MalWare Removal Forum

Hi Delvin,

1. Check Hard Drive for Errors
   
   1. Open Notepad and then copy and paste the following line into Notepad (Notepad is in Start, Programs, Accessories):
      
      Code:
      cmd  /c  chkdsk  c:  |find  /v  "percent"  >> "%userprofile%\desktop\checkhd.txt"
   2. Save the NotePad file like this:
      • Click on File from the top menu bar.
      • Select Save As, use Filename: testhd.bat and Save As Type: All Files.
      • Choose Desktop as the location
      • Click Save.
   3. Right click on testhd.bat on your desktop and select Run As Administrator to run it. OK the UAC.
   4. A Command Prompt box will pop up, then close after a several minutes.
   5. Please post the contents of the checkhd.txt file from your desktop.
      If the file is very long, just copy and paste the LAST 20 or 30 lines into your reply.
   
   
2. Search Files with Farbar Service Scanner
   
   1. Right-click the FSS.exe icon on your Desktop and select Run As Administrator to run the program.
   2. Copy the contents of the following box (do not include the word "Code:") and paste it into the Search box in the Farbar Service Scanner window.
      
      Code:
      sdrsvc.dll;cryptsvc.dll
      
   3. Click the Search Files button.
   4. File FSS.txt will appear on your Desktop once the search has completed and will also be opened in a Notepad window. Please provide the contents of this log in your reply.

Please include in your reply:

1. The text of any error messages and/or a description of any problems you encountered while performing these steps.
2. The contents of the checkhd.txt log.
3. The contents of the FSS.txt log.

mambass

Hihi mambass,

2. The contents of the checkhd.txt log:

The type of the file system is NTFS.
Volume label is OS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
927 large file records processed.

0 bad file records processed.

0 EA records processed.

44 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
0 unindexed files processed.

CHKDSK is verifying security descriptors (stage 3 of 3)...
Security descriptor verification completed.
23674 data files processed.

CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
The Volume Bitmap is incorrect.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

143084539 KB total disk space.
64430832 KB in 117201 files.
80108 KB in 23675 indexes.
0 KB in bad sectors.
274903 KB in use by the system.
65536 KB occupied by the log file.
78298696 KB available on disk.

4096 bytes in each allocation unit.
35771134 total allocation units on disk.
19574674 allocation units available on disk.
_________________

3. The contents of the FSS.txt log:

Farbar Service Scanner Version: 01-03-2012
Ran by Delvin (administrator) on 14-04-2012 at 15:49:42
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)

************************************************
======== Search: "sdrsvc.dll;cryptsvc.dll" =========

C:\Windows\winsxs\x86_microsoft-windows-safedocs-main_31bf3856ad364e35_6.0.6002.22547_none_27559a9f7d2695f0\sdrsvc.dll
[2011-01-12 04:11] - [2010-12-15 02:29] - 0104960 ____A (Microsoft Corporation) BD692806BA118432C240B0E97F32A602

C:\Windows\winsxs\x86_microsoft-windows-safedocs-main_31bf3856ad364e35_6.0.6002.18353_none_26bd2ada6414af94\sdrsvc.dll
[2008-01-21 10:23] - [2008-01-21 10:23] - 0104960 ____A () C515D79B2EF26CC77838375423C1BEE6

C:\Windows\winsxs\x86_microsoft-windows-safedocs-main_31bf3856ad364e35_6.0.6002.18005_none_26f5355863ea5f18\sdrsvc.dll
[2008-01-21 10:23] - [2008-01-21 10:23] - 0104960 ____A () C515D79B2EF26CC77838375423C1BEE6

C:\Windows\winsxs\x86_microsoft-windows-safedocs-main_31bf3856ad364e35_6.0.6001.22812_none_258a97097fec6e46\sdrsvc.dll
[2011-01-12 04:11] - [2010-12-15 01:50] - 0104960 ____A (Microsoft Corporation) D3E92552721B0C0FB434C814B6C1BFC2

