Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Taskmanager disabled

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Taskmanager disabled

Unread postby DEFC0N » June 17th, 2007, 6:28 am

Erm ok, heres the deal, as you all know a certain new virus is out there which disables the taskmanager, regedit, msconfig and also folder options. Unfortunately, it seems to be able to track if I search for HijackThis!. I have managed to get it downloaded here into a friend's pc since its the infected one. The problem is, when running the program it automatically closes HijackThis! and also any current browsers that attempt to search or download HJT or any particular removal tools. So far the virus I have found is w32 Erkez B on the net and am in the midst of now trying to run f-secure's online scan to see if it can help. So no HJT log, truly sorry as this here pc will not let it run. Safe mode doesn't seem to be bootable also as the pc will hang if trying to enter safe mode. Need ideas here to help work this out as formatting would be the last option. No way to backup any data here on this pc.
DEFC0N
Active Member
 
Posts: 14
Joined: June 17th, 2007, 6:20 am
Advertisement
Register to Remove

Unread postby Kimberly » June 17th, 2007, 10:34 am

Hello DEFC0N,

Looks like some nasty stuff is running on the PC. I can't promise anything about reformat or not. Download the tool below, it is randomly named and has some protection against those malware that kill processes to prevent tools from running.

It's possible that your web browser will close when you get to the suspectfile site, if that's the case either let me know or download the file to another PC.

What happens if you enter Safe Mode ? Any messages or at which point does it get stuck ?


Guide : http://www.suspectfile.com/systemscan_guide.php

Download SystemScan from the link on that page, it will be a random name. Save it to your desktop, run the file. Leave all options checked except hijackthis log. It might take a while before the scan is done. The log is very huge, so upload it here please :

http://www.bleepingcomputer.com/submit- ... channel=26

It's my channel. Put a link to your topic here in the appropriate case.

Thanks. :)

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby DEFC0N » June 19th, 2007, 10:56 pm

I'll have to get back to you on this matter as the pc isn't mine, it belongs to a friend and I'm not available to make contact with him though, but I'll try to see what I can do in the mean time to help him, I'll only be able to get back to that pc next week and hopefully he doesn't have to format it by then as, I have similar cases with 3 other friends who have the same virus only, one has it in his thumb drive and pc where the pc is already undergoing a format, the 2nd has it on her thumb drive and the 3rd well she's the unfortunate victim as her laptop got it from the 2nd person's thumb drive and had to reformat it but does not have the proper drives to back up the system after reinstalling windows.
DEFC0N
Active Member
 
Posts: 14
Joined: June 17th, 2007, 6:20 am

Unread postby DEFC0N » June 20th, 2007, 10:50 pm

Ok submited the report log but I'm not sure how long his pc will hold out. One of the symptoms of this new virus or whatever it is, is that it auto minimizes your windows without warning, and it will keep doing so and gets worst over time.
DEFC0N
Active Member
 
Posts: 14
Joined: June 17th, 2007, 6:20 am

Unread postby Kimberly » June 21st, 2007, 12:47 pm

Hello,

Did you reinstall or repair on June 14 th ?

Log doesn't show much, couple of nasty files and a flash drive infector.

Let's try this, but if no Safe Mode, it's gonna be very difficult to get rid of a bot.

Copy/paste the following text into a new Notepad document. Make sure that you have one blank line at the end of the document as shown in the quoted text.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"smss"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"smss"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"


Save it to your desktop as Fixme.reg. Save it as :
File Type: All Files (not as a text document or it wont work).
Name: Fixme.reg

Do not use yet
______________________________

Download
http://www.techsupportforum.com/sectool ... fector.exe

Follow instructions on screen.
______________________________

Locate Fixme.reg on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the merged successfully prompt.
______________________________

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account..
______________________________

Note : If you can't run Safe Mode, download Download SafeBootKeyRepair
http://download.bleepingcomputer.com/sU ... Repair.exe
Save it to your desktop. Double Click to run it, and follow instruction.
______________________________

If Safeboot works, perform below :

Using Windows Explorer, Navigate to C:\Windows\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Clean out your Temporary Internet files. Proceed like this:

Quit Internet Explorer, all browsers and quit any instances of Windows Explorer.

For Internet Explorer 7
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete... under Browsing History.
  • Next to Temporary Internet Files, click Delete files, and then click OK.
  • Next to Cookies, click Delete cookies, and then click OK.
  • Next to History, click Delete history, and then click OK.
  • Click the Close button.
  • Click OK.
For Internet Explorer 4.x - 6.x
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box, and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
For Netscape 4.x and Up
  • Click Edit from the Netscape menubar.
  • Click Preferences... from the Edit menu.
  • Expand the Advanced menu by clicking the triangle sign.
  • Click Cache.
  • Click both the Clear Memory Cache and the Clear Disk Cache buttons.
For Mozilla 1.x and Up
  • Click Edit from the Mozilla menubar.
  • Click Preferences... from the Edit menu.
  • Expand the Advanced menu by clicking the plus sign.
  • Click Cache.
  • Click the Clear Cache button.
For Opera
  • Click File from the Opera menubar.
  • Click Preferences... from the File menu.
  • Click the History and Cache menu.
  • Click the two Clear buttons next to Typed in addresses and Visited addresses (history) and click the Empty now button to clear the Disk cache.
  • Click Ok to close the Preferences menu.
Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then click Empty Recycle Bin.
______________________________

Using Windows Explorer, Search and Delete these Folders if listed:

C:\WINDOWS\system32\idjaajfgh

Using Windows Explorer, Search and Delete these Files if listed:

C:\WINDOWS\system32\RVHIOST.exe
C:\WINDOWS\system32\nhatquanglan5.exe
C:\WINDOWS\system32\ff_vfw.dll
______________________________

  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons loaded, the SDFix report will open on screen and will also be saved into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log.
Reboot in Normal Mode.

Try Hijackthis and give me a new SystemScan report too please. Let me know how everything went, especially if you could boot into Safe Mode. If not, we will have to delete the files differently.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby NonSuch » June 29th, 2007, 6:56 pm

This topic is now closed due to inactivity. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 27230
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 27 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware