Windows Recovery Virus!!! Help needed to remove

Page 1 of 2 1, 2  Next

View previous topic View next topic Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 26th May 2011, 4:09 am

Remember the picture I showed you? When I go into my Local Disk (C:), it didn't look like that. It was normal until I got that Windows Recovery on my computer and maybe created those files, folders, and those locks on them. I was wondering if there is anyway I can get it to how it looked like before that picture. Some of the folders, files, etc. have like locks on them, which I don't even know why. Let say I googled "GeekPolice" and I clicked on 1 of the links shown. Instead of taking me to the website, it totally takes me to a different website like this 1: [You must be registered and logged in to see this link.]

Somehow it takes me pretty long to go to a website, which loads pretty slow. It wasn't like this before. I got a question. Is the virus even removed? If you can't help me, I'll just go reinstall windows 7, and re-download all the program and software I had on my computer. That I think is the best way to restore everything back the way I had.

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Crush on 27th May 2011, 12:36 am

Hi,


  • Download [You must be registered and logged in to see this link.] and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • Click the Report button and copy/paste the contents of it into your next reply
Note:It will also create a log in the C:\ directory.

Crush
Master
Master

Posts Posts : 3889
Joined Joined : 2010-01-27
Gender Gender : Male
Points Points : 42118
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 27th May 2011, 2:21 am

Nothing happens when I double click on TDSSKiller.exe

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 28th May 2011, 5:05 am

bump. no reply for 2 days....

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 28th May 2011, 8:16 pm

Hi zhengs,

Crush is helping another helper that is on vacation.

Okay, Right-click TDSSKiller and select Run As Administrator. Copy/paste the contents of it into your next reply


Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 29th May 2011, 3:04 am

[You must be registered and logged in to see this link.] wrote:Hi zhengs,

Crush is helping another helper that is on vacation.

Okay, Right-click TDSSKiller and select Run As Administrator. Copy/paste the contents of it into your next reply


Did that too and didn't do anything.

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 29th May 2011, 4:28 am

Right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (Example: puppy.com). If you do not see the file extension, please refer to: [You must be registered and logged in to see this link.]


  • Then Click the Start Scan button
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • Click the Report button and copy/paste the contents of it into your next reply
Note:It will also create a log in the C:\ directory.

Next


ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read [You must be registered and logged in to see this link.].


  • Please go [You must be registered and logged in to see this link.] then click on:
  • Select the option YES, I accept the Terms of Use then click on:
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:


    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology

  • Now click on:
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on:
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!


In your next reply, please include these log(s):

1.TDSSKiller report
2.ESET Online report


Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 29th May 2011, 5:35 am

Right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (Example: puppy.com). If you do not see the file extension, please refer to: [You must be registered and logged in to see this link.]


  • Then Click the Start Scan button
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • Click the Report button and copy/paste the contents of it into your next reply
Note:It will also create a log in the C:\ directory.

Still doesn't work.


Last edited by zhengs on 29th May 2011, 5:53 am; edited 1 time in total

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 29th May 2011, 5:51 am

TDSSKiller is giving us a hard time. Good chance your PC policies that have been affected by malware.


  • Download [You must be registered and logged in to see this link.] by Bill Castner and save it to your desktop.
  • Right-click on FixPolicies.exe & select RUN AS ADMINISTRATOR
  • Click on Install. It will create a folder named FixPolicies on your desktop.
  • Open the FixPolicies folder.
  • Double click on Fix_policies.cmd to run it. Command Prompt will open and close quickly this is normal.
  • Reboot your computer after it runs


Next

Drag TDSSKiller icon into the recycle bin. Download a fresh copy. Run TDSSKiller as in my previous post. Run ESET Online Scanner next. Even if you can't run TDSSKiller.

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 29th May 2011, 7:19 am

Nothing happened after running tdsskiller after reboot.

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=7179bbf29e298d4a9226c5b68864d184
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-05-29 06:56:58
# local_time=2011-05-29 02:56:58 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1024 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 7296061 58193272 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=109889
# found=19
# cleaned=0
# scan_time=3737
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\649294e6-71055772 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\58ec35a7-39982b61 a variant of Java/Exploit.CVE-2010-4452.A trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\b692329-177627f6 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\474f9daa-227fa994 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\4c81ed73-73050f42 probably a variant of Java/Agent.BR trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\32171ff4-625267dd multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-12c91330 Java/TrojanDownloader.Agent.NCA trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-23bf33ce Java/TrojanDownloader.Agent.NCA trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\4425dafa-1c19fe4c multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\649294e6-71055772 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\58ec35a7-39982b61 a variant of Java/Exploit.CVE-2010-4452.A trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\b692329-177627f6 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\474f9daa-227fa994 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\4c81ed73-73050f42 probably a variant of Java/Agent.BR trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\32171ff4-625267dd multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-12c91330 Java/TrojanDownloader.Agent.NCA trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-23bf33ce Java/TrojanDownloader.Agent.NCA trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\4425dafa-1c19fe4c multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\James\Downloads\FDMSetup.exe a variant of Win32/Adware.HotBar.H application (unable to clean) 00000000000000000000000000000000 I

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 29th May 2011, 1:00 pm

Hi,

I'll be busy for the next few days, when I get back we'll finish up. Your PC is safe to surf the net until then.

Run OTL.exe

  • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL

    :files
    C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\649294e6-71055772
    C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\58ec35a7-39982b61   
    C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\b692329-177627f6   
    C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\474f9daa-227fa994
    C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\4c81ed73-73050f42
    C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\32171ff4-625267dd
    C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-23bf33ce
    C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\4425dafa-1c19fe4c
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\649294e6-71055772
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\58ec35a7-39982b61   
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\b692329-177627f6   
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\474f9daa-227fa994
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\4c81ed73-73050f42
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\32171ff4-625267dd
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-12c91330
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-23bf33ce
    C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\4425dafa-1c19fe4c
    C:\Users\James\Downloads\FDMSetup.exe   
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    [emptytemp]
    [EMPTYFLASH]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done.


Post resulting log.

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 29th May 2011, 8:06 pm

All processes killed
========== OTL ==========
========== FILES ==========
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\649294e6-71055772 moved successfully.
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\58ec35a7-39982b61 moved successfully.
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\b692329-177627f6 moved successfully.
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\474f9daa-227fa994 moved successfully.
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\4c81ed73-73050f42 moved successfully.
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\32171ff4-625267dd moved successfully.
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-23bf33ce moved successfully.
C:\Documents and Settings\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\4425dafa-1c19fe4c moved successfully.
File\Folder C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\649294e6-71055772 not found.
File\Folder C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\58ec35a7-39982b61 not found.
File\Folder C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\b692329-177627f6 not found.
File\Folder C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\474f9daa-227fa994 not found.
File\Folder C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\4c81ed73-73050f42 not found.
File\Folder C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\32171ff4-625267dd not found.
C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-12c91330 moved successfully.
File\Folder C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3e8b0db5-23bf33ce not found.
File\Folder C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\4425dafa-1c19fe4c not found.
File\Folder C:\Users\James\Downloads\FDMSetup.exe not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\James\Downloads\cmd.bat deleted successfully.
C:\Users\James\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: James
->Temp folder emptied: 173946493 bytes
->Temporary Internet Files folder emptied: 18961758 bytes
->Java cache emptied: 14397103 bytes
->FireFox cache emptied: 19422971 bytes
->Flash cache emptied: 2219 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 526253 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 2559544 bytes

Total Files Cleaned = 219.00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: James
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.23.0 log created on 05292011_103339

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\TMP0000000174F21DAB185B250A not found!

Registry entries deleted on Reboot...

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 30th May 2011, 7:41 pm

Some of the stuff I can't get rid of because it says access denied even though I'm logged in as administer.
UAC is at fault. Visit this site:

[You must be registered and logged in to see this link.]


The reason why this happens with UAC enable. As in your C:\ Drive... Because Admin User Account Control handles the users of the administrators group as a standard user/users.

You can use this tool to turn off and turn on UAC at:

[You must be registered and logged in to see this link.]

Let me know how it went?


Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 31st May 2011, 3:33 am

k I installed it. What do I do now?

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 31st May 2011, 11:27 am

Click turn UAC off now. Reboot your PC. You should have access to those files now.

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 31st May 2011, 8:08 pm

Yes, it works. Now what?

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 31st May 2011, 8:28 pm

Purge old temporary files. Now that we are done.... Smile

Please download [You must be registered and logged in to see this link.] to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start
    button to begin the process. Depending on how often you clean temp
    files, execution time should be anywhere from a few seconds to a minute
    or two. Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

You should keep TFC and run it once a week.


Your Computer is Clean



Some final items:


Follow these steps to uninstall Combofix and tools used in the removal of malware

To remove all of the tools we used and the files and folders they created, please do the following:
Please download [You must be registered and logged in to see this link.] by OldTimer:

  • Save it to your Desktop.
  • Double click OTC.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.


It's a good idea to Flush your System Restore after removing malware and create a new restore point.