C:\Windows\winsxs\x86_microsoft-windows-safedocs-main_31bf3856ad364e35_6.0.6001.18561_none_24c9e68c66f8468c\sdrsvc.dll
[2008-01-21 10:23] - [2008-01-21 10:23] - 0104960 ____A () C515D79B2EF26CC77838375423C1BEE6

C:\Windows\winsxs\x86_microsoft-windows-safedocs-main_31bf3856ad364e35_6.0.6001.18000_none_2509bc4c66c893cc\sdrsvc.dll
[2008-01-21 10:23] - [2008-01-21 10:23] - 0104960 ____A () C515D79B2EF26CC77838375423C1BEE6

C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.0.6002.18005_none_77eb127097f11935\cryptsvc.dll
[2009-09-19 00:48] - [2009-04-11 14:28] - 0000000 ____A ()

C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.0.6001.18000_none_75ff99649acf4de9\cryptsvc.dll
[2008-01-21 10:24] - [2008-01-21 10:24] - 0128000 ____A (Microsoft Corporation) 6DE363F9F99334514C46AEC02D3E3678

C:\Windows\System32\cryptsvc.dll
[2009-09-19 00:48] - [2009-04-11 14:28] - 0000000 ____A ()

C:\Windows\System32\sdrsvc.dll
[2008-01-21 10:23] - [2008-01-21 10:23] - 0104960 ____A () C515D79B2EF26CC77838375423C1BEE6

====== End Of Search ======

Hi Delvin,

I apologize for the delay in getting back to you.

Please print these instructions because you will not have access to the Internet while performing some of the tasks below.

1. System File Checker:
   
   1. Click Start > All Programs > Accessories then right-click on Command Prompt and select Run As Administrator. A Command Prompt window will open.
      
   2. Copy the contents in the following box and then right-click in the Command Prompt window and select Paste from the popup menu. A scan progress window will open and the Command Prompt window will close.
      
      • Do not include the word "Code:"
      Code:
      cd c:\
      sfc /scannow
      exit
      cls
      
   3. The scan progress window will close when the scan has completed. The scan can take a while so please be patient and allow it to complete before moving on to the next task below.
      Note: There's a small chance that the utility may ask you to load your Windows operating system installation CD.
   
   
2. Reboot (restart) your computer
   
   
3. Perform a Custom Fix with OTL
   
   1. Right-click the OTL icon on your Desktop and select Run As Administrator to run the program.
   2. In the Custom Scans/Fixes box at the bottom, paste in the following lines from the Code box (Do not include the word "Code"):
      
      Code:
      :Commands
      [CREATERESTOREPOINT]
      
      
   3. Close all running applications other than OTL.
   4. Click the Run Fix button at the top.
   5. Let the program run unhindered.
   6. When the program terminates, a Notepad text file will appear.
   7. Copy the contents of that file and post it in your next reply. The log can also be found, based on the date/time it was created, as C:\_OTL\MovedFiles\MMDDYYYY_HHMMSS.log.
   
   
4. Run Farbar Service Scanner
   
   1. Right-click the FSS.exe icon on your Desktop and select Run As Administrator to run the program.
   2. Check (tick) the following boxes
      
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center/Action Center
      • Windows Update
      • Windows Defender
   3. Click the Scan button.
   4. File FSS.txt will appear on your Desktop once the scan has completed and will also be opened in a Notepad window. Please provide the contents of this log in your reply.

Please include in your reply:

1. The text of any error messages and/or a description of any problems you encountered while performing these steps.
2. The contents of the OTL Fix log.
3. The contents of the FSS.txt log.

mambass
_________________

hihi mambass,

no worries. by the way is my comp beyond hope?lol..any idea if it will get worse i.e. infect other parts of my comp?

2. The contents of the OTL Fix log:

========== COMMANDS ==========


OTL by OldTimer - Version 3.2.39.2 log created on 04192012_114312

anyway the OTL fix is almost immediate.

this took few seconds..

