Virus on PC - Logs and Dumps included

[5aq1b]

Hello there,
I have a seriously big problem with my PC. I’ve somehow managed to get the Sality.NAM virus on my machine and it’s an absolute nightmare!
I shall give as much information possible in this post to help you help me
Main Hard Drive is partitioned into 4 sections.

Hard Drive 1:
C: Contains XP used for general USE
D: Contains XP used for Music Production
F: Contains Program files for C: XP
G: Contains Program Files for D: XP

The Other 3 Hard drives are as follows:

Hard Drive 2:
I: Music Production Projects
H: Downloaded Material (mp3’s, avi’s, etc); My Documents Folder.

Hard Drive 3:
N: Music Production Samples

Hard Drive 4:
W: Backup Drive; contains System Images etc.

I first noticed something suspicious when my CCleaner program failed to run on BOTH installs of XP! Spybot Search and Destroy also fails to run. I just get the “cannot locate file” box. Also, my Nod32 A/V Fails to run at startup and requires a manual start.

If I install CCleaner or Spybot S&D again, they disappear again after a reboot.
I ran a virus scan and noticed a whole host of infiltrations and a whole host of files in quarantine. Are these files USELESS now? I am not so fussed about my XP which is used for general use but I really can’t afford to lose anything to do with the music production side.

As shown above. I also have separate physical hard drives that contain Music Audio Projects, My Documents from General use XP, Backups etc. Are those separate Hard Drives safe?

I have posted Hijack this and MalwareBytes logs below.

My Nod32 Has placed loads into quarantine. I have taken screen dumps also of what malwarebytes found and of the quarantine in Nod32. As you can see from the Nod32 screen dump, hundreds of files are in quarantine. Am I SCREWED??? Please Help!

PS. My PC doesn’t boot into safe mode either now, and I’m guessing that it’s because of this virus.

 

[mflynn]

Run HJT Scan only Fix all lines ENDING with (no file)

Then run MBAM again as the log says "No Action Taken" meaning you exited without cleaning.

The SuperAntiSpyware is part of the 8 Steps so run it and post log.

We will get back to the question of if those files are trashed or not after you are clean.

The longer you keep running with these the worse it will get!

Mike

 

[5aq1b]

Thnks mate, Logs Posted below

 

[mflynn]

OK there is more!

Update both MBAM and SAS then boot to Safe Mode and run them both again post logs when back up in normal mode.

Be sure to select and remove the tracking cookies in SAS!

Mike

 

[5aq1b]

Hi, Tried to do this before, and trying again now but it refuses to boot into safe mode. I get to the menu and select Safe Mode. It looks as if it is booting into safe mode however it stops when it reaches a part where it says 'Press escape to cancel loading SPTD.sys'

 

[mflynn]

You may not be giving it enough time!

Give it several minutes 3 or 4 before pressing ESC to cancel SPTD.sys. If you do have to cancel it wait again 3-4 minutes to see if it will come up in Safe Mode.

If not do then steps in Normal Mode.

Mike

 

[5aq1b]

It only gives you 4 or 5 seconds and no matter if you cancel it or not, it will just reboot.

Ran the test in normal mode again and nothing was found however my Nod32 qurantine is full of the aforementioned virus.

 

[mflynn]

OK so you say both MBAM and SAS were clear?

So do the below..

Download ComboFix

Get it here: https://www.techspot.com/downloads/5587-combofix.html
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

Install Recovery Console if connected to the Internet!

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.

Mike

 

[5aq1b]

done.. .

 

[mflynn]

OK rename ComboFix.exe to 12cbf34.exe and run that and post log.

Then only after above...

Only after the above is done do this to attempt to fix Safe Mode.
Download http://www.didierstevens.com/files/data/SafeBoot.zip. Open zip and dbl click the one for your SP level. Approve to add/merge to registry when asked.

Then...

SDFix requires Safe Mode so hopefully the above fixed it.

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.

--------------------------------------------------------------------------------------------------------

Only do the below if Safe Mode is still not working after the SafeBoot fix above.

Paste the line in the box below to the Run command and click OK.

"C:\Program Files\SUPERAntiSpyware\BootSafe.exe"

Note when you chose Safe Mode (or any mode) with this program you will need to use it to switch back to Normal as it will boot Safe Mode every time until you change it back Normal Mode using SafeBoot again!

Mike

 

[5aq1b]

re

OK rename ComboFix.exe to 12cbf34.exe and run that and post log.

Then only after above...

Only after the above is done do this to attempt to fix Safe Mode.
Download http://www.didierstevens.com/files/data/SafeBoot.zip. Open zip and dbl click the one for your SP level. Approve to add/merge to registry when asked.

Then...

SDFix requires Safe Mode so hopefully the above fixed it.

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.

--------------------------------------------------------------------------------------------------------

Only do the below if Safe Mode is still not working after the SafeBoot fix above.

Paste the line in the box below to the Run command and click OK.

"C:\Program Files\SUPERAntiSpyware\BootSafe.exe"

Note when you chose Safe Mode (or any mode) with this program you will need to use it to switch back to Normal as it will boot Safe Mode every time until you change it back Normal Mode using SafeBoot again!

Mike

thanks the safeboot thing workd. Logs attached

PS. Still, everytime I reinstall CCleaner it fails to work after reboot. I just get the "missing shortcut" box with the torch etc as if CCleaner does not exist.

Also!, I notice in my nod32 log thousands of files but this one in particular "system32\wmdrtc32.dll"

This website refers to it: http://www.greatis.com/appdata/d/SysDir/w/wmdrtc32.dll_Removal.htm

Hope this info helps.

 

[mflynn]

Well ComboFix just got them!

Rename ComboFix.exe to 12cbf34.exe and run 12cbf34 and post the log to see it this run comes clean or finds more!

Mike

 

[5aq1b]

Well ComboFix just got them!

Rename ComboFix.exe to 12cbf34.exe and run 12cbf34 and post the log to see it this run comes clean or finds more!

Mike

I now get the message:

"You cannot rename ComboFix as 12cbf34

Please use another name, preferably made up of alphanumeric characters"

Also, in the nod32 real time protection log, there are still files appearing related to win32/sality.nam virus and 6 minutes ago the wmdrtc32.dll file appeared with the message "unable to clean"

 

[mflynn]

Ok uninstall ComboFix

Start-Run
type
combofix /u
click OK

Now download ComboFix again and do the rename as above!

Then boot to Safe Mode and run it post log when back to normal.

Mike

 

[5aq1b]

no luck. I ran combofix again without renaming, it removed the .dll files but they keep re-appearing after reboot.

 

[mflynn]

OK

Download http://download.nai.com/products/mcafee-avert/stinger.exe

Download DrWeb https://www.techspot.com/vb/post724044-3.html

Then ....

Left Drag mouse and Copy for Pasting all text in the box below. Make sure the slider bar goes to bottom from the @ to the end of the second exit.

Then paste to a notepad document and save to the Desktop .

@echo off
cd\
:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile

sc stop TDSSserv.sys
sc delete TDSSserv.sys
:: Above sc commands first stops then deletes service if it exists
::
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata"
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\tdss"
::
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" /f
::The above reg commands first unloads the reg keys then deletes these keys.
::
Attrib -h -s -r tdss*.* /s
del /f /q /s tdss*.*
:: The above two lines first clears protective attributes then 
:: deletes all files on Drive beginning with the name tdss

:: Remove AntiVirus2009
attrib -h -s -r "%UserProfile%\Desktop\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
attrib -h -s -r "%UserProfile%\Start Menu\Antivirus 2009\*.*"

del /f /q "%UserProfile%\Desktop\Antivirus 2009.lnk"
del /f /q  "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
del /f /q "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
del /f /q "%UserProfile%\Start Menu\Antivirus 2009\*.*"

rd /s /q "%UserProfile%\Start Menu\Antivirus 2009"

attrib -h -s -r "c:\Program Files\Antivirus 2009\*.*"
rd /s/q "c:\Program Files\Antivirus 2009"

attrib -h -s -r c:\WINDOWS\system32\ieupdates.exe
attrib -h -s -r c:\WINDOWS\system32\scui.cpl
attrib -h -s -r c:\WINDOWS\system32\winsrc.dll

del /f /q c:\WINDOWS\system32\ieupdates.exe
del /f /q c:\WINDOWS\system32\scui.cpl
del /f /q c:\WINDOWS\system32\winsrc.dll

attrib -h -s -r /s c:\xwdxqu.txt
del /f /q /s c:\xwdxqu.txt

attrib -h -s -r c:\windows\x
del /f /q c:\windows\x

attrib -h -s -r /s "c:\SxsCaPendDel*.*"
del /f /q /s "c:\SxsCaPendDel*.*"

