Virus/Spyware Problems MBAM cant detect

[Simy]

Hey

I have recently had problems with my computer, a rouge antivirus was recently in my computer but i managed to remove it thanks to MBAM.

But, i dont think MBAM has completey removed all malware, i am still recieving adware and im pretty sure there may be a trojan or maybe a rootkit still in my computer, i looked into task manager to see if there were unusual procceses, and i keep seeing many iexplore.exe procceses, not run by me but under SYSTEM, sorry if this explanation is not very understandable , im not a computer expert :/

Thanks

[MrCharlie]

Welcome to the forum.

Please start at the link below:

http://forums.malwarebytes.org/index.php?showtopic=9573

Post the logs from GMER and DDS and also can you post the logs from MBAM.

MrC

[Simy]

Hey

I followed the instructions on the forum post as u posted, GMER causes my computer to blue screen, i dont kno why

Thanks

Attach.txt

DDS.txt

mbam_log_2010_07_16__16_50_35_.txt

[MrCharlie]

When you ran GMER did you....

Disable your CD Emulation drivers with DeFogger ?

--------------------------

Try running it like this:

Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  
• Click on this link to see a list of programs that should be disabled.
  
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  
• Allow the driver to load if asked.
  
• You may be prompted to scan immediately if it detects rootkit activity.
  
• If you are prompted to scan your system click "No", save the log and post back the results.
  
• If not prompted, click the "Rootkit/Malware" tab.
  
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  
• Select all drives that are connected to your system to be scanned.
  
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
  
• When the scan is finished, click Save to save the scan results to your Desktop.
  
• Save the file as Results.log and copy/paste the contents in your next reply.
  
• Exit the program and re-enable all active protection when done.
  

Let me know, MrC

[Simy]

Hey

i disabled all security in my computer, and i downloaded DeFrogger and disabled the drives (it did not ask to re-boot my machine), but everytime i try to run GMER i still get a blue screen

Thanks

[MrCharlie]

OK, here's a real simple tool to check for rootkits:

Download and unzip the Avenger from the link below:

http://swandog46.geekstogo.com/avenger2/download.php

Open the program and make sure.........

Scan for rootkits <-----this box is checked

Automatically disable any rootkits found <----this box is not checked

Then click Execute button then choose Yes in the box that pops up.

Reboot the computer

After the computer reboots a text with results will appear

Please post it in your reply.

------------------------------------

Next:

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon and choose disable. More info HERE
  They may interfere with the running of ComboFix.
  
• Double click on ComboFix.exe & follow the prompts.
  Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
  Note: If you have SP3, use the SP2 package.
  If Vista or Windows 7, skip the Recovery Console part
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please let me know.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

5.Give it atleast 20-30 minutes to finish if needed.

MrC

[Simy]

Hey

I managed to get GMER to run smoothly (i forgot about windows security sorry), and i ran ComboFix too, they both managed to detect malware ill post the logs here.

Thanks

log.txt

[Simy]

Hey Sorry for double post, the GMER log didnt show up when i posted here it is.

GMER.txt

[MrCharlie]

OK, while I look over your logs, do me a favor and run the Avenger as outlined and post the report, I'd like to see what it says.

Thanks, MrC

[Simy]

Hey

Sorry i completely forgot about Avenger, here is the scan log

Thanks

avenger.txt

[MrCharlie]

OK, Thanks for doing that.

These two files that GMER found are most likely from ComboFix (Tools used by it)

C:\DOCUME~1\simy\LOCALS~1\Temp\catchme.sys

C:\DOCUME~1\simy\LOCALS~1\Temp\mbr.sys

---------------------------------

Run these two small programs and post the reports back here:

Download TDSSKiller and save it to your Desktop.

Click on TDSSKiller.exe to run it.

Once completed it will create a log in your C:\ drive called TDSSKiller_*** (*** denotes version & date)

Please post the content of the TDSSKiller log

-----------------------------

Download MBRCheck.exe to your desktop

XP users > double click on MBRCheck.exe to run it

Vista and Windows 7 users > right click on MBRCheck.exe and select Run as Administrator

It will show a black screen with some data on it

Don't run any of the options!!!

When it's done > Press Enter to close the program

A file will called MBRCheck_ will appear on your desktop

Please copy into to your next reply

MrC

[Simy]

Hey

here are the two logs from the scanners.

Thanks

MBRCheck_07.17.10_20.32.18.txt

TDSSKiller.2.3.2.2_17.07.2010_20.32.56_log.txt

[MrCharlie]

You were right...There it is:

-------------------------------------------------------------------------------------

MBRCheck, version 1.1.1

© 2010, AD

\\.\C: --> \\.\PhysicalDrive0

Size Device Name MBR Status

--------------------------------------------

74 GB \\.\PhysicalDrive0 Known-bad MBR code detected (Whistler / Black Internet)!

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done! Press ENTER to exit...

--------------------------------------------------------

Let me decide how we're going to fix this, MrC

[MrCharlie]

A couple of questions for you.

What kind of computer is this...brand name......

and do you have a XP cd or recovery cd that came with the computer?

Thanks, MrC

[Simy]

I have a ACER Aspire 4315 Laptop, Windows XP Professional SP3

I do have a recovery disk, But its Vista disk as i downgraded to XP

Thanks

[MrCharlie]

Please Note:

While fixing the Master Boot Record (MBR) is generally safe, there is a very small risk of damaging the system, the system won't boot up or partitions may become corrupted. Be sure to have your MS Windows CD at hand which will allow you to recover boot code via the Recovery Console in case of any problems or please install the XP Recovery Console now.

You have the Recovery Console installed!

If any problems occur, the links below explain how to repair the MBR:

Repair MBR XP and Vista

Please familiarize yourself with the procedure for your operating system version in case it's needed.

------------------------------------

OK, here's the fix:

Run MBRCheck.exe

Wait until you see the following line: Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Please push the 'Y' key and then press Enter

When program ask you Enter your choice: enter 2 and press the Enter key

Now the program will ask you Enter the physical disk number to fix (0-99, -1 to cancel):

Enter 0 and press the Enter key.

The program will show Available MBR codes:, followed by a list of operating systems. Please enter 1 for Windows XP, and then press Enter.

The program will prompt for confirmation. Type YES and hit Enter.

Left click on the title bar at the top of the window (where program name and path is written).

From menu chose Edit -> Select All

Hit the Enter key on your keyboard to copy selected text.

Paste that text into Notepad, save it to your desktop as MBRCheck results.txt

Hit Enter to close the program.

Restart your PC.

Post the text in MBRCheck results.txt here, please.

MrC

[Simy]

I have done as you asked and here is the log

Thanks

MBRCheck_07.17.10_22.16.16.txt

[MrCharlie]

OK, just run MBRCheck.exe again (don't run any options, just let in check the MBR) and post the log, please don't get it confused with any previous logs.

MrC

[Simy]

Hey

here is the log from the scan, iv checked my task manager and no iexplore.exe's are showing anymore!, and the laptop's cpu is now back to normal not 100%

Thanks!

MBRCheck_07.17.10_22.37.25.txt

[MrCharlie]

Looks OK, How's it running, MrC

[Simy]

Hey

The Laptop is now running very well, no pop-ups,no awkward audio sounds being played, no video lag

Thank you very much for your help :)

[Simy]

All was going well until i relised in the task manager that a LOADER.EXE appeared, its trying to attempt to install so there is still malware

[MrCharlie]

OK, please do this:

Download TFC to your desktop, it will clean out all the temp files on your system.

Open the file and close any other windows.

It will close all programs itself when run, make sure to let it run uninterrupted.

Click the Start button to begin the process. The program should not take long to finish its job

Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

----------------------------------

Update and then run a quick scan with MBAM.

Post the log back here when done, MrC

[Simy]

Ok i downloaded TFC and cleaned the system, and the machine rebooted as expected, here is the MBAM log after a quick scan,

so far everything is running fine , i will post if i see any malware activity, and to make sure i am performing a full system scan with MBAM and then Avast 5.

Thanks!

mbam_log_2010_07_17__23_49_42_.txt

[MrCharlie]

MBAM found nothing.

LOADER.EXE can be a good file.

I suggest you do a search for it then upload it for a scan here.

Let me know the results, MrC