3. The contents of the FSS.txt log:

Farbar Service Scanner Version: 01-03-2012
Ran by Delvin (administrator) on 19-04-2012 at 11:47:52
Running from "C:\Users\Delvin\Desktop"
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.
Checking LEGACY_SDRSVC: Attention! Unable to open LEGACY_SDRSVC\0000 registry key. The key does not exist.


System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============
cryptsvc Service is not running. Checking service configuration:
The start type of cryptsvc service is OK.
The ImagePath of cryptsvc service is OK.
The ServiceDll of cryptsvc service is OK.
Checking LEGACY_cryptsvc: Attention! Unable to open LEGACY_cryptsvc\0000 registry key. The key does not exist.


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll
[2008-01-21 10:23] - [2008-01-21 10:23] - 0104960 ____A () C515D79B2EF26CC77838375423C1BEE6

C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2009-09-19 00:48] - [2009-04-11 14:28] - 0000000 ____A ()

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

Hi Delvin,

At this point I'm not seeing any malware issues but there are still a few things I'd like to check.

With respect to your initial report concerning AVG reporting rootkit activity, that would appear to be a false positive report by AVG. We were able to get accurate copies of those files and their analysis showed no infection. This has been reported as a problem in the AVG forums. Please make sure that your AVG virus definitions are up-to-date.

The issue that we're dealing with now involves problems with some of your system files. We need to determine if these represent actual file problems or disk errors.

1. Repair Hard Drive Errors
   Note: This task will require that you reboot your system. Chkdsk will then run upon reboot and you will not be able to use your computer until it has completed which may take several hours depending on a number of factors. Therefore you should only perform this task when you can afford to have your computer down for a prolonged period of time.
   
   
   1. Click Start > All Programs > Accessories then right-click on Command Prompt and select Run As Administrator. An Administrator: Command Prompt window will open.
   2. In the command window, type the command shown below and then press the Enter key. Be sure to include a space between chkdsk and /r.
      
      Code:
      chkdsk /r
   3. Type the letter Y and press the Enter key when asked if you would like to schedule this volume to be checked the next time the system restarts.
   4. Reboot (restart) your computer.
   5. Chkdsk will run when your computer is rebooting before you can log on.
   6. If possible, write down and include in your reply any messages related to errors, bad sectors detected or repairs that were performed. You can include the first 10 or so if more than 10 messages of a particular type are displayed.
   7. Allow the program to run until completion, at which point you can log in.
   
   
2. Scan file using VirusTotal
   
   1. Goto www.virustotal.com
   2. Click the Choose File button then navigate to and double-click on the following file:
      
      Code:
      C:\Windows\System32\sdrsvc.dll
      
   3. Click the Scan it! button. Your file will be uploaded and analyzed.
      
      • Note: If a message is displayed indicating that the file was already analyzed, click the Reanalyse button so that your copy of the file will be analyzed.
   4. Please wait for all the scanners to finish then copy and paste the permalink (web address) in your next response.
      Example of web address :
      
   
   
3. Perform a Custom Fix with OTL
   
   1. Right-click the OTL icon on your Desktop and select Run As Administrator to run the program.
   2. In the Custom Scans/Fixes box at the bottom, paste in the following lines from the Code box (Do not include the word "Code"):
      
      Code:
      :Commands
      [CREATERESTOREPOINT]
      
      
   3. Close all running applications other than OTL.
   4. Click the Run Fix button at the top.
   5. Let the program run unhindered.
   6. When the program terminates, a Notepad text file will appear.
   7. Copy the contents of that file and post it in your next reply. The log can also be found, based on the date/time it was created, as C:\_OTL\MovedFiles\MMDDYYYY_HHMMSS.log.
   
   
4. Run Farbar Service Scanner
   
   1. Right-click the FSS.exe icon on your Desktop and select Run As Administrator to run the program.
   2. Check (tick) the following boxes
      
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center/Action Center
      • Windows Update
      • Windows Defender
   3. Click the Scan button.
   4. File FSS.txt will appear on your Desktop once the scan has completed and will also be opened in a Notepad window. Please provide the contents of this log in your reply.

Please include in your reply:

1. The text of any error messages and/or a description of any problems you encountered while performing these steps.
2. Any information you may have concerning errors, bad sectors or repairs from chkdsk.
3. The permalink (web address) of the VirusTotal scan.
4. The contents of the OTL Fix log.
5. The contents of the FSS.txt log.

mambass

Hihi mambass,

2. Any information you may have concerning errors, bad sectors or repairs from chkdsk:
I didn't notice any, though I was not at my comp during the last part.

3. The permalink (web address) of the VirusTotal scan:
https://www.virustotal.com/file/3a81a4a ... 335040954/

4. The contents of the OTL Fix log:
========== COMMANDS ==========


OTL by OldTimer - Version 3.2.39.2 log created on 04222012_044813

5. The contents of the FSS.txt log:
Farbar Service Scanner Version: 01-03-2012
Ran by Delvin (administrator) on 22-04-2012 at 04:49:58
Running from "C:\Users\Delvin\Desktop"
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.
Checking LEGACY_SDRSVC: Attention! Unable to open LEGACY_SDRSVC\0000 registry key. The key does not exist.


System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============
cryptsvc Service is not running. Checking service configuration:
The start type of cryptsvc service is OK.
The ImagePath of cryptsvc service is OK.
The ServiceDll of cryptsvc service is OK.
Checking LEGACY_cryptsvc: Attention! Unable to open LEGACY_cryptsvc\0000 registry key. The key does not exist.


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll
[2008-01-21 10:23] - [2008-01-21 10:23] - 0104960 ____A () C515D79B2EF26CC77838375423C1BEE6

C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2009-09-19 00:48] - [2009-04-11 14:28] - 0000000 ____A ()

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

hihi mambass,

by the way from the start till now, i am still seeing the same error messages from Windows everytime i log on to my comp. and the main prob affecting me is i can't connect to the internet wireless.

Rdgs,
Delvin

Hi Delvin,

At this point I see no evidence of malware on your system. I do see that a number of system files have been corrupted. I believe that your best options at this point are to either:

1. Have the hard drive reformatted and have Vista installed from scratch using the Vista DVD, or
2. Invoke the Recovery Partition at bootup (if it has one from Dell, HP, etc.) and completely return the system to its "as purchased" state (Any "repair" install probably won't work), or
3. Seek assistance from experts who deal with Vista operating system issues. Here are some excellent Tech sites (in no particular order) that may be able to help with these problems:
   
   • Tech Support Forums
   • What the Tech
   • Tech Support Guy
   • GeekstoGo Forums
   Please feel free to refer them to this thread so that they can see what has been done so far.

Once your system has been reinstalled or repaired, the important thing then will be to actively do things that will help keep you from getting infected in the future

1. Keep Antivirus and applications updated
   This is the MOST IMPORTANT thing that you can do to keep from becoming infected.
   
   • Keep Microsoft products up-to-date with the latest security patches. Either
     
     • Enable some level of Automatic Updates
       
       • Click Start > Control Panel. The Control Panel window will be displayed.
       • Click the Windows Update entry. The Windows Update frame will be displayed.
       • Click the Change setting link in the left column of the window. The Choose how Windows can install updates frame will be displayed.
       • Select the option which best fits your needs.
     • Or click Start > All Programs > Windows Update on a regular basis and follow the instructions to install all important updates.
     
     
   • I personally use and recommend the free Secunia Personal Software Inspector (PSI). This program will keep you aware of software that is installed on your computer that contains security vulnerabilities for which security patches exist. I have mine set to automatically scan my computer weekly.
     
     
   • All updates are important but pay particular attention to updates for all browsers as well as Microsoft, Java and Adobe products. These are widely-used products that Malware writers frequently target.
   
   
2. Read and stay informed!
   
   To help minimize the chances of becoming re-infected, please read.
   Computer Security - a short guide to staying safer online
   
   If your computer is running slowly after your clean up, please read.
   What to do if your Computer is running slowly

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!


mambass

thanks mambass

You're welcome.