To SET A NEW RESTORE POINT:
1. Go to Start > Programs > Accessories > System Tools and click "System Restore".
2. Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
3. Then go to Start > Run and type: Cleanmgr
4. Click "OK".
5. Click the "More Options" Tab.
6. Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Graphics for doing this are in the following links if you need them.
[You must be registered and logged in to see this link.].
[You must be registered and logged in to see this link.].


Here are some additional links for you to check out to help you with your computer security.

Browsers

Just because your computer came loaded with Internet Explorer doesn't mean that you have to use it, there are other free alternatives, [You must be registered and logged in to see this link.] and [You must be registered and logged in to see this link.], both are free to use and are more secure than IE.

If you are using firefox you can stay more secure by adding [You must be registered and logged in to see this link.] and [You must be registered and logged in to see this link.]

NoScript stops Java scripts from starting on a web page unless you give permission for them, and WOT (Web Of Trust) has a comprehensive list of ratings for different websites allowing you to easily see if a website that you are about to go to has a bad reputation; in fact it will warn you to check if you are sure that you want to continue to a bad website.

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.


Additional Security Measures

[You must be registered and logged in to see this link.]

Visit Microsoft's Windows Update Site Frequently - It is important that you visit [You must be registered and logged in to see this link.] regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

[You must be registered and logged in to see this link.]- Scans your PC for tracking cookies in multiple browsers as well as in Adobe Flash.

[You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.] - Two good disc defragmenters for you to choose from to help speed up your computer.

[You must be registered and logged in to see this link.]




Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 31st May 2011, 10:37 pm

No no no.... MY computer is slow and get very hot now. So what do I do with all the files and folders on my computer? What if I can't delete it? Why when I search something on google, it brings me to another link when I click on the link? And there are some processes associated with the virus that might have something to do with the googling links I did. There are so many more problems haven't been solved yet......

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 31st May 2011, 10:51 pm

MY computer is slow and get very hot now.
Sounds like a hardware problem.

So what do I do with all the files and folders on my computer?
What files and folders? Are you referring to?

There are so many more problems haven't been solved yet......
What are the others problems? Other than redirects?

What if I can't delete it?
Have you tried,,,,,,,, now that UAC is turned off?

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 1st June 2011, 12:19 am

The computer wasn't burning up and slow until that virus got into it. Files and folders that just came in my C: drive and flooded into my other folders that I had. It wasn't like that before the virus came, so I thought maybe it was the virus. I have no idea... I thought I could just delete them, but there are too many folders and files everywhere created by it. Some of them can't be deleted. I don't know all folders and files that are created by the virus or not. You can see the picture of my C: drive on page 2. There is more to it when you open into the folders, which contains more and more folders and files. Does too much folders and files on the computer make it slow for me?

I always use Google to google things. Whenever I click on the link I googled, I get send to another different place. The link quickly changed to something else that wasn't even a website. That's why I always have to type the website in the link bar now. But it wasn't like this after the virus got onto my computer. I kinda got frustrated that my computer couldn't be the way it was before. I don't know what to do. I'm sorry I can't explained it so well, but that's all my problems I have right now.

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 1st June 2011, 1:43 am

Does too much folders and files on the computer make it slow for me?
No. Not at all with the amount of RAM you have install. A lot of the files are system files in your C: drive... Some are non system files. Like this one:

U_SUN_setup.exe

[You must be registered and logged in to see this link.]

Part of a install.

Disk Cleanup would help at:

[You must be registered and logged in to see this link.]

Okay, I'm more concern about the google redirects. Are you behind a router?

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 1st June 2011, 4:24 am

But still not all the folders and files gone away. Yes, I'm using a router for the modem.

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 1st June 2011, 11:12 am

Your Router seems to be infected as well. Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.


1. Very important: First disconnect your computers from the Internet.

2. Router Reset: Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into the small hole labeled Reset located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 30 seconds).

3. Reset the IP/DNS settings of your Internet connection on each computer connected:

  • Go to Start -> Control Panel -> Double click on Network Connections.
  • Right click on your default connection (usually Local Area Connection or Wireless Network Connection) and select Properties.

  • Select the General tab.
  • Double click on Internet Protocol (TCP/IP).

    • Under General tab:

      • Select "Obtain an IP address automatically".
      • Select "Obtain DNS server address automatically".



  • Click OK twice to save the settings.
  • Reboot if you had to change any setting.

4. Flush the DNS cache:

  • Click the Start logo in the bottom left corner of the screen
  • Click on Run
  • In the command window copy/paste the following:

    Code:
    ipconfig /flushdns
  • Then hit enter.
  • Exit the command window.

4. Reconnect: Once you have followed all the above steps you can reconnect your computer to the internet.

Then checks for redirects and let me know if the redirectsn are gone?

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 1st June 2011, 2:23 pm

3. Reset the IP/DNS settings of your Internet connection on each computer connected


Is it okay if I only reset mine? There are other computers connected the internet that isn't mine and they are gone for vacation. Also I only reset my computer and seem like it didn't work.

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 1st June 2011, 5:44 pm

Just your computer would be fine. But if you can't, move on to step 4.

Let me know if the Google redirects are still happening?

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 1st June 2011, 6:10 pm

still happening.

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 1st June 2011, 8:08 pm

Please click [You must be registered and logged in to see this link.] to download Kaspersky Virus Removal Tool.


  1. Double click on the file you just downloaded and let it install.
  2. It will install to your desktop.
  3. After that leave what is selected and put a check next to My Computer.
  4. Click on the option that says Threat Detection and change it to Disinfect,delete if disinfection fails.
  5. Then click on Start Scan.
  6. Before it is done it may prompt for action regardless of the setting so choose delete if prompted.
  7. When the scan is done no log will be produced.
  8. Click on the bottom where it says Report to open the report.
  9. Then highlight of of the items found by using ctrl + a on your keyboard to select all or use your mouse to select all then right click and choose copy.
  10. This will copy the items that it found to the clipboard you can then open notepad (go to start then run then type in notepad) and choose paste to paste the contents into Notepad.
  11. You can save this on the desktop.
  12. Post the contents of the document in your next reply.


Note: This tool will self uninstall when you close it so please save the log before closing it.




Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 1st June 2011, 9:42 pm

Do you know what is Team Viewer? I was thinking maybe you can check my computer yourself for what is wrong. I don't know all the problems I'm having and what is causing them...

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 1st June 2011, 9:55 pm

Yes I have Team Viewer and use it for my family computers and paying clients.

But we do NOT use it here. GeekPolice is a Free help forum and is run by volunteers. So, I'm sorry I don't use it here or at any other FREE help forums.

Perhaps you should do a Complete Reformat and Reinstall of your OS.

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 1st June 2011, 10:53 pm

You mean reinstall Windows 7 Ultimate?

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 1st June 2011, 11:51 pm

Autoscan: completed 15126 days ago (events: 11, objects: 141678, time: 00:39:41)
6/1/2011 5:49:36 PM Task started
6/1/2011 5:49:37 PM Detected: MEM:Rootkit.Win32.Sst.a Unknown application
6/1/2011 5:49:37 PM Cannot be backed up: MEM:Rootkit.Win32.Sst.a Unknown application
6/1/2011 5:55:09 PM Detected: MEM:Rootkit.Win32.Sst.a System Memory
6/1/2011 5:55:29 PM Disinfected: MEM:Rootkit.Win32.Sst.a System Memory
6/1/2011 5:55:29 PM Disinfected: MEM:Rootkit.Win32.Sst.a System Memory
6/1/2011 6:12:36 PM Detected: Packed.Win32.Katusha.p C:\Users\James\AppData\Local\temp\BCDB.tmp
6/1/2011 6:12:41 PM Detected: Trojan-Dropper.Win32.TDSS.aoje C:\Users\James\AppData\Roaming\Adobe\plugs\mmc2260501.txt
6/1/2011 6:12:54 PM Deleted: Packed.Win32.Katusha.p C:\Users\James\AppData\Local\temp\BCDB.tmp
6/1/2011 6:12:56 PM Deleted: Trojan-Dropper.Win32.TDSS.aoje C:\Users\James\AppData\Roaming\Adobe\plugs\mmc2260501.txt
6/1/2011 6:29:17 PM Task completed

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 2nd June 2011, 12:12 am

Please download aswMBR from [You must be registered and logged in to see this link.]


  • Save aswMBR.exe to your Desktop
  • Double click aswMBR.exe to run it
  • Click the Scan button to start the scan as illustrated below



Note: Do not take action against any **Rootkit** entries until I have reviewed the log.

