Jump to content

Can't do anything after a couple mins!


anj109
 Share

Recommended Posts

Hey Guys,

So usually when I get these stupid malware viruses which try to get you to buy some anti-spyware software I run Malwarebytes and it gets rid of it. Well I did that last night and it got rid of all those stupid pop-ups but now it seems its affecting all my exe files. It shuts IE down after opening and I could only open up Malwarebytes after creating a copy of the exe file. When I start the quick scan, it finds 2 infected files within 30 seconds and then after about 2 or 3 minutes my computer freezes. I tried running Defogger but since I'm not logged in under Administrator that won't run (work computer but I do have admin rights) and when I run GMER my computer locks up around it but the program is still running.

Any ideas of how I can get my computer fixed? I'm trying to avoid my IT dept at all costs because all they're gonna do is re-image my computer and that's just a hassle cause of all the programs, etc I have setup.

Thanks,

Alex

Link to post
Share on other sites

Somehow I got a quick scan to run completely and was able to reboot and the system seems to be running better but the virus is still around. I ran it 3 more times and everything seems to be good except I can't open IE or Mozilla properly. Right after opening, a window pops up saying "Firefox.exe (or Internet Explorer) has encountered a problem and needs to close.....". If I hit ok, the browser shuts down. If I don't do anything, I can still use the browser in the background (what I'm doing now!).

Any ideas from you guys? Everytime I run a scan, I update. I attached my last 3 scans.

Thanks!

Desktop.zip

Link to post
Share on other sites

Ran OTL.exe and that hung up forever so had to terminate it.

Then ran GMER and here is my log. Any suggestions?

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-01-13 16:20:00

Windows 5.1.2600 Service Pack 3

Running: r4jtugr8.exe; Driver: C:\DOCUME~1\ajensen\LOCALS~1\Temp\kglorpog.sys

---- System - GMER 1.0.15 ----

SSDT 8A5A8870 ZwAlertResumeThread

SSDT 8A5BFD30 ZwAlertThread

SSDT 89B52690 ZwAllocateVirtualMemory

SSDT 89742D28 ZwConnectPort

SSDT 8A5DA858 ZwCreateMutant

SSDT 89B05DB8 ZwCreateThread

SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xEB085CC0]

SSDT 89749CF0 ZwFreeVirtualMemory

SSDT 89797C70 ZwImpersonateAnonymousToken

SSDT 89C06F88 ZwImpersonateThread

SSDT 89C02398 ZwMapViewOfSection

SSDT 8A56A278 ZwOpenEvent

SSDT 899B1E88 ZwOpenProcessToken

SSDT 89BB9598 ZwOpenThreadToken

SSDT 89BCD2A8 ZwQueryValueKey

SSDT 8980FAF0 ZwResumeThread

SSDT 89839CF0 ZwSetContextThread

SSDT 89BB7E98 ZwSetInformationProcess

SSDT 89A53A28 ZwSetInformationThread

SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xEB085F20]

SSDT 8A5AA7B0 ZwSuspendProcess

SSDT 89A40F00 ZwSuspendThread

SSDT 8981AE88 ZwTerminateProcess

SSDT 8A57B608 ZwTerminateThread

SSDT 89C02A58 ZwUnmapViewOfSection

SSDT 89750DB8 ZwWriteVirtualMemory

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)

AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\drivers\H8SRTafdvwkkjkr.sys (*** hidden *** ) [DISABLED] H8SRTd.sys <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 4

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTafdvwkkjkr.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTafdvwkkjkr.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTdstsveotqp.dll

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTxjemnmtdwt.dat

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTaoykrnqjrt.dll

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtmsg \\?\globalroot\systemroot\system32\H8SRTourfmhhgam.dll

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTpreqjuwsew.dll

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@start 4

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@type 1

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTafdvwkkjkr.sys

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@group file system

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTafdvwkkjkr.sys

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTdstsveotqp.dll

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTxjemnmtdwt.dat

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTaoykrnqjrt.dll

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtmsg \\?\globalroot\systemroot\system32\H8SRTourfmhhgam.dll

Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTpreqjuwsew.dll

Link to post
Share on other sites

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.