TechSpot

Um can someone analyze this for me

By magewarrior
Mar 19, 2009
  1. Like the title states, I have literally run everything from steps 1 through 8, so I dont know if this might help, they were taken at different times, sry. easywinscanner and truescan4 both showed up one morning while I was browsing sites (avg detected it but I have no clue if it got rid of it) plz help.
     

    Attached Files:

  2. mflynn

    mflynn TS Rookie Posts: 2,655

    Ok if you run all 8 Steps where is the SUperAntiSpyware (SAS) log?

    Run HJT Scan only Fix all lines ENDING in (no file)

    Mike
     
  3. magewarrior

    magewarrior TS Rookie Topic Starter

    Me being really stupid as I am sometimes, removed Superantispyware from my comp this morning, I was in a terrible mood, and just wanted to clean my desktop, I forgot I needed that program, so I can post the log, I kept malware bytes though, sry about that, I ran all the programs in steps 1 through 8, SAS gave the same result as malware bytes, nothing out of the ordinary was detected, no files were infected.
     
  4. mflynn

    mflynn TS Rookie Posts: 2,655

    Then do the 2 below!

    Download ComboFix

    Get it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Or here: http://subs.geekstogo.com/ComboFix.exe

    Double click combofix.exe follow the prompts.

    Install Recovery Console if connected to the Internet!

    When finished, it will open a log.
    Attach the log and a new HJT log in your next reply.

    Note: Do not click combofix's window while its running. That may cause it to stall.
    =========================================

    Download SDFix to Desktop.

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    On Desktop run SDdFix It will run (install) then close.

    Then reboot into Safe Mode

    As the computer starts up, tap the F8 key several times.

    On the Boot menu Choose Safe Mode.

    Click thu all the prompts to get to desktop.

    At Desktop
    My Computer C: drive. Double-click to open.

    Look for a folder called SD Fix. Double-click to enter SD Fix.

    Double-click to RunThis.bat. Type Y to begin.

    SD Fix does its job.

    When prompted hit the enter key to restart the computer

    Your computer will reboot.

    On normal restart the Fixtool will run again and complete the removal process then say Finished,
    Hit the Enter key to end the script and load your desktop icons.

    Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
    Attach the Report.txt file to your next post.

    Mike
     
  5. magewarrior

    magewarrior TS Rookie Topic Starter

    Quick q, when I try to run combofix, it gives me an error saying something like you cannot rename combofix o.0??

    and I tried uninstalling it using combofix /u but it couldnt find the file
     
  6. mflynn

    mflynn TS Rookie Posts: 2,655

    Have you had ComboFix before?

    If ComboFix.exe is on the Desktop rename it to 12cbf34.exe and run that!

    Mike
     
  7. magewarrior

    magewarrior TS Rookie Topic Starter

    Heres the combofix log and the new HJT log ...
     

    Attached Files:

  8. mflynn

    mflynn TS Rookie Posts: 2,655

    There you go! I knew it! We meed to run 12cbf34 again to confirm they are gone! We need a clean log!

    OK do the SDFix now but when you boot to Safe Mode to do SDFix do another 12cbf34 before SDFIX..

    After the 12cbf34 then do the SDFix

    Post the 12cbf34 log after rebooting from the SDFix.

    Mike
     
  9. magewarrior

    magewarrior TS Rookie Topic Starter

    New combofix log, and sdfix log
     

    Attached Files:

  10. mflynn

    mflynn TS Rookie Posts: 2,655

    Still some there.

    Do this..

    Left Drag mouse and Copy for Pasting all text in the box below. Make sure the slider bar goes to bottom from the @ to the end of the second exit.

    Then paste to the black screen of an open command prompt. All may not apply so ignore errors.

    Code:
    @echo off
    cd\
    :: Fix associations
    ftype exefile="%1" %*
    ftype batfile="%1" %*
    ftype cmdfile="%1" %*
    ftype comfile="%1" %*
    ftype scrfile="%1" /S
    ftype regfile="regedit.exe" "%1"
    ftype piffile="%1" %*
    ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
    ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
    ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*
    
    assoc .exe=exefile
    assoc .bat=batfile
    assoc .cmd=cmdfile
    assoc .com=comfile
    assoc .scr=scrfile
    assoc .reg=regfile
    assoc .pif=piffile
    assoc .lnk=lnkfile
    assoc .inf=inffile
    assoc .vbs=VBSFile
    assoc .js=JSFile
    
    sc stop TDSSserv.sys
    sc delete TDSSserv.sys
    :: Above sc commands first stops then deletes service if it exists
    ::
    reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata"
    reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\tdss"
    ::
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" /f
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" /f
    ::The above reg commands first unloads the reg keys then deletes these keys.
    ::
    Attrib -h -s -r tdss*.* /s
    del /f /q /s tdss*.*
    :: The above two lines first clears protective attributes then 
    :: deletes all files on Drive beginning with the name tdss
    
    :: Remove AntiVirus2009
    attrib -h -s -r "%UserProfile%\Desktop\Antivirus 2009.lnk"
    attrib -h -s -r "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
    attrib -h -s -r "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
    attrib -h -s -r "%UserProfile%\Start Menu\Antivirus 2009\*.*"
    
    del /f /q "%UserProfile%\Desktop\Antivirus 2009.lnk"
    del /f /q  "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
    del /f /q "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
    del /f /q "%UserProfile%\Start Menu\Antivirus 2009\*.*"
    
    rd /s /q "%UserProfile%\Start Menu\Antivirus 2009"
    
    attrib -h -s -r "c:\Program Files\Antivirus 2009\*.*"
    rd /s/q "c:\Program Files\Antivirus 2009"
    
    attrib -h -s -r c:\WINDOWS\system32\ieupdates.exe
    attrib -h -s -r c:\WINDOWS\system32\scui.cpl
    attrib -h -s -r c:\WINDOWS\system32\winsrc.dll
    
    del /f /q c:\WINDOWS\system32\ieupdates.exe
    del /f /q c:\WINDOWS\system32\scui.cpl
    del /f /q c:\WINDOWS\system32\winsrc.dll
    
    attrib -h -s -r /s c:\xwdxqu.txt
    del /f /q /s c:\xwdxqu.txt
    
    attrib -h -s -r c:\windows\x
    del /f /q c:\windows\x
    
    attrib -h -s -r /s "c:\SxsCaPendDel*.*"
    del /f /q /s "c:\SxsCaPendDel*.*"
    
    attrib -h -s -r c:\windows\system32\drivers\qh3s.sys
    attrib -h -s -r c:\windows\system32\drivers\jsdpp32.sys
    attrib -h -s -r c:\windows\system32\drivers\oxauau96.sys
    
    del /f /q c:\windows\system32\drivers\qh3s.sys 
    del /f /q c:\windows\system32\drivers\jsdpp32.sys
    del /f /q c:\windows\system32\drivers\oxauau96.sys
    
    reg delete HKLM\SOFTWARE\swearware /f
    reg delete HKCU\Software\Wget /f
    reg delete HKLM\Software\Classes\CLSID\{CD363BEC-7150-B887-530D-F3E2E0424EA} /f
    
    :: rootkit gaopdxserv
    sc stop gaopdxserv.sys.sys
    sc delete gaopdxserv.sys.sys
    
    attrib -h -s -r /s c:\gaopdx*.*
    del /f /q /s c:\gaopdx*.*
    
    sc stop WinSvchostManager
    sc delete WinSvchostManager
    
    attrib -h -s -r /s "C:\WinSvcHostmanager*.*"
    del /f /q /s "C:\WinSvcHostmanager*.*"
    
    sc stop ntndis
    sc delete ntndis
    
    attrib -h -s -r /s C:\ntndis.*
    del /f /q /s C:\ntndis.*
    
    sc stop u_lehj
    sc delete u_lehj
    
    attrib -h -s -r /s "c:\\u_lehj32*.*"
    del /f /q /s "c:\u_lehj32.*.*"
    
    attrib -h -s -r "C:\WINDOWS\system32\svcprs32.exe"
    del /f /q "C:\WINDOWS\system32\svcprs32.exe"
    
    attrib -h -s -r "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"
    del /f /q "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"
    
    attrib -h -s -r "C:\WINDOWS\system32\mdmcls32.exe"
    del /f /q "C:\WINDOWS\system32\mdmcls32.exe"
    
    attrib -h -s -r "C:\32788R22FWJFW.0.tmp"
    del /f /q "C:\32788R22FWJFW.0.tmp"
    
