more detail, more problems

[Fric]

I'm tearing my hair out!!!

Athlon AMD 2600+

2.10GHz - 2GB Ram (superseded steam drive)

Windows XP SP2

2 x 80GB Hard Drives

Problem sequence:

1. Lost second hard drive – the only way to recover it was to ‘Restore’.

2. If I disconnect power to PC, when I boot up again – back to 1.

3. Eventually ‘Restore’ failed and I had to boot in ‘Safe Mode’ to restore.

4. Ran scans from McAfee, CCleaner, Spyware Doctor, Registry Patrol, ID Patrol and Threatfire.

5. Firefox 4 Beta failed – It would make a search but could not select from results. It froze.

6. Tried to Update Firefox 4 Beta. No difference.

7. Uninstalled Firefox and reinstalled. Same result.

8. Uninstalled 4 Beta and Downloaded 3.6. Same result. Currently using IE 7.

9. Now all online activity is slow and ‘Task Manager’ displays heavy CPU usage with various files. Eg mcshield.exe – TFservice.exe – wuauclt.exe – svchost.exe (various) – pctsSvc.exe – sqlsevr.exe – Rapportservice.exe – jqs.exe

Any one of these can take up to 90% CPU and it seems they take it in turns.

10. Suddenly I cannot open e-mail attachments which are in W. Media Player or in Power Point format. Where I used to be able to play them without a problem, I now get “x cannot play this file as it is corrupted” even though the file begins to play.

Suggestions would be very welcome. Just to know there's someone trying to help would save me from drink.

[Goku]

Hello Fric. The symptoms you state heavily indicate towards a Malware problem. Hence, I will move this thread into the Malware Removal forums so that you can receive help as soon as one of our Malware experts come online and view this thread. :)

 

Thank you for your patience and co-operation.

 

-- Goku

[Starbuck]

Thanks Goku http://fc07.deviantart.com/images3/i/2004/146/9/1/Two_thumbs_up.gif

-----------------------

 

Hi Fric and welcome to FPCH.

 

Let's get a better look at things.

 

Step 1

Download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

 

Step 2

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
  
• Double-click on Download_mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware

  [*]Then click Finish.

  [*]MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

  [*]On the Scanner tab:

  • Make sure the "Perform Full Scan" option is selected.
    
  • Then click on the Scan button.

  [*]If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.

  [*]The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.

  [*]When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".

  [*]Click OK to close the message box and continue with the removal process.

  [*]Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.

  [*]Make sure that everything is checked, and click Remove Selected.

  [*]When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)

  [*]The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

  [*]Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

 

 

Step 3

Please download MBRCheck.exe to your desktop.

• Be sure to disable your security programs
  
• Double click on the downloaded file to run it
  .
  Vista and Windows 7 users will have to confirm the UAC prompt
   
  
• A window similar to this should open on your desktop:
  

.

http://i677.photobucket.com/albums/vv132/RPMcMurphy_album_photos/mbrcheck.png

 

 

• If you are prompted with options, enter N at the prompt and press Enter
  
• Press Enter again
  
• A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your deskop. Please post the contents of that file.

 

 

Step 4

• Download OTL to your desktop.
  if you have problems, try this download link:
  OTL
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check

.

 

.

http://img.photobucket.com/albums/v708/starbuck50/new/newOtl2.png

Now copy the lines in the codebox below.


netsvcs
msconfig
%SYSTEMDRIVE%*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%*. /mp /s
%systemroot%system32*.dll /lockedfiles
%systemroot%Tasks*.job /lockedfiles
%systemroot%system32drivers*.sys /lockedfiles
CREATERESTOREPOINT

• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
  .
  
• Click the Run Scan button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runscan.png
   
  
• Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

 

In your next reply, please submit:

MBAM scan report

MBRCheck

Both reports from OTL

 

 

Thanks.