  • Once the scan finishes click Save log to save the log to your Desktop

  • Copy and paste the contents of aswMBR.txt back here for review

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 2nd June 2011, 12:24 am

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-06-01 20:23:29
-----------------------------
20:23:29.025 OS Version: Windows 6.1.7601 Service Pack 1
20:23:29.025 Number of processors: 2 586 0xF0D
20:23:29.027 ComputerName: JAMES-PC UserName: James
20:23:37.477 Initialize success
20:23:47.437 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4
20:23:47.440 Disk 0 Vendor: FUJITSU_MHY2250BH 0000000B Size: 238475MB BusType: 11
20:23:49.464 Disk 0 MBR read successfully
20:23:49.469 Disk 0 MBR scan
20:23:49.473 Disk 0 Windows 7 default MBR code
20:23:51.479 Disk 0 scanning sectors +488395120
20:23:51.761 Disk 0 scanning C:\Windows\system32\drivers
20:23:57.484 Service scanning
20:23:59.211 Disk 0 trace - called modules:
20:23:59.233 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x860991ed]<<
20:23:59.238 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85fd3510]
20:23:59.243 3 CLASSPNP.SYS[8b37c59e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-4[0x85ecf030]
20:23:59.249 \Driver\atapi[0x85ec3428] -> IRP_MJ_CREATE -> 0x85e381f8
20:23:59.254 Scan finished successfully
20:24:29.676 Disk 0 MBR has been saved successfully to "C:\Users\James\Desktop\MBR.dat"
20:24:29.683 The log file has been saved successfully to "C:\Users\James\Desktop\aswMBR.txt"



zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 2nd June 2011, 12:09 pm

Drag combofix icon into the recycle bin. Download a updated copy.

Please rerun Combofix and tell me if it still detects rootkit activity? Also, post that log in your next reply



  1. Download ComboFix from below:

    [You must be registered and logged in to see this link.]


Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 2nd June 2011, 7:27 pm

ComboFix 11-06-01.07 - James 2/2011 Thu 15:19:43.5.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.936.86.1033.18.3062.2377 [GMT -4:00]
执行位置: c:\users\James\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\James\AppData\Roaming\Adobe\plugs
c:\users\James\AppData\Roaming\Adobe\shed
c:\users\James\AppData\Roaming\Adobe\shed\thr1.chm
c:\windows\system32\config\mcckmplayervod.ini
.
.
((((((((((((((((((((((((( 2011-05-02 至 2011-06-02 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-06-02 19:24 . 2011-06-02 19:24 -------- d-----w- c:\users\James\AppData\Local\temp
2011-06-02 19:24 . 2011-06-02 19:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-01 21:06 . 2011-06-01 23:51 -------- d-----w- c:\programdata\Kaspersky Lab
2011-05-31 20:24 . 2011-05-31 20:24 -------- d-----w- c:\windows\Sun
2011-05-30 02:36 . 2011-05-30 02:36 -------- d-sh--w- c:\programdata\thunder_vod_cache
2011-05-30 02:36 . 2011-05-30 02:36 -------- d-----w- c:\program files\Common Files\Thunder Network
2011-05-30 02:36 . 2011-05-30 02:36 -------- d-----w- c:\programdata\Thunder Network
2011-05-30 02:35 . 2011-05-30 02:35 -------- d-----w- c:\program files\Thunder Network
2011-05-30 02:35 . 2009-05-04 17:09 89600 ----a-w- c:\windows\system32\atl71.dll
2011-05-30 02:35 . 2009-05-04 17:09 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-05-30 02:35 . 2009-05-04 17:09 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-05-29 05:51 . 2011-05-29 05:51 -------- d-----w- c:\program files\ESET
2011-05-29 05:16 . 2011-05-29 05:16 -------- d-----w- c:\users\James\AppData\Roaming\AVG10
2011-05-29 05:16 . 2011-05-29 05:16 -------- d--h--w- c:\programdata\Common Files
2011-05-29 05:15 . 2011-05-29 05:20 -------- d-----w- c:\users\James\AppData\Roaming\PIPI
2011-05-29 05:15 . 2011-05-29 05:47 -------- d-----w- c:\programdata\AVG10