attrib -h -s -r /s c:\h3s.sys
del /f /q /s c:\qh3s.sys

attrib -h -s -r /s c:\jsdpp32.sys
del /f /q c:\jsdpp32.sys

attrib -h -s -r /s c:\oxauau96.sys
del /f /q /s c:\oxauau96.sys

reg delete HKLM\SOFTWARE\swearware /f
reg delete HKCU\Software\Wget /f
reg delete HKLM\Software\Classes\CLSID\{CD363BEC-7150-B887-530D-F3E2E0424EA} /f

:: rootkit gaopdxserv
sc stop gaopdxserv.sys.sys
sc delete gaopdxserv.sys.sys

attrib -h -s -r /s c:\gaopdx*.*
del /f /q /s c:\gaopdx*.*
reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Classes\gaopdxvx" /f

sc stop WinSvchostManager
sc delete WinSvchostManager

attrib -h -s -r /s "C:\WinSvcHostmanager*.*"
del /f /q /s "C:\WinSvcHostmanager*.*"

sc stop ntndis
sc delete ntndis

attrib -h -s -r /s C:\ntndis.*
del /f /q /s C:\ntndis.*

sc stop u_lehj
sc delete u_lehj

attrib -h -s -r /s "c:\\u_lehj32*.*"
del /f /q /s "c:\u_lehj32.*.*"

attrib -h -s -r /s c:\svcprs32.exe
del /f /q /s c:\svcprs32.exe

attrib -h -s -r /s c:\wmdrtc32.dll
del /f /q /s c:\wmdrtc32.dll

attrib -h -s -r "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"
del /f /q "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"

attrib -h -s -r "C:\WINDOWS\system32\mdmcls32.exe"
del /f /q "C:\WINDOWS\system32\mdmcls32.exe"

reg delete "HKEY_CURRENT_USER\Software\75319611769193918898704537500611" /f
reg delete "HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "75319611769193918898704537500611" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "ieupdate" /f
echo Finshed ripping out Antivirus 2008-9

:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile
exit
exit

Once saved to Desktop reboot to Safe Mode.

Open the document and copy then paste to the black screen of an open command prompt.

It will run and exit. It is a cover all so ignore errors.

Then run..

1st Stinger

2nd DrWeb

DrWeb will fisrt do an Express Scan on its own when it completes then you should do a full scan.

The first Virus it finds select Cure and from here on it will do the same for all the rest.

This could take a while!

Mike

 

[kritius]

Well ComboFix just got them!

Rename ComboFix.exe to 12cbf34.exe and run 12cbf34 and post the log to see it this run comes clean or finds more!

Mike

I now get the message:

"You cannot rename ComboFix as 12cbf34

Please use another name, preferably made up of alphanumeric characters"

Mike, the reason it couldn't be renamed is because it was already running as that. Have a look at the previous log.

 

[5aq1b]

OK

Download http://download.nai.com/products/mcafee-avert/stinger.exe

Download DrWeb https://www.techspot.com/vb/post724044-3.html

Then ....

Left Drag mouse and Copy for Pasting all text in the box below. Make sure the slider bar goes to bottom from the @ to the end of the second exit.

Then paste to a notepad document and save to the Desktop .

@echo off
cd\
:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile

sc stop TDSSserv.sys
sc delete TDSSserv.sys
:: Above sc commands first stops then deletes service if it exists
::
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata"
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\tdss"
::
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" /f
::The above reg commands first unloads the reg keys then deletes these keys.
::
Attrib -h -s -r tdss*.* /s
del /f /q /s tdss*.*
:: The above two lines first clears protective attributes then 
:: deletes all files on Drive beginning with the name tdss

