How can i get rid of My Rookit and Lag space

[Ttakeru]

I've been having real problems with my computer lately, 2 items keep appearing on my desktop called online security guide and live safty center and before i lost my task bar to the pocket in my monitor (im not sure what to call it so i just called it lag space as i explain further down) an icon would come from the left of the task bar saying i had a virus or spyware and that i needed to download "so and so" to get rid of it,and after a long time cleaning out my computer with software/adware/malware programs i have discovered its a Rootkit but cannot fix this myself. There is also something that concerns me greatly, on my moniter (like anyone elses) there are boundaries to where the mouse can go, usually the mouse cant go beyond those boundaries, but recently the bottom left corner of my screens boundary didnt seem to.. well be a boundary even though you cant tell anything is wrong the mouse can slip far off into the left corner(I tested this by dragging a window to the bottom left corner and the mouse pointer disapeared right along side the window i was dragging but it was easily retrievable) and not be seen until you drag it back, also my taskbar doesnt show up anymore when i log in, sometimes when i see windows minimize they go to the left corner and once or twice ive been able to use my mouse to drag the taskbar back even though it was planely out of site. I'm wondering if all of this has to do with the Rootkit that i have?

Im sending my HJT in the hopes that someone has the answer to my problem.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Your system is infected with a variety of malware.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

Also, let me know the results of the AVG Antirootkit scan.

Regards Howard :wave: :wave:

This thread is for the use of Ttakeru only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Ttakeru]

Me Again

Sorry for the delay, I have done all that i can with the guide that you gave me and the result of the avg anitrookit program was negative for rootkits, thanks by the way, but i still have the small bubble on the lower left corner and as it turns out i've investigated this with the magnifier tool and found that its like a second desktop down there except there is no icons or a taskbar(this is how i got my taskbar back from there) just a background image of my main desktop have any idea's of what it is?

Ps here are the logs.

Cheers

Takeru

 

[howard_hopkinso]

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT and Combofix log.

Regards Howard

This thread is for the use of Ttakeru only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Ttakeru]

All complete

Ok i did everything as you told me, here are the logs

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

XSIFWWV
BAKBODKV
McAfee Application Installer Cleanup

Close the services window.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

004776~1.EXE
ATR1.exe
BAKBODKV.exe
XSIFWWV.exe
igxrwhcc.exe
wesxbwtc.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O4 - Startup: The Matrix_ Path of Neo Registration.lnk = C:\Documents and Settings\kathrine Jones\Local Settings\Temp\{AE456F26-8595-4086-827A-B858DE9372BA}\{E571E8B1-9771-465D-9DE0-3B A2D1BDAE99}\ATR1.exe

O8 - Extra context menu item: &Search - ?p=ZNfox000

O23 - Service: McAfee Application Installer Cleanup (0047761190628526) (0047761190628526mcinstcleanup) - McAfee, Inc. - C:\WINDOWS\TEMP\004776~1.EXE

O23 - Service: BAKBODKV - Unknown owner - C:\DOCUME~1\KATHRI~1\LOCALS~1\Temp\BAKBODKV.exe (file missing)

O23 - Service: XSIFWWV - Unknown owner - C:\DOCUME~1\KATHRI~1\LOCALS~1\Temp\XSIFWWV.exe (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\DOCUME~1\KATHRI~1\LOCALS~1\Temp\XSIFWWV.exe
C:\DOCUME~1\KATHRI~1\LOCALS~1\Temp\BAKBODKV.exe
C:\WINDOWS\TEMP\004776~1.EXE

C:\Documents and Settings\kathrine Jones\Local Settings\Temp\{AE456F26-8595-4086-827A-B858DE9372BA}\{E571E8B1-9771-465D-9DE0-3B A2D1BDAE99}\ATR1.exe
C:\WINDOWS\system32\wesxbwtc.exe
C:\WINDOWS\system32\igxrwhcc.exe

C:\WINDOWS\system32\mlkkj.bak1
C:\WINDOWS\system32\pqtwa.bak1
C:\WINDOWS\system32\kjjlm.bak1

C:\WINDOWS\system32\kjjlm.bak2
C:\!KillBox
C:\VundoFix Backups

C:\4ddc3f84d2839e83e4c1fd49a5b0
C:\WINDOWS\winstart.bat

Reboot into normal mode and rehide your protected OS files.

Post fresh HJT and Combofix logs.

Regards Howard

This thread is for the use of Ttakeru only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Ttakeru]

Completed

Ok everything from the last message that you told me to do was completed.
Here are the logs

Cheers

Takeru

 

[howard_hopkinso]

I notice you`re running two firewalls, McAfee and Zonealarm. I susgets you uninstall Zonealarm as it`s not a good idea to have more than one firewall running at one time. It can cause conflicts.

Your log files appear to be clean. Unless you`re still having problems, you should be good to go.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of Ttakeru only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.