2011-05-29 05:15 . 2011-05-29 05:18 -------- d-----w- c:\windows\system32\drivers\AVG
2011-05-29 05:13 . 2011-05-29 05:19 -------- d-----w- c:\programdata\MFAData
2011-05-29 05:10 . 2011-05-29 05:10 -------- d-sh--w- c:\programdata\seemao_backup
2011-05-29 05:09 . 2011-05-29 05:10 -------- d-----w- c:\programdata\~smtemp
2011-05-29 05:01 . 2011-05-29 05:01 -------- d-----w- c:\programdata\KuaiKuai
2011-05-22 22:29 . 2011-05-22 22:29 -------- d-----w- c:\programdata\PC Tools
2011-05-16 20:09 . 2011-05-16 20:09 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-11 00:15 . 2011-04-09 06:02 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-05-11 00:15 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe
2011-05-11 00:15 . 2011-04-09 06:02 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-05-07 05:27 . 2011-05-07 05:27 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-07 05:27 . 2011-05-07 05:27 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-05-07 05:27 . 2011-05-07 05:27 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-05-07 05:27 . 2011-05-07 05:27 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-07 05:27 . 2011-05-07 05:27 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-07 05:27 . 2011-05-07 05:27 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-07 05:27 . 2011-05-07 05:27 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-07 05:27 . 2011-05-07 05:27 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-11 05:33 . 2011-04-12 20:09 1164288 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-11 05:33 . 2011-04-12 20:09 1137664 ----a-w- c:\windows\system32\mfc42.dll
2011-03-08 05:28 . 2011-04-12 20:08 741376 ----a-w- c:\windows\system32\inetcomm.dll
2011-05-07 05:27 . 2011-05-07 05:27 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^James^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip]
path=c:\users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip
backup=c:\windows\pss\CurseClientStartup.ccip.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-23 23:30 173592 ----a-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-23 23:30 141848 ----a-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-12-20 22:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 22:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-23 23:30 150552 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-18 00:40 1242448 ----a-w- c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files\Garena\safedrv.sys [x]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2010-05-31 6638080]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-10-21 4093392]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-31 1343400]
R3 XDva379;XDva379;c:\windows\system32\XDva379.sys [x]
R3 XDva380;XDva380;c:\windows\system32\XDva380.sys [x]
R3 XDva383;XDva383;c:\windows\system32\XDva383.sys [x]
R3 XDva384;XDva384;c:\windows\system32\XDva384.sys [x]
R3 XDva385;XDva385;c:\windows\system32\XDva385.sys [x]
R3 XDva386;XDva386;c:\windows\system32\XDva386.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-21 691696]
S3 NETwLv32; Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETwLv32.sys [2010-08-16 6637056]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2007-08-03 9344]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
.
------- 而外的扫描 -------
.
uStart Page = [You must be registered and logged in to see this link.]
IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436}
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\z4dfk4n4.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
完成时间: 2011-06-02 15:25:42
ComboFix-quarantined-files.txt 2011-06-02 19:25
.
Pre-Run: 180,994,048,000 bytes free
Post-Run: 180,967,469,056 bytes free
.
- - End Of File - - 22E5B2FAD221C93783C3E9F6CF1D5B1C

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 2nd June 2011, 8:00 pm

The search redirections should have stopped now.

Run CFScript


  • Close any open browsers.
  • Open Notepad by click start
  • Click Run
  • Type notepad into the box and click enter
  • Notepad will open
  • Copy and Paste everything from the Code box into Notepad:


Code:
KILLALL::
Reglock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
Firefox::
FF - ProfilePath - c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\z4dfk4n4.default\
DDS::
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com

Save the file to your desktop and name it CFScript.txt


Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.





This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 2nd June 2011, 11:22 pm

Redirects still happening...

ComboFix 11-06-02.02 - James 2/2011 Thu 19:12:57.6.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.936.86.1033.18.3062.2247 [GMT -4:00]
执行位置: c:\users\James\Downloads\ComboFix.exe
Command switches used :: c:\users\James\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( 2011-05-02 至 2011-06-02 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-06-02 23:17 . 2011-06-02 23:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-02 19:25 . 2011-06-02 23:18 -------- d-----w- c:\users\James\AppData\Local\temp
2011-06-01 21:06 . 2011-06-01 23:51 -------- d-----w- c:\programdata\Kaspersky Lab
2011-05-31 20:24 . 2011-05-31 20:24 -------- d-----w- c:\windows\Sun
2011-05-30 02:36 . 2011-05-30 02:36 -------- d-sh--w- c:\programdata\thunder_vod_cache
2011-05-30 02:36 . 2011-05-30 02:36 -------- d-----w- c:\program files\Common Files\Thunder Network
2011-05-30 02:36 . 2011-05-30 02:36 -------- d-----w- c:\programdata\Thunder Network
2011-05-30 02:35 . 2011-05-30 02:35 -------- d-----w- c:\program files\Thunder Network
2011-05-30 02:35 . 2009-05-04 17:09 89600 ----a-w- c:\windows\system32\atl71.dll
2011-05-30 02:35 . 2009-05-04 17:09 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-05-30 02:35 . 2009-05-04 17:09 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-05-29 05:51 . 2011-05-29 05:51 -------- d-----w- c:\program files\ESET
2011-05-29 05:16 . 2011-05-29 05:16 -------- d-----w- c:\users\James\AppData\Roaming\AVG10
2011-05-29 05:16 . 2011-05-29 05:16 -------- d--h--w- c:\programdata\Common Files
2011-05-29 05:15 . 2011-05-29 05:20 -------- d-----w- c:\users\James\AppData\Roaming\PIPI
2011-05-29 05:15 . 2011-05-29 05:47 -------- d-----w- c:\programdata\AVG10
2011-05-29 05:15 . 2011-05-29 05:18 -------- d-----w- c:\windows\system32\drivers\AVG
2011-05-29 05:13 . 2011-05-29 05:19 -------- d-----w- c:\programdata\MFAData
2011-05-29 05:10 . 2011-05-29 05:10 -------- d-sh--w- c:\programdata\seemao_backup
2011-05-29 05:09 . 2011-05-29 05:10 -------- d-----w- c:\programdata\~smtemp
2011-05-29 05:01 . 2011-05-29 05:01 -------- d-----w- c:\programdata\KuaiKuai
2011-05-22 22:29 . 2011-05-22 22:29 -------- d-----w- c:\programdata\PC Tools
2011-05-16 20:09 . 2011-05-16 20:09 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-11 00:15 . 2011-04-09 06:02 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-05-11 00:15 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe
2011-05-11 00:15 . 2011-04-09 06:02 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-05-07 05:27 . 2011-05-07 05:27 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-07 05:27 . 2011-05-07 05:27 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-05-07 05:27 . 2011-05-07 05:27 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-05-07 05:27 . 2011-05-07 05:27 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-07 05:27 . 2011-05-07 05:27 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-07 05:27 . 2011-05-07 05:27 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-07 05:27 . 2011-05-07 05:27 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-07 05:27 . 2011-05-07 05:27 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-11 05:33 . 2011-04-12 20:09 1164288 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-11 05:33 . 2011-04-12 20:09 1137664 ----a-w- c:\windows\system32\mfc42.dll
2011-03-08 05:28 . 2011-04-12 20:08 741376 ----a-w- c:\windows\system32\inetcomm.dll
2011-05-07 05:27 . 2011-05-07 05:27 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^James^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip]
path=c:\users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip
backup=c:\windows\pss\CurseClientStartup.ccip.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-23 23:30 173592 ----a-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-23 23:30 141848 ----a-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-12-20 22:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 22:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-23 23:30 150552 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-18 00:40 1242448 ----a-w- c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files\Garena\safedrv.sys [x]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2010-05-31 6638080]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-10-21 4093392]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-31 1343400]
R3 XDva379;XDva379;c:\windows\system32\XDva379.sys [x]
R3 XDva380;XDva380;c:\windows\system32\XDva380.sys [x]
R3 XDva383;XDva383;c:\windows\system32\XDva383.sys [x]
R3 XDva384;XDva384;c:\windows\system32\XDva384.sys [x]
R3 XDva385;XDva385;c:\windows\system32\XDva385.sys [x]
R3 XDva386;XDva386;c:\windows\system32\XDva386.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-21 691696]
S3 NETwLv32; Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETwLv32.sys [2010-08-16 6637056]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2007-08-03 9344]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
.
------- 而外的扫描 -------
.
uStart Page = [You must be registered and logged in to see this link.]
IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436}
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\z4dfk4n4.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
------------------------ 其他运行进程 ------------------------
.
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
完成时间: 2011-06-02 19:21:03 - 电脑已重新启动
ComboFix-quarantined-files.txt 2011-06-02 23:21
.
Pre-Run: 180,946,677,760 bytes free
Post-Run: 180,833,189,888 bytes free
.
- - End Of File - - FE8AD9B1324AA24328B5366EAC113D3B

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 3rd June 2011, 12:18 am

This will be the last scan, if nothing shows up with Dr.Web CureIt that's related with search redirections. Then your router is at fault.

Please download to your Desktop:[You must be registered and logged in to see this link.]

