WiredWX Hobby Weather ToolsLog in

 


Help please with a virus

3 posters

descriptionHelp please with a virus EmptyHelp please with a virus

more_horiz
Hello. I'm new to this website. I've been having problems with this virus for quite some time. It causes the computer to run slower than normal and causes it to freeze frequently. A virus detected bubble always pops up in the corner on the taskbar at the bottom right of my computer screen. Also, it redirects the browser when I click on websites found by Google and doesn't allow for me to download any anti-spyware. If I can download it somehow, the spyware won't run. Please help if you can! Thank you!




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:52:05 PM, on 12/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brastk.exe
C:\Documents and Settings\Danny Y\lsass.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Danny Y\Desktop\hijackgpthis.exe
C:\WINDOWS\system32\notepad.exe

R3 - URLSearchHook: (no name) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [brastk] brastk.exe
O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\Danny Y\lsass.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\RunOnce: [tdss] C:\WINDOWS\TEMP\15848000.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-18\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'Default user')
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\karna.dat
O21 - SSODL: Wizfmmp - {50F823A6-FA52-890C-9518-8A2C721214A5} - C:\WINDOWS\system32\jip.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 4321 bytes

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Hello.


  • Open Hijack This.
  • Press "Do a system scan only"
  • Check the boxes infront of these lines.

    R3 - URLSearchHook: (no name) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - (no file)
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O4 - HKLM\..\Run: [brastk] brastk.exe
    O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\Danny Y\lsass.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\RunOnce: [tdss] C:\WINDOWS\TEMP\15848000.exe
    O4 - HKUS\S-1-5-18\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'Default user')
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O20 - AppInit_DLLs: C:\WINDOWS\system32\karna.dat
    O21 - SSODL: Wizfmmp - {50F823A6-FA52-890C-9518-8A2C721214A5} - C:\WINDOWS\system32\jip.dll
    O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

  • Press "Fix Checked"
  • Close Hijack This.



1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE.

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):


Files to delete:
C:\Documents and Settings\Danny Y\lsass.exe
C:\WINDOWS\system32\karna.dat
C:\WINDOWS\system32\jip.dll
C:\WINDOWS\TEMP\15848000.exe
C:\WINDOWS\system32\brastk.exe


Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Hello. I've deleted the items in Hijackthis but i cannot download The Avenger through the given link. When i click it it says failed to connect. sorry about the edit.

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Hello.
Download from here:
http://www.sendspace.com/file/vydi5g

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "TDSSserv.sys" found!
ImagePath: \systemroot\system32\drivers\TDSSpqlt.sys
Driver disabled successfully.

Rootkit scan completed.

File "C:\Documents and Settings\Danny Y\lsass.exe" deleted successfully.
File "C:\WINDOWS\system32\karna.dat" deleted successfully.
File "C:\WINDOWS\system32\jip.dll" deleted successfully.
File "C:\WINDOWS\TEMP\15848000.exe" deleted successfully.
File "C:\WINDOWS\system32\brastk.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


Thank you so much!

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Hello.
The rootkit has been disabled.


  • Download combofix from here, use the top links - combofix.exe
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.

    Help please with a virus Rcauto10

  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes

    Help please with a virus Whatne10

  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Hello. After using combo fix, my computer is stuck at a black screen and I can't see any icons or the taskbar. I'm using another computer to post right now.

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
It refuses to boot?
Darn. Sad tearing

Does it say why? like a file missing or something?

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
It doesn't say anything at all Sad tearing . After it loads the welcome screen it takes me to a black screen that's empty except for the mouse.

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Ah.
So it does boot, we might be able to do something.
Press alt + ctrl + del twice to open the Task Manager.

Press the "Applications" tab and press the "New Task..." button at the bottom of the window.
Type in "explorer" and press "Okay"

Does your icons and other stuff load now?

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Ok. I will try that immediately when I get to my computer. I had to resort to going to a friend's house to use his computer. Sad tearing

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Sorry about that, but I wasn't expecting this neither.
We disabled the big problem with no damage, but removing leftovers does this? Shocking Whoa

If it's not explorer, it maybe something else.

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Good evening. So I've tried ctrl + alt + del and and new task but it says explorer.exe cannot be found. Any suggestions? Indifferent or Blank

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
Explorer.exe may have been trashed when CF was run.
Open the Task Manager again.
Look on the "processes" tab this time, locate explorer.exe and kill it.
Now go back to the "Applications tab" and try loading explorer again.

If that doesn't work
Start another new task, but this time, type this in:
sfc /scannow <== note the space between the c and /
Press okay.

Allow the system file protection to scan and it might replace a missing explorer.exe
Once it's done, reboot and try again.

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
I've tried the new task but it only shows the scan window briefly before it disappears. I don't think it has scanned the computer.

descriptionHelp please with a virus EmptyRe: Help please with a virus

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum