Ransom Virus removed but can't boot up

[SoDawg81]

I am unable to run any scans or get logs, screen shots because although the 'ransom screen' is gone, I am still locked out of system... just have a black screen now

 

[kuttus]

Hi and welcome to the malwaretips.com forums!

I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:

• I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine!
• The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Refrain from running self fixes as this will hinder the malware removal process.
• It may prove beneficial if you print of the following instructions or save them to notepad as I post them.

Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.
<hr />

Please open the Task Manager once again and inside the Task Manger you can see a File Menu. Click on File--> New Task (Run..) Now you will get a Create New Task Window. Inside that Type EXPLORER.EXE and press on Ok. Now you can see your Desktop back.. After that Follow the Steps below.

<hr />


You should be able to run both scans while in Normal mode...
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chamelon mode

<ol>
<li>Download <>Malwarebytes Chameleon from <a title="External link" href="http://downloads.malwarebytes.org/file/chameleon" rel="nofollow external">here</a> </>and extract it to a folder in a convenient location</li>
<li>Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.</li>
<li>If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window <em><>Note:</> Do not attempt to open <>mbam-killer</> as that is not a Chameleon executable and serves a different purpose)</em></li>
<li>Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for yo</li>
<li>Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click <>OK</> when it says that the database was updated successful</li>
<li>Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan</li>
<li>Upon completion of the scan, if anything has been detected, click on <>Show Result</></li>
<li>Have Malwarebytes Anti-Malware remove any threats that are detected and click <>Yes</> if prompted to reboot your computer to allow the removal process to complete</li>
<li>After your computer restarts, open <>Malwarebytes Anti-Malware</> and perform a Full System scan to verify that there are no remaining threats</li>
Please add both logs in your next reply.
</ol>

<hr />

STEP 2: Run a scan with OTL by OldTimer
<ol><li>Download the OTL utility using the below link :
<><a title="External link" href="http://oldtimer.geekstogo.com/OTL.exe" rel="nofollow external">OTL DOWNLOAD LINK</a> <em>(This link will automatically download OTL on your computer)</em></></li>
<li>Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL-logo.png" alt="" title="OTL-logo" width="106" height="118" class="alignnone size-full wp-image-3946" /></li>
<li>When the window appears, <>underneath Output</> at the top change it to <>Minimal Output</>.</li>
<li>Check the boxes beside <>LOP Check</> and <>Purity Check</>.</li>
<li>Click the<> Run Scan</> button.
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL.png" alt="" title="OTL" width="658" height="584" class="alignnone size-full wp-image-3945" /></li>
<li>When the scan completes, it will open two notepad windows. <>OTL.Txt</> and <>Extras.Txt</>. These are saved in the same location as OTL.
<>Please post this 2 logs in your first reply.</>.</li></ol>

Settings You need to Select in OTL

1. Click the Scan All Users checkbox.
2. Change Standard Registry to All.
3. Check the boxes beside LOP Check and Purity Check.

<em>Note: If OTL.exe will not run, it may be blocked by malware. Try these alternate versions: <a title="External link" href="http://www.itxassociates.com/OT-Tools/OTL.scr" rel="nofollow external">OTL.scr</a>, or <a title="External link" href="http://oldtimer.geekstogo.com/OTL.com" rel="nofollow external">OTL.com</a>.</em>

<hr />

What's next?

Add the following logs to your next post (You can find here details on how to use the Attachment System):
1. OTL Log
2. Malwarebytes Anti-Malware log
3. Let me know if you had any problems with the above instructions and also <>let me know how things are running now!</>

<hr />

 

[SoDawg81]

Thanks for the quick response and great help.

First of all, I was able to run 'explorer.exe' from the task manager. This did NOT bring up my desktop, but did bring up the explorer window. From there I went to Desktop and then to IE to get to web. I input the address from your link for Malwarebytes Chameleon and got the download and unzipped. I did not see a 'help' file per se, but I did click on a file.. "Chameleon.chm" wich was a html file and that opened I Malwarebytes Chameleon window. Basically it said to click on the buttons one at a time to attempt to run chameleon. I clicked on all 12 buttons and they all came back and said 'tested', but did not open a dos window as it said 'if it worked'. I then went back to the zip file and just clicked on "mbam-chameleon.exe". This DID open a dos window and began running. It updated Malwarebytes as normal, then it said..."killing known malicious processes, please wait"... This lasted a LONG time, and now it just said "done' and now it is running Malwarebytes scan (I thought I was stuck when I started writing this)...

OK... so Malwarebytes found an object, and I removed it, and saved the logs per your instructions. I will attach logs. I hit reboot to finish removing items and I am back to a black/locked screen again. This time I did not get the rundll error re: the virus file I had deleted, so that .bat file is gone, but it looks like I still have something locking up the screen. I can get to 'explorer.exe' and that is where I am? Should I try to run chameleon again or ?

Logs:

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Database version: v2013.01.11.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Greg Henning :: DESKTOP [administrator]

1/11/2013 11:20:52 AM
mbam-log-2013-01-11 (11-20-52).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 232900
Time elapsed: 13 minute(s), 35 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Exploit.Drop.GSA) -> Bad: (C:\PROGRA~3\dsgsdgdsgdsgw.bat) Good: () -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\$Recycle.Bin\S-1-5-21-3334729812-3173734214-3854604701-1003\$RL8MD2Z.exe (Adware.HotBar) -> Quarantined and deleted successfully.
C:\ProgramData\dsgsdgdsgdsgw.bat (Exploit.Drop.GSA) -> Quarantined and deleted successfully.
C:\ProgramData\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> Quarantined and deleted successfully.
C:\ProgramData\dsgsdgdsgdsgw.reg (Exploit.Drop.GSA) -> Quarantined and deleted successfully.

(end)

LOg2
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Database version: v2013.01.11.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Greg Henning :: DESKTOP [administrator]

1/11/2013 11:20:52 AM
mbam-log-2013-01-11 (11-34-55).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 232900
Time elapsed: 13 minute(s), 35 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Exploit.Drop.GSA) -> Bad: (C:\PROGRA~3\dsgsdgdsgdsgw.bat) Good: () -> No action taken.

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\$Recycle.Bin\S-1-5-21-3334729812-3173734214-3854604701-1003\$RL8MD2Z.exe (Adware.HotBar) -> No action taken.
C:\ProgramData\dsgsdgdsgdsgw.bat (Exploit.Drop.GSA) -> No action taken.
C:\ProgramData\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> No action taken.
C:\ProgramData\dsgsdgdsgdsgw.reg (Exploit.Drop.GSA) -> No action taken.

(end)


Greg

thanks

Hi and welcome to the malwaretips.com forums!

I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:

• I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine!
• The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Refrain from running self fixes as this will hinder the malware removal process.
• It may prove beneficial if you print of the following instructions or save them to notepad as I post them.

Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.
<hr />

Please open the Task Manager once again and inside the Task Manger you can see a File Menu. Click on File--> New Task (Run..) Now you will get a Create New Task Window. Inside that Type EXPLORER.EXE and press on Ok. Now you can see your Desktop back.. After that Follow the Steps below.

<hr />


You should be able to run both scans while in Normal mode...
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chamelon mode

<ol>
<li>Download <>Malwarebytes Chameleon from <a title="External link" href="http://downloads.malwarebytes.org/file/chameleon" rel="nofollow external">here</a> </>and extract it to a folder in a convenient location</li>
<li>Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.</li>
<li>If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window <em><>Note:</> Do not attempt to open <>mbam-killer</> as that is not a Chameleon executable and serves a different purpose)</em></li>
<li>Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for yo</li>
<li>Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click <>OK</> when it says that the database was updated successful</li>
<li>Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan</li>
<li>Upon completion of the scan, if anything has been detected, click on <>Show Result</></li>
<li>Have Malwarebytes Anti-Malware remove any threats that are detected and click <>Yes</> if prompted to reboot your computer to allow the removal process to complete</li>
<li>After your computer restarts, open <>Malwarebytes Anti-Malware</> and perform a Full System scan to verify that there are no remaining threats</li>
Please add both logs in your next reply.
</ol>

<hr />

STEP 2: Run a scan with OTL by OldTimer
<ol><li>Download the OTL utility using the below link :
<><a title="External link" href="http://oldtimer.geekstogo.com/OTL.exe" rel="nofollow external">OTL DOWNLOAD LINK</a> <em>(This link will automatically download OTL on your computer)</em></></li>
<li>Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL-logo.png" alt="" title="OTL-logo" width="106" height="118" class="alignnone size-full wp-image-3946" /></li>
<li>When the window appears, <>underneath Output</> at the top change it to <>Minimal Output</>.</li>
<li>Check the boxes beside <>LOP Check</> and <>Purity Check</>.</li>
<li>Click the<> Run Scan</> button.
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL.png" alt="" title="OTL" width="658" height="584" class="alignnone size-full wp-image-3945" /></li>
<li>When the scan completes, it will open two notepad windows. <>OTL.Txt</> and <>Extras.Txt</>. These are saved in the same location as OTL.
<>Please post this 2 logs in your first reply.</>.</li></ol>

Settings You need to Select in OTL

1. Click the Scan All Users checkbox.
2. Change Standard Registry to All.
3. Check the boxes beside LOP Check and Purity Check.

<em>Note: If OTL.exe will not run, it may be blocked by malware. Try these alternate versions: <a title="External link" href="http://www.itxassociates.com/OT-Tools/OTL.scr" rel="nofollow external">OTL.scr</a>, or <a title="External link" href="http://oldtimer.geekstogo.com/OTL.com" rel="nofollow external">OTL.com</a>.</em>

<hr />

What's next?

Add the following logs to your next post (You can find here details on how to use the Attachment System):
1. OTL Log
2. Malwarebytes Anti-Malware log
3. Let me know if you had any problems with the above instructions and also <>let me know how things are running now!</>

<hr />

 

[kuttus]

Hi,

Please run the OTL Tool that I Given in Step 2 and Update me the Logfiles....

 

[SoDawg81]

OK...
I was able to re-run Malwarebytes, and also downloaded and ran OLT... Logs are below.

Note...looks like desktop is still locked... only get black screen, OLT doesn't say it found anything -- at least I don't see an obvious thing like MWB displays?

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.01.11.11

Windows 7 Service Pack 1 x64 FAT32
Internet Explorer 9.0.8112.16421
Greg Henning :: DESKTOP [administrator]

1/11/2013 11:53:36 AM
MBAM-log-2013-01-11 (14-52-44).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 679833
Time elapsed: 2 hour(s), 42 minute(s), 17 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Greg Henning\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3f65908c-422de967 (Trojan.FakeMS) -> No action taken.

(end)
------

OTL log attached

 

[kuttus]

Hi,

How comfortable you are with Editing Registry? Do you ever done that before?

Please follow the following steps and upload me the log files....

STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL

:Files
C:\Users\Greg Henning\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3f65908c-422de967
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

:Commands
[EmptyTemp]
[EmptyFlash]
[EmptyJava]
[Reboot]

<>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>

<hr />

STEP 2: Clean your temporary files to gain more hard drive space and

remove the junk files
<ol>
<li>Download Ccleaner from the below link:
CCLEANER DOWNLOAD

LINK</a> <em>(This link will automatically download Ccleaner on your

computer)</em></li>
<li>Install Ccleaner by following the prompts</li>
<li>Start Ccleaner and the following should be selected by default, if not,

please select:
<img src="http://i52.tinypic.com/4l5a4i.png" alt="Posted Image" /></li>
<li>Click <img src="http://i56.tinypic.com/16jox2o.png" alt="Posted Image" />

and choose <img src="http://i40.tinypic.com/5x3nu8.gif" alt="Posted Image" /></li>
<li>Uncheck <img src="http://i51.tinypic.com/amuvj8.gif" alt="Posted Image"

/></li>
<li>Then go back to <img src="http://i41.tinypic.com/2jb4qyb.gif" alt="Posted

Image" /> and click <img src="http://i25.tinypic.com/nf47ev.gif" alt="Posted Image" />

to run it.</li>
<li>Exit CCleaner.</li>
</ol>

---

 

[SoDawg81]

I have done a little regedit before... I am in the computer business... worked for a HD mfg for many years... not an expert, but not totally uncomfortable.

FYI...the version of 'ccleaner' looks a little different... options not all the same:

Here is the OTL logfile - attached

Hi,

How comfortable you are with Editing Registry? Do you ever done that before?

Please follow the following steps and upload me the log files....

STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL

:Files
C:\Users\Greg Henning\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3f65908c-422de967
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

:Commands
[EmptyTemp]
[EmptyFlash]
[EmptyJava]
[Reboot]

<>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>

<hr />

STEP 2: Clean your temporary files to gain more hard drive space and

remove the junk files
<ol>
<li>Download Ccleaner from the below link:
CCLEANER DOWNLOAD

LINK</a> <em>(This link will automatically download Ccleaner on your

computer)</em></li>
<li>Install Ccleaner by following the prompts</li>
<li>Start Ccleaner and the following should be selected by default, if not,

please select:
<img src="http://i52.tinypic.com/4l5a4i.png" alt="Posted Image" /></li>
<li>Click <img src="http://i56.tinypic.com/16jox2o.png" alt="Posted Image" />

and choose <img src="http://i40.tinypic.com/5x3nu8.gif" alt="Posted Image" /></li>
<li>Uncheck <img src="http://i51.tinypic.com/amuvj8.gif" alt="Posted Image"

/></li>
<li>Then go back to <img src="http://i41.tinypic.com/2jb4qyb.gif" alt="Posted

Image" /> and click <img src="http://i25.tinypic.com/nf47ev.gif" alt="Posted Image" />

to run it.</li>
<li>Exit CCleaner.</li>
</ol>

---

---

 

[kuttus]

Here is the OTL logfile - attached

No attachments in the last replay..

 

[SoDawg81]

For some reason it is not attaching... log below:

All processes killed
Error: Unable to interpret <Code:> in the current context!
Error: Unable to interpret < > in the current context!
========== FILES ==========
File\Folder C:\Users\Greg Henning\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3f65908c-422de967 not found.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\x64 folder moved successfully.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64 folder moved successfully.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Greg Henning
->Temp folder emptied: 3232171683 bytes
->Temporary Internet Files folder emptied: 1926473823 bytes
->Java cache emptied: 2386220 bytes
->Google Chrome cache emptied: 430018241 bytes
->Flash cache emptied: 1748 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2830681093 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 556 bytes
RecycleBin emptied: 238389115 bytes

Total Files Cleaned = 8,259.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Greg Henning
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Greg Henning
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 01132013_092832

Files\Folders moved on Reboot...
File\Folder C:\Users\Greg Henning\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\XCOS4AP1\_WIPLDYoIWcfVXxvZu9XwJ55OX7Ag,0mB7r3D7VybCAZUiyO88JrpsjzIsHjrU9dS8tncHseVYek7vpJ4g8FSookt3rzAW88plO7mlBw3tABQ6g34hMnliRGPsQbRjFpvpspmUfe1Q8zsf1XnPFQe2pdPl1rK0uFa_gw[1].gif not found!
C:\Users\Greg Henning\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
File\Folder C:\Users\Greg Henning\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T1PYCODU\Thread-Ransom-Virus-removed-but-can-t-boot-up[1].htm not found!
File\Folder C:\Users\Greg Henning\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DRSDEJ5W\tweet_button.1357735024[1].htm not found!
File\Folder C:\Users\Greg Henning\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6BH5BFPJ\fastbutton[1].htm not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Here is the OTL logfile - attached

No attachments in the last replay..

 

[kuttus]

Okay. Now please do one thing Open your Windows Registry. Top Open Registry Press on Windows Key and R Key Together on your keyboard. Now you will get a Run Window. Inside that Run window type REGEDIT and press on Ok.

After that go to the location

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

In the Right Side you can see one value called Shell. Check if you are able to see Explorer.exe there? If Explorer.exe is not there add Explorer.exe. if you found any other values there in Shell delete it and add Explorer.exe.

http://123pcworld.com/MalwareTips/Fix.PNG

Please back up your Windows Registry before you proceed editing.

For that Click on File --> Export and save the Registry To the C drive with a Name REGBKP.

Make Sure you Selected All in the Back up Range...
http://123pcworld.com/MalwareTips/regbkp.PNG

 

[SoDawg81]

Ok...

The 'Windows Key and R' didn't work, but I ran regedit from the task manager option, backed up reg and then made change. I rebooted and I have my desktop back.

However, I have a dos window popping up running some type of .bat file still. Screen shot won't attach - too big.

Basically it says

C:\Windows/SysWOW64>"c:\users\Greg Henning\AppData\local\google\chrome\user data\default\extensions\b.bat"

This pops up for a while and then dissappears. Looks like it is opening random websites when I am in internet?

Thanks for your help btw.

Okay. Now please do one thing Open your Windows Registry. Top Open Registry Press on Windows Key and R Key Together on your keyboard. Now you will get a Run Window. Inside that Run window type REGEDIT and press on Ok.

After that go to the location

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

In the Right Side you can see one value called Shell. Check if you are able to see Explorer.exe there? If Explorer.exe is not there add Explorer.exe. if you found any other values there in Shell delete it and add Explorer.exe.

http://123pcworld.com/MalwareTips/Fix.PNG

Please back up your Windows Registry before you proceed editing.

For that Click on File --> Export and save the Registry To the C drive with a Name REGBKP.

Make Sure you Selected All in the Back up Range...
http://123pcworld.com/MalwareTips/regbkp.PNG

 

[kuttus]

It is great to hear that you got your desktop back.. :biggrin:

Now please try the following 3 steps also..

STEP 1: Run a scan with AdwCleaner

<ol><li>Download AdwCleaner from the below link.
<><a href="http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner" target="_blank">ADWCLEANER DOWNLAOD LINK</a></> (This link will automatically download Security Check on your computer)</li>

<li>Close all open programs and internet browsers.</li>
<li>Double click on <>adwcleaner.exe</> to run the tool.</li>
<li>Click on <>Delete</>,then confirm each time with <>Ok</>.</li>
<li>Your computer will be rebooted automatically. A text file will open after the restart.</li>
<li>Please post the contents of that logfile with your next reply.</li>
<li>You can find the logfile at <>C:\AdwCleaner[S1].txt</> as well.</li>
</ol>
<hr/>

STEP 2: Run Temp File Cleaner by OldTimer
<ol>
<li>You can download the TFC utility from the below link
<a title="External link" href="http://oldtimer.geekstogo.com/TFC.exe" rel="nofollow external"><>TFC DOWNLOAD LINK</></a> <em>(This link will automatically download Temp File Cleaner on your computer)</em></li>
<li>Please double-click <>TFC.exe</> to run it. (<>Note:</> If you are running on Vista or 7, right-click on the file and choose <>Run As Administrator</>).</li>
<li>It <>will close all programs</> when run, so make sure you have <>saved all your work</> before you begin.</li>
<li>Click the <>Start</> button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. <>Let it run uninterrupted to completion</>.</li>
<li>Once it's finished it should <>reboot your machine</>. If it does not, please <>manually reboot the machine</> yourself to ensure a complete clean.</li>
</ol>
<hr />

STEP 3 : Run a scan with Kaspersky TDSSKiller
<ol>
<li>Download Kaspersky TDSKiller from the below link.
<><a title="External link" href="http://support.kaspersky.com/downloads/utils/tdsskiller.exe" rel="external">KASPERKSY TDSSKILLER DOWNLOAD LINK</a></> <em>(This link will automatically download Kaspersky TDSSKiller on your computer)</em>
</li>
<li>Double-click on <>TDSSKiller.exe</> to run the application.
<img src="http://img4.imageshack.us/img4/1907/tdss1.png" alt="Posted Image" /></li>
<li>Click <>Change parameters</>
<img src="http://img593.imageshack.us/img593/288/tdss2.png" alt="Posted Image" /></li>
<li>Check the boxes next to <>Verify Driver Digital Signature</> and <>Detect TDLFS file system</>, then click <>OK</>
<img src="http://img521.imageshack.us/img521/1456/tdss3.png" alt="Posted Image" /></li>
<li>Click on the <>Start Scan</> button to begin the scan and wait for it to finish.
<>NOTE:</> Do not use the computer during the scan!</li>
<li>During the scan it will look similar to the image below:
<img src="http://img6.imageshack.us/img6/9136/tdss4.jpg" alt="Posted Image" /></li>
<li>When it finishes, you will either see a report that no threats were found like below:
<img src="http://img696.imageshack.us/img696/9898/tdss5.jpg" alt="Posted Image" />
If no threats are found at this point, just click the <>Report</> selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved.</li>
<li>If any infection or suspected items are found, you will see a window similar to below:
<img src="http://img854.imageshack.us/img854/905/tdss7.jpg" alt="Posted Image" />
<ul>
<li>If you have files that are shown to fail <em>signature check</em> do not take any action on these. Make sure you select <>Skip</>. I will tell you what to do with these later. They may not be issues at all.</li>
<li>If <em>Suspicious objects</em> are detected, the default action will be Skip. Leave the default set to Skip.</li>
<li>If <em>Malicious objects</em> are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects
Make sure that <>Cure</> is selected. <>VERY IMPORTANT!</> - If <em>Cure</em> is not available, please choose <>Skip</> instead. DO NOT choose Delete unless instructed to do so.</li>
</ul>
</li>
<li>Click <>Continue</> to apply selected actions.</li>
<li>A reboot may be required to complete disinfection. A window like the below will appear:
<img src="http://img828.imageshack.us/img828/4812/tdss6.jpg" alt="Posted Image" />
Reboot immediately if TDSSKiller states that one is needed.</li>
<li>Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like <>TDSSKiller.2.1.1_2.12.2012_14.17.04_log.txt</> which is based on the program version # and date and time run.</li>
<li>Attach this log to your next reply.</li>
</ol>
<hr />