:: Remove AntiVirus2009
attrib -h -s -r "%UserProfile%\Desktop\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
attrib -h -s -r "%UserProfile%\Start Menu\Antivirus 2009\*.*"

del /f /q "%UserProfile%\Desktop\Antivirus 2009.lnk"
del /f /q  "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
del /f /q "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
del /f /q "%UserProfile%\Start Menu\Antivirus 2009\*.*"

rd /s /q "%UserProfile%\Start Menu\Antivirus 2009"

attrib -h -s -r "c:\Program Files\Antivirus 2009\*.*"
rd /s/q "c:\Program Files\Antivirus 2009"

attrib -h -s -r c:\WINDOWS\system32\ieupdates.exe
attrib -h -s -r c:\WINDOWS\system32\scui.cpl
attrib -h -s -r c:\WINDOWS\system32\winsrc.dll

del /f /q c:\WINDOWS\system32\ieupdates.exe
del /f /q c:\WINDOWS\system32\scui.cpl
del /f /q c:\WINDOWS\system32\winsrc.dll

attrib -h -s -r /s c:\xwdxqu.txt
del /f /q /s c:\xwdxqu.txt

attrib -h -s -r c:\windows\x
del /f /q c:\windows\x

attrib -h -s -r /s "c:\SxsCaPendDel*.*"
del /f /q /s "c:\SxsCaPendDel*.*"

attrib -h -s -r /s c:\h3s.sys
del /f /q /s c:\qh3s.sys

attrib -h -s -r /s c:\jsdpp32.sys
del /f /q c:\jsdpp32.sys

attrib -h -s -r /s c:\oxauau96.sys
del /f /q /s c:\oxauau96.sys

reg delete HKLM\SOFTWARE\swearware /f
reg delete HKCU\Software\Wget /f
reg delete HKLM\Software\Classes\CLSID\{CD363BEC-7150-B887-530D-F3E2E0424EA} /f

:: rootkit gaopdxserv
sc stop gaopdxserv.sys.sys
sc delete gaopdxserv.sys.sys

attrib -h -s -r /s c:\gaopdx*.*
del /f /q /s c:\gaopdx*.*
reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Classes\gaopdxvx" /f

sc stop WinSvchostManager
sc delete WinSvchostManager

attrib -h -s -r /s "C:\WinSvcHostmanager*.*"
del /f /q /s "C:\WinSvcHostmanager*.*"

sc stop ntndis
sc delete ntndis

attrib -h -s -r /s C:\ntndis.*
del /f /q /s C:\ntndis.*

sc stop u_lehj
sc delete u_lehj

attrib -h -s -r /s "c:\\u_lehj32*.*"
del /f /q /s "c:\u_lehj32.*.*"

attrib -h -s -r /s c:\svcprs32.exe
del /f /q /s c:\svcprs32.exe

attrib -h -s -r /s c:\wmdrtc32.dll
del /f /q /s c:\wmdrtc32.dll

attrib -h -s -r "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"
del /f /q "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"

attrib -h -s -r "C:\WINDOWS\system32\mdmcls32.exe"
del /f /q "C:\WINDOWS\system32\mdmcls32.exe"

reg delete "HKEY_CURRENT_USER\Software\75319611769193918898704537500611" /f
reg delete "HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "75319611769193918898704537500611" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "ieupdate" /f
echo Finshed ripping out Antivirus 2008-9

:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile
exit
exit

Once saved to Desktop reboot to Safe Mode.

Open the document and copy then paste to the black screen of an open command prompt.

It will run and exit. It is a cover all so ignore errors.

Then run..

1st Stinger

2nd DrWeb

DrWeb will fisrt do an Express Scan on its own when it completes then you should do a full scan.

The first Virus it finds select Cure and from here on it will do the same for all the rest.

This could take a while!

Mike

Sir you are a f*cking legend!! I think I may be clean now. No Eset log file going crazy, the .dl has disappeared also and infected .exe's have been cleaned! Thanks again for your help, much appreciated!

By the way, i'm fairly IT literate as I work and study in IT, cisco etc etc etc. How did this virus come along, and why did my Nod32 not pick it up as it is up to date.

Do you recommend realtime protection be activated on malwarebytes also?

Thanks!

 

[5aq1b]

OK

Download http://download.nai.com/products/mcafee-avert/stinger.exe

Download DrWeb https://www.techspot.com/vb/post724044-3.html

Then ....

Left Drag mouse and Copy for Pasting all text in the box below. Make sure the slider bar goes to bottom from the @ to the end of the second exit.

Then paste to a notepad document and save to the Desktop .

