malware bytes malicious website blocking disabled

[atldude]

Thanks. When running aswMBR my system crashed with the deadly blue screen and rebooted. I booted it up in Safe Mode. Should I re-run the aswMBR again?

[MrCharlie]

Yes please....MrC

[atldude]

Please find attached the log. Please advise of next steps.

aswMBR.txt

[MrCharlie]

That was clean.

We have to get ComboFix to run.

Try it like this......

Delete your copy of ComboFix. Grab a fresh copy and save it to your Desktop, but do not run it yet.

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Click Start --> Run, and enter this command exactly as shown: (copy and paste)

"%userprofile%\desktop\combofix.exe" /killall

See if it will run successfully now. MrC

[atldude]

Scanning for infected files..... has been running for little over an hour in Safe mode option. Should I let it continue?

[MrCharlie]

If you can give it another half hour and then cancel > MrC

[atldude]

Okay. I went ahead and cancelled the scan. What do you think is causing us not to successfully complete the scan? Please advise of next steps.

[MrCharlie]

Okay. I went ahead and cancelled the scan. What do you think is causing us not to successfully complete the scan? Please advise of next steps.

The infection can cause it.

Let me think about what the next step will be , MrC

[atldude]

Okay. I will wait for your guidance.

[MrCharlie]

Just for "kicks", delete your copy TDSSKiller and download a fresh one and run it like this:

Please read the directions carefully so you don't end up deleting something that is good!!

Please download and run TDSSKiller to your desktop as outlined below:

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

-------------------------

Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

------------------------

Click the Start Scan button.

-----------------------

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

----------------------

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

--------------------

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

--------------------

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

-------------------

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

MrC

[atldude]

Please find attached the requested log.

TDSSKiller.2.8.10.0_28.09.2012_08.51.48_log.txt

[MrCharlie]

That scan was clean...please do this:

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
  
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  
• Use the arrow keys to select the Repair your computer menu item.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account an click Next.
  

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
  
• Restart your computer.
  
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  
• Click Repair your computer.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account and click Next.
  

On the System Recovery Options menu you will get the following options:

• 
  
• Select Command Prompt
  
• In the command window type in notepad and press Enter.
  
• The notepad opens. Under File menu select Open.
  
• Select "Computer" and find your flash drive letter and close the notepad.
  
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
  
• The tool will start to run.
  
• When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:
  services.exe
  
• Now press the Search button
  
• When the search is complete, search.txt will also be written to your USB
  
• Type exit and reboot the computer normally
  
• Please copy and paste both logs in your reply.(FRST.txt and Search.txt)
  

MrC

[atldude]

Please find attached the logs.

FRST.txt

Search.txt

[MrCharlie]

Nothing showing there >>>>>>

Download and run Yorkyt.exe, it will reboot the computer.

Let me know, MrC

[atldude]

It says it detected some bad files and rebooted to cleanup. The last message I received after reboot is 'Cleanup Complete'

[MrCharlie]

Good > Run another DDS scan and we'll see if that file is still showing in the log, MrC

[atldude]

Please advise of next steps.

[MrCharlie]

Post above yours, MrC

[atldude]

Please find attached the logs.

Attach.txt

DDS.txt

[atldude]

It appears that all this malware scans and cleanup has affected my Windows update feature. When I do windows update, I receive the error code 80096001. Search for updates, searches for about two seconds and then receives this error code. Please advise how do I fix this.

[MrCharlie]

Still there, run this one (ESETSirfefEVCleaner tool) and pay attention as it runs and see if it finds anything:

http://kb.eset.com/esetkb/index?page=content&id=SOLN2895

MrC

[atldude]

I followed the steps as indicated in the link, but I do not see the icon nor ESET in Start Programs like below:

Open the main program window by double-clicking the ESET icon in your Windows notification area or by clicking Start All Programs ESET ESET Smart Security or ESET NOD32 Antivirus.

Please advise.

[MrCharlie]

I just wanted you to do steps 1 and 2.

Did you run the ESETSirfefEVCleaner tool?

MrC

[atldude]

Yes, I did. I have completed Part 1 and 2.

[MrCharlie]

Did you remember if it found anything?? MrC