Path: C:\Documents and Settings\Lindsey\Local Settings\Temp\UAC9b9b.tmpStatus: Invisible to the Windows API!Malwarebytes' Anti-Malware 1.34Database version: 1866Windows 5.1.2600 Service Pack 33/18/2009 7:19:17 PMmbam-log-2009-03-18 (19-19-17).txtScan type: Quick ScanObjects scanned: 93352Time elapsed: 11 minute(s), 31 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 2Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 8Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\WINDOWS\system32\UACbdveiqxf.dll (Trojan.TDSS) -> Quarantined and deleted successfully.C:\Documents and Settings\Lindsey\Local Settings\Temp\UAC9b9b.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.C:\WINDOWS\Temp\UAC66a4.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.C:\WINDOWS\system32\UACubrxdksf.dat (Trojan.Agent) -> Quarantined and deleted successfully.C:\WINDOWS\system32\UACvwubkrwx.dll (Trojan.Agent) -> Quarantined and deleted successfully.C:\WINDOWS\system32\UACysiullop.log (Trojan.Agent) -> Quarantined and deleted successfully.C:\WINDOWS\system32\drivers\UACmfxylkya.sys (Trojan.Agent) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
Recommended Posts