 

[SoDawg81]

Okay...

Followed instructions, log files of 2 programs attached. NOTE that the Kasperesky program found 5 threats but they were all 'unsigned' so i skipped.

On reboot each time, the dos window with the bat file still comes up...

thanks

It is great to hear that you got your desktop back.. :biggrin:

Now please try the following 3 steps also..

STEP 1: Run a scan with AdwCleaner

<ol><li>Download AdwCleaner from the below link.
<><a href="http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner" target="_blank">ADWCLEANER DOWNLAOD LINK</a></> (This link will automatically download Security Check on your computer)</li>

<li>Close all open programs and internet browsers.</li>
<li>Double click on <>adwcleaner.exe</> to run the tool.</li>
<li>Click on <>Delete</>,then confirm each time with <>Ok</>.</li>
<li>Your computer will be rebooted automatically. A text file will open after the restart.</li>
<li>Please post the contents of that logfile with your next reply.</li>
<li>You can find the logfile at <>C:\AdwCleaner[S1].txt</> as well.</li>
</ol>
<hr/>

STEP 2: Run Temp File Cleaner by OldTimer
<ol>
<li>You can download the TFC utility from the below link
<a title="External link" href="http://oldtimer.geekstogo.com/TFC.exe" rel="nofollow external"><>TFC DOWNLOAD LINK</></a> <em>(This link will automatically download Temp File Cleaner on your computer)</em></li>
<li>Please double-click <>TFC.exe</> to run it. (<>Note:</> If you are running on Vista or 7, right-click on the file and choose <>Run As Administrator</>).</li>
<li>It <>will close all programs</> when run, so make sure you have <>saved all your work</> before you begin.</li>
<li>Click the <>Start</> button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. <>Let it run uninterrupted to completion</>.</li>
<li>Once it's finished it should <>reboot your machine</>. If it does not, please <>manually reboot the machine</> yourself to ensure a complete clean.</li>
</ol>
<hr />

STEP 3 : Run a scan with Kaspersky TDSSKiller
<ol>
<li>Download Kaspersky TDSKiller from the below link.
<><a title="External link" href="http://support.kaspersky.com/downloads/utils/tdsskiller.exe" rel="external">KASPERKSY TDSSKILLER DOWNLOAD LINK</a></> <em>(This link will automatically download Kaspersky TDSSKiller on your computer)</em>
</li>
<li>Double-click on <>TDSSKiller.exe</> to run the application.
<img src="http://img4.imageshack.us/img4/1907/tdss1.png" alt="Posted Image" /></li>
<li>Click <>Change parameters</>
<img src="http://img593.imageshack.us/img593/288/tdss2.png" alt="Posted Image" /></li>
<li>Check the boxes next to <>Verify Driver Digital Signature</> and <>Detect TDLFS file system</>, then click <>OK</>
<img src="http://img521.imageshack.us/img521/1456/tdss3.png" alt="Posted Image" /></li>
<li>Click on the <>Start Scan</> button to begin the scan and wait for it to finish.
<>NOTE:</> Do not use the computer during the scan!</li>
<li>During the scan it will look similar to the image below:
<img src="http://img6.imageshack.us/img6/9136/tdss4.jpg" alt="Posted Image" /></li>
<li>When it finishes, you will either see a report that no threats were found like below:
<img src="http://img696.imageshack.us/img696/9898/tdss5.jpg" alt="Posted Image" />
If no threats are found at this point, just click the <>Report</> selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved.</li>
<li>If any infection or suspected items are found, you will see a window similar to below:
<img src="http://img854.imageshack.us/img854/905/tdss7.jpg" alt="Posted Image" />
<ul>
<li>If you have files that are shown to fail <em>signature check</em> do not take any action on these. Make sure you select <>Skip</>. I will tell you what to do with these later. They may not be issues at all.</li>
<li>If <em>Suspicious objects</em> are detected, the default action will be Skip. Leave the default set to Skip.</li>
<li>If <em>Malicious objects</em> are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects
Make sure that <>Cure</> is selected. <>VERY IMPORTANT!</> - If <em>Cure</em> is not available, please choose <>Skip</> instead. DO NOT choose Delete unless instructed to do so.</li>
</ul>
</li>
<li>Click <>Continue</> to apply selected actions.</li>
<li>A reboot may be required to complete disinfection. A window like the below will appear:
<img src="http://img828.imageshack.us/img828/4812/tdss6.jpg" alt="Posted Image" />
Reboot immediately if TDSSKiller states that one is needed.</li>
<li>Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like <>TDSSKiller.2.1.1_2.12.2012_14.17.04_log.txt</> which is based on the program version # and date and time run.</li>
<li>Attach this log to your next reply.</li>
</ol>
<hr />

 

[kuttus]

Please run the OTL Tools once again and Send me the new Logfiles...

Run This Tool Called AutoRuns... Now you can see lots of Tabs in it. Got to the Tab Called Logon.... After that Send me the Screen Shots of the Logon Tab... it will be looks like this..

 

[SoDawg81]

Ok...

Screen shot and OTL log is attached:

thanks

Please run the OTL Tools once again and Send me the new Logfiles...

Run This Tool Called AutoRuns... Now you can see lots of Tabs in it. Got to the Tab Called Logon.... After that Send me the Screen Shots of the Logon Tab... it will be looks like this..

 

[kuttus]

Okay. Now please run the Autoruns once again and go to the same Tab again.. There you can see one file c:\windows\syswow64\c.bat

Remove the Check Mark for that one and restart the computer. After a restart check if you are getting that pop up or not...

 

[SoDawg81]

Ok...

Unchecked the autoauto line per instructions and rebooted. Looks like the dos window is not coming up any longer, but I am still getting the web re-directs as before.. When I am in Google and click on a new link or new line, it opens up a random website, usually some sort of advertisement site. The underlying issue that started this all is still there, thought it looks like the dos window is gone.

this is an example of the screen that pops up...

http://ad.directrev.com/RealMedia/ads/adstream_sx.ads/S0000481/1%5brandomNo%5d@x10

thanks

Okay. Now please run the Autoruns once again and go to the same Tab again.. There you can see one file c:\windows\syswow64\c.bat

Remove the Check Mark for that one and restart the computer. After a restart check if you are getting that pop up or not...

 

[kuttus]

Okay it is nice to hear that the Command Window from the start up is gone.. Now we can fix the issues with the Advertisements in Browsers...

Are you getting this Advertisements in Internet Explorer only? Or is it happening in all the Browsers?

 

[SoDawg81]

In both Google Chrome and IE 9, but it does seem much more prevelant when I am using google Chrome.

Okay it is nice to hear that the Command Window from the start up is gone.. Now we can fix the issues with the Advertisements in Browsers...

Are you getting this Advertisements in Internet Explorer only? Or is it happening in all the Browsers?

 

[kuttus]

Okay... Please run the OTL Once again and upload me the new OTL log...

Reset the Internet Explorer...

Steps To Reset Internet Explorer...

1. Please press the Windows key
   
   and R key on your keyboard together.
2. Now you will get a Run window. In that run window please type inetcpl.cpl and press on OK.
   
   
3. Now you will get a Internet Options Window.
   
   
4. In that Window Press on the Advanced Tab and press on Reset
   
   
5. Press on Reset Once Again in the Second Window.
   
   
6. When Internet Explorer finishes resetting, click Close in the confirmation dialogue box and then click OK.
   
   

NOTE : Before you Start Resting Internet Explorer Close all the Open Windows of Internet Explorer ...

<hr />