  • After the file has downloaded, disable your current Anti-Virus and disconnect from the Internet
  • Doubleclick the drweb-cureit.exe file, then click the Start button, then the OK button to perform an Express Scan.
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
  • Once the short scan has finished, Click on the Complete scan radio button.
  • Then click on the Settings menu on top, the select Change Settings or press the F9 key. You can also change the Language
  • Choose the Scanning tab and I recomend leaving the Heuristic analysis enabled (this can lead to False Positives though)
  • On the File types tab ensure you select All files
  • Click on the Actions tab and set the following:

    • Objects Infected objects = Cure, Incurable objects = Move, Suspicious objects = Report
    • Infected packages Archive = Move, E-mails = Report, Containers = Move
    • Malware Adware = Move, Dialers = Move, Jokes = Move, Riskware = Move, Hacktools = Move
    • Do not change the Rename extension - default is: #??
    • Leave the default save path for Moved files here: %USERPROFILE%\DoctorWeb\Quarantine\
    • Leave prompt on Action checked

  • On the Log file tab leave the Log to file checked.
  • Leave the log file path alone: %USERPROFILE%\DoctorWeb\CureIt.log
  • Log mode = Append
  • Encoding = ANSI
  • Details Leave Names of file packers and Statistics checked.
  • Limit log file size = 2048 KB and leave the check mark on the Maximum log file size.
  • On the General tab leave the Scan Priority on High
  • Click the Apply button at the bottom, and then the OK button.
  • On the right side under the Dr Web Anti-Virus Logo you will see 3 little buttons. Click the left VCR style Start button.
  • In this mode it will scan Boot sectors of all disks, All removable media, and all local drives
  • The more files and folders you have the longer the scan will take. On large drives it can take hours to complete.
  • When the Cure option is selected, an additional context menu will open. Select the necessary action of the program, if the curing fails.
  • Click Yes to all if it asks if you want to cure/move the files.
  • This will move it to the %USERPROFILE%\DoctorWeb\Quarantine\ folder if it can't be cured. (in this case we need samples)
  • After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  • Save the report to your Desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web you saved previously to your Desktop in your next reply

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 4th June 2011, 4:20 am

Process in memory: C:\Windows\explorer.exe:1120;;BackDoor.Tdss.565;Eradicated.;
33b0ee5e-62dbe15d;C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30;Trojan.Siggen2.25270;Deleted.;

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 4th June 2011, 9:15 pm

We're going to run two batch scripts.


  • Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):

    Code:
    @echo off

    set DataDir=C:\Users\%James%\AppData\Local\Mozilla\Firefox\Profiles

    del /q /s /f "%DataDir%"
    rd /s /q "%DataDir%"

    for /d %%x in (C:\Users\%James%\AppData\Roaming\Mozilla\Firefox\Profiles\*) do del /q /s /f %%x\*sqlite
  • Once you've done that click on File and select Save As...
  • In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  • Name the file firefox.bat (the .bat extension is very important)
  • Save the file to your Desktop. It should look like this:

  • and double click it to run it.
  • A black dialog box will flash very fast. This is normal.


Next

Note: You will need to save any work before double clicking the fix.bat file because it will automatically restart your computer

  • Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):
    Code:
    @Echo on
    pushd\windows\system32\drivers\etc
    attrib -h -s -r hosts
    echo 127.0.0.1 localhost>HOSTS
    attrib +r +h +s hosts
    popd
    ipconfig /release
    ipconfig /renew
    ipconfig /flushdns
    netsh winsock reset all
    netsh int ip reset all
    shutdown -r -t 1
    del %0
  • Once you've done that click on File and select Save As...
  • In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  • Name the file fix.bat (the .bat extension is very important)
  • Save the file to your desktop and double click it to run it.
  • Once it runs it will automatically restart your computer
  • Once your computer boots again, check to see search redirections have stopped?

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 5th June 2011, 3:09 am

Yup, redirects has all stopped! It was very annoying...

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 5th June 2011, 3:45 pm

Let me know of any remaining issues with this PC?

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by zhengs on 5th June 2011, 7:47 pm

What about all the files and folders the virus brought that flooded my C: drive?

zhengs
Senior
Senior

Posts Posts : 228
Joined Joined : 2009-01-02
Gender Gender : Male
OS OS : Windows Vista
Points Points : 30485
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 5th June 2011, 11:59 pm

Those are not malware related. We talked about this already. Now for the ones with the lock on them read the below:

[You must be registered and logged in to see this link.]

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Recovery Virus!!! Help needed to remove

Post by Kenny94 on 6th June 2011, 12:00 am

Some final items:


Follow these steps to uninstall Combofix and tools used in the removal of malware

To remove all of the tools we used and the files and folders they created, please do the following:
Please download [You must be registered and logged in to see this link.] by OldTimer:

  • Save it to your Desktop.
  • Double click OTC.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Kenny94
Tech Officer
Tech Officer

Posts Posts : 2019
Joined Joined : 2010-04-22
Gender Gender : Male
OS OS : Windows 7
Protection Protection : Avira/Router and Malwarebytes
Points Points : 33531
# Likes # Likes : 0

View user profile

Back to top Go down

Page 1 of 2 1, 2  Next

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum