Jump to content

I Screwed Things up Royally: ComboFix and no internet

Ppwfam

By Ppwfam
in Resolved Malware Removal Logs

 Share

Recommended Posts

Ppwfam

Ppwfam

Posted
Posted

I've never had to post a question on a forum before, but tonight I think I'm way over my head.

 

I've had my yahoo email password hacked about 4 times. I ran some basic malware and spyware programs, but to no avail. I read somewhere to use ComboFix, and I dove right in. I've never used such a dangerous program! Ah!

 

So, the first ComboFix didn't seem to go through. Somehow, though I disabled it, AVG interferred with its process. The PC reset and the typical no connection to the internet ensured. Additionally, my laptop (windows 7) freezes up now and is super buggy.

 

I looked for the log, but it didn't seem to exist. The "file folder" in which things were to be stored just redirects me to the "My Computer" screen. <sigh>

 

I've been trying to follow the diretions here: https://forums.malwarebytes.org/index.php?showtopic=21435, but nothing is working.

 

Please help!

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted
Hi and Welcome!!   

 

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

 

  • The fixes are specific to your problem and should only be used for the issues on this machine.

It's often worth reading through these instructions and printing them for ease of reference.

If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.

Please reply to this thread. Do not start a new topic.

If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.

Please be sure to subscribe to the topic if you have not already done so.


IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.

 

Having said that....   YBCQLm4.gif   Let's get going!!  

----------

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Could you look for the file C:\ComboFix.txt please?  If it is there, please post that.  If not, let me know.   :)
 
----------------------
 
LlJESjW.jpgMalwarebytes Anti-Rootkit
 
Please download Malwarebytes Anti-Rootkit and save it to your desktop.

  • Be sure to print out and follow the instructions provided on that same page.
  • Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
  • Scan your system for malware
  • If malware is found, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.

If there is no malware found, please let me know as well.
----------

Link to post
Share on other sites
Ppwfam

Ppwfam

Posted
  • Author
Posted

Hi Jeff,

Thank you so much for replying. As I can see, you and your team are lifesavers (or at least computer savers).

I'm running the MalwareBytes scan as we speak. I'm using a different laptop to upload these files since mine won't access the internet. I disabled the connector for the moment since the computer runs infinitely faster I noticed when it's not "not connecting."

 

I didn't find anything on C:\ but I did find these inside the QooBox directory. There's a ComboFix directory as you can see, but it redirects me to what 'My Computer' would show. I can't find a Compfix.txt ... just a combofix2. I tried running it again after the first one didn't take, but it didn't seem to work either. I then tried contacting you guys ^_^

ComboFix2.txt

ComboFix-quarantined-files.txt

post-156469-0-84801000-1392231940_thumb.

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

That will work.   :)
 
I see you still have ComboFix on your Desktop?  
 
---------------------
 
Delete your version of SystemLook please and then do the following...
 
SystemLook
 
Please use either of the following links:
Download Mirror 1
Download Mirror 2

  • Right-click and Run as Administrator SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind*afd.sys
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Hi,

 

You are running Malwarebytes right now?  When that finishes post the log and don't do anything else ok?   :)

 

I see you also posted over at Bleeping Computer.  Could you go and let them know that you are getting help here so there are not two people working on the same topic?  Thank you.  

 

Nevermind....I closed it myself.  

 

Just post the new Malwarebytes log when it is made.  

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Good job.   :)
 
ComboFix

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    FCopy::
    C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys | C:\Windows\System32\drivers\afd.sys

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
     
    CFScriptB-4.gif
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
----------

 

Once finished with this, reboot your system and then check your internet connection.  :)

Link to post
Share on other sites
Ppwfam

Ppwfam

Posted
  • Author
Posted

Jeff,

I'm running it as we speak but it's running so slowly since I have the wi-if enabled. Since this issue arose, I've noticed that if wi-finis manually disabled, the computer runs at its usual faster-than-486 speed. Do I need to leave wi-if on for combofix?

Link to post
Share on other sites
Ppwfam

Ppwfam

Posted
  • Author
Posted

Ok...here's an update. It totally locked up. I had to cold boot it. Once I did, I disabled the wireless card using the keyboard function key and reran it. It ran with no problems this time and created two logs (which upon cursory look, seem to be identical). Then I activated the wireless but the internet is still not working. The two logs are attached.

ComboFix.txt

log.txt

Link to post
Share on other sites
Ppwfam

Ppwfam

Posted
  • Author
Posted

This is exactly why I changed my major from Computer Science to English: explicating Puritan rhetoric and studying Derrida is so much easier than coding. So..ComboFix froze up per my last post. I reset it, disabled the network card, ran ComboFix again, let it reboot, and still nothing, right? So I decided to let it try in Safemode (what's the harm since nothing was working anyways), and ComboFix unpacked and started but at Step 2, it had about 10 errors that stated it could not proceed. ComboFix then closed itself, and my pc started locking up in Safemode. I had to cold boot again and then I let it boot up regularly...and...huzzah! The computer is working. I'm using it now!

 

I don't know what worked--but I'm certain I have you to thank. It's like it needed two or three resets to kick in? It's not a car starter ... That doesn't make sense but it worked.

 

Things seem to be back to normal. Is there any way of checking?
 

Also, the reason i got into this whole mess was because my yahoo email has been hacked like 4 times in the past week. I'm using complex passwords, verified my email is not being forwarded, and have a secure network at home. I read online that there was likely some malware or keylogger, and that's what led me to ComboFix in the first place. Any ideas about this either?

 

Thanks again!

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Well I am glad to see that your internet is working.   :)  You had that file that was infected and we replaced that so that your internet could work again.  Thanks for letting me know about how your system is running, but please don't do anything that is not requested.  It helps me to keep track mentally of what is going on.   :)  
 
Anyway....
 
There is still more in the logs that need to be cleaned so stick with me as this may take a couple passes to clean up....
 
First...
 
Run Farbar Service Scanner again and post the new log that is made.
-------------
 
81mYIKe.jpg  AdwCleaner
 
Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool
    Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

----------

Link to post
Share on other sites
Ppwfam

Ppwfam

Posted
  • Author
Posted

Ok here are the reports. Things seem to be running in order.

 

Out of the 5 available, how did you know which afd.sys file to replace the infected one with? Also, what infected the afd? Was it malware? or was it ComboFix that messed it up somehow? It's such a strange problem...how does a malware remover corrupt the registry and in turn affect the drivers for the network card?

 

I also uninstalled AVG for ComboFix's sake. Should I redownload it?

AdwCleanerS0.txt

FSS.txt

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

There we go....that looks better.  The afd.sys was definitely infected by malware and blocking your internet access.  I just had to replace it, but anyway....
 
You can redownload AVG if you like but since you uninstalled it, don't reinstall it until we are done for simplicity sake and don't really browse anywhere but here until we get it back onto the system.
 
Please delete the current version of Combofix.exe from your desktop and download a new version from here to your desktop.
 
Disable your AntiVirus and AntiSpyware applications.
 
Right-click and Run as Administrator on the Combofix.exe and follow the prombts on your display. When finish, it will create a C:\Combofix.txt. Please post this log for further review.
---------

Link to post
Share on other sites
Ppwfam

Ppwfam

Posted
  • Author
Posted

Seems to be running better. The internet is connecting. It seemed like it even booted faster this morning.

 

What program should I use for routine Malware maintenance?

 

How about heavy duty maintenance (for instance, I'm going to hook up a couple old hard drives from old laptops and use them to store photos, and they probably need some heavy cleaning)?

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Good to hear.....  Remind me of these questions before we go, but for now let's check and be sure that nothing is in there hiding.
 
Please download DDS from either of these links
 
LINK 1
LINK 2
 
and save it to your desktop.

  • Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.

---------------------------------------------------
Please include the contents of the following in your next reply:
 
DDS.txt
 
Attach.txt
----------

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

VBJ9QO9.jpgJava 
 
Please go to Start > Control Panel > Programs and Features > uninstall all the Java Programs you see, now download the latest Java from the following link and install it:
 
http://java.com/en/download/index.jsp
----------
 
VBJ9QO9.jpgJava
See this page for instructions on how to clear java's cache.
 
Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Installed Applications and Applets
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Java Control Panel.

----------
 

GUZVCQN.jpgMalwarebytes
 
Please open Malwarebytes, update it and then run a Quick Scan.  Save the log that is created for your next reply.
----------
 

ESET Online Scanner
 
Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.

----------

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.