@echo off
cd\
:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile

sc stop TDSSserv.sys
sc delete TDSSserv.sys
:: Above sc commands first stops then deletes service if it exists
::
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata"
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\tdss"
::
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" /f
::The above reg commands first unloads the reg keys then deletes these keys.
::
Attrib -h -s -r tdss*.* /s
del /f /q /s tdss*.*
:: The above two lines first clears protective attributes then 
:: deletes all files on Drive beginning with the name tdss

:: Remove AntiVirus2009
attrib -h -s -r "%UserProfile%\Desktop\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
attrib -h -s -r "%UserProfile%\Start Menu\Antivirus 2009\*.*"

del /f /q "%UserProfile%\Desktop\Antivirus 2009.lnk"
del /f /q  "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
del /f /q "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
del /f /q "%UserProfile%\Start Menu\Antivirus 2009\*.*"

rd /s /q "%UserProfile%\Start Menu\Antivirus 2009"

attrib -h -s -r "c:\Program Files\Antivirus 2009\*.*"
rd /s/q "c:\Program Files\Antivirus 2009"

attrib -h -s -r c:\WINDOWS\system32\ieupdates.exe
attrib -h -s -r c:\WINDOWS\system32\scui.cpl
attrib -h -s -r c:\WINDOWS\system32\winsrc.dll

del /f /q c:\WINDOWS\system32\ieupdates.exe
del /f /q c:\WINDOWS\system32\scui.cpl
del /f /q c:\WINDOWS\system32\winsrc.dll

attrib -h -s -r /s c:\xwdxqu.txt
del /f /q /s c:\xwdxqu.txt

attrib -h -s -r c:\windows\x
del /f /q c:\windows\x

attrib -h -s -r /s "c:\SxsCaPendDel*.*"
del /f /q /s "c:\SxsCaPendDel*.*"

attrib -h -s -r /s c:\h3s.sys
del /f /q /s c:\qh3s.sys

attrib -h -s -r /s c:\jsdpp32.sys
del /f /q c:\jsdpp32.sys

attrib -h -s -r /s c:\oxauau96.sys
del /f /q /s c:\oxauau96.sys

reg delete HKLM\SOFTWARE\swearware /f
reg delete HKCU\Software\Wget /f
reg delete HKLM\Software\Classes\CLSID\{CD363BEC-7150-B887-530D-F3E2E0424EA} /f

:: rootkit gaopdxserv
sc stop gaopdxserv.sys.sys
sc delete gaopdxserv.sys.sys

attrib -h -s -r /s c:\gaopdx*.*
del /f /q /s c:\gaopdx*.*
reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Classes\gaopdxvx" /f

sc stop WinSvchostManager
sc delete WinSvchostManager

attrib -h -s -r /s "C:\WinSvcHostmanager*.*"
del /f /q /s "C:\WinSvcHostmanager*.*"

sc stop ntndis
sc delete ntndis

attrib -h -s -r /s C:\ntndis.*
del /f /q /s C:\ntndis.*

sc stop u_lehj
sc delete u_lehj

attrib -h -s -r /s "c:\\u_lehj32*.*"
del /f /q /s "c:\u_lehj32.*.*"

attrib -h -s -r /s c:\svcprs32.exe
del /f /q /s c:\svcprs32.exe

attrib -h -s -r /s c:\wmdrtc32.dll
del /f /q /s c:\wmdrtc32.dll

attrib -h -s -r "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"
del /f /q "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"

attrib -h -s -r "C:\WINDOWS\system32\mdmcls32.exe"
del /f /q "C:\WINDOWS\system32\mdmcls32.exe"

reg delete "HKEY_CURRENT_USER\Software\75319611769193918898704537500611" /f
reg delete "HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "75319611769193918898704537500611" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "ieupdate" /f
echo Finshed ripping out Antivirus 2008-9

:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile
exit
exit

Once saved to Desktop reboot to Safe Mode.

Open the document and copy then paste to the black screen of an open command prompt.

It will run and exit. It is a cover all so ignore errors.

Then run..

1st Stinger

2nd DrWeb

DrWeb will fisrt do an Express Scan on its own when it completes then you should do a full scan.

The first Virus it finds select Cure and from here on it will do the same for all the rest.

This could take a while!

Mike

Sir you are a f*cking legend!! I think I may be clean now. No Eset log file going crazy, the .dl has disappeared also and infected .exe's have been cleaned! Thanks again for your help, much appreciated!

By the way, i'm fairly IT literate as I work and study in IT, cisco etc etc etc. How did this virus come along, and why did my Nod32 not pick it up as it is up to date.

Do you recommend realtime protection be activated on malwarebytes also?

Thanks!