    attrib -h -s -r "C:\c4fa75a403273a5728dd2d773c*.*"
    del /f /q "C:\c4fa75a403273a5728dd2d773c*.*"
    rd /s /q "C:\c4fa75a403273a5728dd2d773c*"
    
    attrib -h -s -r "C:\eb4a5e7b53740aae3305081d*.*"
    del /f /q "C:\eb4a5e7b53740aae3305081d*.*"
    rd /s /q "C:\eb4a5e7b53740aae3305081d*"
    
    attrib -h -s -r "C:\e210719537a1c91523236d*.*"
    del /f /q "C:\e210719537a1c91523236d*.*"
    rd /s /q "C:\e210719537a1c91523236d*"
    
    
    
    
    
    reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
    reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
    reg delete "HKEY_LOCAL_MACHINE\Software\Classes\gaopdxvx" /f
    
    reg delete "HKEY_CURRENT_USER\Software\75319611769193918898704537500611" /f
    reg delete "HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "75319611769193918898704537500611" /f
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "ieupdate" /f
    echo Finshed ripping out Antivirus 2008-9
    :: Fix associations
    ftype exefile="%1" %*
    ftype batfile="%1" %*
    ftype cmdfile="%1" %*
    ftype comfile="%1" %*
    ftype scrfile="%1" /S
    ftype regfile="regedit.exe" "%1"
    ftype piffile="%1" %*
    ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
    ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
    ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*
    
    assoc .exe=exefile
    assoc .bat=batfile
    assoc .cmd=cmdfile
    assoc .com=comfile
    assoc .scr=scrfile
    assoc .reg=regfile
    assoc .pif=piffile
    assoc .lnk=lnkfile
    assoc .inf=inffile
    assoc .vbs=VBSFile
    assoc .js=JSFile
    exit
    exit
    This should run and exit!

    It is a coverall and you may see a few errors related to it addressing something you do not need. This is normal ignore.

    Run 12cbf34 once more and after post another HJT log!

    Mike
     
  11. magewarrior

    magewarrior TS Rookie Topic Starter

    How do I do that exactly o.0??
     
  12. mflynn

    mflynn TS Rookie Posts: 2,655

    What boot to Safe Mode? Tap F8 while booting get advance boot menu chose Safe Mode!

    Open command prompt?
    Start-Run
    type
    cmd
    Click OK

    Copy paste?

    Mike
     
  13. magewarrior

    magewarrior TS Rookie Topic Starter

    I tried that nothing happened, it kinda like froze and hung there doing nothing, the text didnt even appear once I copied it to the command prompt, if it was theree i didnt see it, just a cursor, honestly I dont know what Im doing wrong ?
     
  14. mflynn

    mflynn TS Rookie Posts: 2,655

    After you copy the text and open the command prompt Left click the black screen once to make it the active window then rt click and click paste to put it there.

    I will run and exit you may see errors but this is a cover all and it may try to clean something you do not have. It will close the prompt when finished.

    Mike
     
  15. magewarrior

    magewarrior TS Rookie Topic Starter

    like I said, I dont see the text, I tried highlighting, and it seems to be there, but its not showing anything, do I put the whole thing there, maybe its formatting it wrong, when I highlighted the black screen to see if it was there, it highlighted a huge block of it, like as if you were posting a novel not a code, and when I ran it, it didnt execute, no errors, and it didnt exit. o.0??
     
  16. mflynn

    mflynn TS Rookie Posts: 2,655

    I just tested it, many may have done it.

    Are you getting part of the Box. Only inside the box.

    Mike
     
  17. magewarrior

    magewarrior TS Rookie Topic Starter

    It finally ran, heres my new HJT logfile (I dont think anything changed though)
     
  18. mflynn

    mflynn TS Rookie Posts: 2,655

    So get me another ComboFix run post log!

    Mike
     
  19. magewarrior

    magewarrior TS Rookie Topic Starter

    New combofix log ...
     

    Attached Files:

  20. mflynn

    mflynn TS Rookie Posts: 2,655

    OK run Post #10 again as i have edited it.

    Then another 12cbf34.

    Mike
     
  21. magewarrior

    magewarrior TS Rookie Topic Starter

    Ran it again, heres the new combofix log, and if you want heres the new HJT log
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...