This thread's last reply is from August 27, 2011, 4:29 PM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
After doing a system restore, my computer fired up right away like it's supposed to. The infection is still there, but I have internet and comand prompt functions once again.
I do have the XP installation CD that came with my computer. I have reformatted in the past, but was not willing to this time due to the files I have on my computer. I have dozens of movies, tons of music, pictures ect, so I do not want to lose all of them. I've tried to save them, but when I try to burn to a CD, or plug in my flash drive, the program is immediatly terminated. If I could find a way to save all the stuff I want ( over 100GB ) I would have no problem reformatting.
After the last OTL fix we ran that caused the last problem, I am also unable to open OTL as well still, the icon was changed to a default one and I get the same 'you may not have permission' error message as with MWB.
Is there still hope that this can be fixed? Or am I just gonna have to man up and delete all of my stuff?
"Sonic324" wrote:Is there still hope that this can be fixed? Or am I just gonna have to man up and delete all of my stuff?
Yes, there is still hope The tools we have used so far may not have worked but we still have other methods we can use. Reformatting is an option but we will only do this as a last resort.
Lets check your PC for a rootkit/MBR infection.
MBRCheck
Please download MBRCheck.exe and save it to your desktop.
Double click on MBRCheck.exe to run it.
A window similar to this should open on your desktop:
If you are prompted with options, enter N at the prompt and press Enter
Press Enter again.
A log will open on your Desktop ...... MBRCheck_mm.dd.yy_hh.mm.ss.txt(where mm.dd.yy_hh.mm.ss are the date and time the scan was run)
Please post the contents of the log in your next reply.
Scan With RKUnHooker
Please Download Rootkit Unhooker Save it to your desktop.
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers, Stealth, Files, Code Hooks. Uncheck the rest. then Click OK.
Wait till the scanner has finished and then click File, Save Report.
* This can take a while. Please be patient *.
Save the report somewhere where you can find it. Click Close.
Copy the entire contents of this log in you're next reply.
This log can be lengthy you may have to post it in separate replies.
Note: You may get the following warning - it is ok - just ignore it: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?"
Here is my MBR scanner log. The Rootkit Unhooker scaned all the way through, was in the process of putting together a report, then it was terminated and now I cannot open the program again.
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000000d
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
PhysicalDrive0 Model Number: WDCWD3200AAKS-75L9A0, Rev: 01.03E01
Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
The mbrcheck came back clear. We will use a tool called Combofix against the infection. Let me know how the PC is performing once Combofix has run. Instructions below.
Download and Run ComboFix
Please download ComboFix from one of the following links.
Link 1.
Link 2.
Note: You mustrename it before saving it... Rename it: notepad See images below.
**IMPORTANT !!! Save ComboFix.exe to your Desktop**
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
I downloaded and renamed it. Upon opening it, it starts an initial scan/unzip with green lettering. Halfway through, mrtstub kills it and I cannot reopen it due to not having permission. Now I cannot even delete it from my desktop. Keeps telling me Access Denied, so now I'm perminantly stuck with it.
Lets see if we can get Combofix to work in Safe Mode.
Boot into Safe Mode
Reboot your computer in Safe Mode with Networking.
If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode with Networking option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.
Download and Run ComboFix
Please download ComboFix from one of the following links.
Link 1.
Link 2.
Note: You mustrename it before saving it... Rename it: mspaint See images below.
**IMPORTANT !!! Save ComboFix.exe to your Desktop**
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
Massive critical errors and complete system failure now. Whatever it was, my hard drive is now completly shot. I appreciate your help, but we did not get it done before it was able to do it's thing. Being as I know exactly where I got it from, do you where I might be able to report the site to prevent this thing from getting to other people?
I believe you are infected with a particularly nasty rootkit called Zeroaccess. It has many tripwires that prevent the tools we use from removing it. Because of the severity and the capabilities of this type of virus, The only responsible course of action I can advise is to is to back up your files, reformat your computer and reinstall windows.
I am sorry the news is not better, Should you have any questions please feel free to ask.
As previously stated, I cannot back anything up. Online uploads don't work, cd drive won't work, even flash drives won't work. There ate no options, as I stated in my last post, my hard drive is already fried. There is nothing that can be done now. Any ideas about the question I asked?
Google offer a malware reporting service here http://www.google.co.uk/safebrowsing/report_badware/
I am not 100% sure what they will do with the information. They will at at a minimum be able to test the site, and if anything malicious is found, be able to flag the site as malicious in search results.
No ads, no affiliate links — generated on request from this thread's own
archived content, not written by forum staff. Never run a scan/removal tool
as a self-service step if the original thread describes it being done under
a helper's direct supervision, and don't include your name, email, or other
personal details in a follow-up question. See our privacy page
for details on how this works.
The tools we have used so far may not have worked but we still have other methods we can use. Reformatting is an option but we will only do this as a last resort.
