hi oldman…the computer has been running fine…here’s the TDSS report…thanks 
Hi JackSession,
Nothing amiis ther. Perhaps your computer just doesn’t like aswMBR. Happens sometmes.
One more to see if we missed anything.
Go here to run an online scannner from
ESET
(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)
[*]Tick the box next to YES, I accept the Terms of Use.
[*]Click Start
[*]When asked, allow the activex control to install
[*]Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
[*]Click Start
[*]Make sure that the option “Remove found threats” is Unchecked, and the option “Scan unwanted applications” is Checked.
[*]Click Scan.
[*]Wait for the scan to finish.
[*]When the scan completes, click List of found threats
[*]click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
[*]Include the contents of this report in your next reply
Note - when ESET doesn’t find any threats, no report will be created.
[*]Push the back button.
[*]Push Finish
[*]Re-enable your Antivirus software.
ESET found some stuff…i attached the report…thanks
virtumonde info
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Win32%2FVirtumonde
http://en.wikipedia.org/wiki/Vundo
what should i do? run the microsoft stuff at the bottom of that link?
no that was just info…in case it was interesting
you wait for oldman to continue…
it is interesting…maybe that explains the blue screens with aswMBR…ive got a machine in the closet that wont go on the internet that i believe has an older version of vundo…id like to clean that one up too but i think that will be a lot more difficult…should i assume that all my personal info/passwords etc have been compromised at this point?
.ive got a machine in the closet that wont go on the internet that i believe has an older version of vundit can be done downloading the tools on a clean machine and move over with a usb stick you may ask oldman when he is back
Hi ,
We can work on your other computer after we finish this one. We can continue in this topic if you wish.
Back to the computer we are currently working on. No worries about the ESEt detections. Those are files that we have quarantined or are in old System Restore points. These will all be removed when we remove the tools.
As for aswMBR not running. I don’t think it’s malware related. It might be interference from another security program such as MBAM. We can disable it for now and try aswMBR again.
Right-click on the MBAM icon in the systray, chose Exit and then click Yes at the prompt asking “Are you sure you want to disable the MBAM Protection Module?”
MBAM will restart on a reboot. Just a note, if this is the trial version it will stop real time scanning once the trial period is over. Even so it is a very good program and one which I recommend keeping as an on demand scanner.
We’ll clean up the tools after you post back.
as a rule of thumb ive been disabling mbam and avast! before running any of these applications…the only variation i might have is whether FF is open as some instructions specified to close browsers and some didnt
my right click button on my mouse is worn out and doesnt work (initially it was the left click worn out but i switched them up so i can click)
soo…to disable mbam ive been telling it not to start on restart and then restarting…ive tried aswMBR a few times like that and it doesnt look like mbam is running (red box indicating not enabled) - still got the blue screens
ill try aswMBR again a couple more times…it seems to be getting hung up around the same place so i can try to note where if it helps
Hi
Give it one more try then try in safe mode. Again I do not believe it is of concern but it will make us both feel better if it runs.
To boot to safe mode:
[]Restart your computer
[]After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
[]Instead of Windows loading as normal, a menu with options should appear;
[]Select the first option, to run Windows in Safe Mode, then press “Enter”.
[*]Choose your usual account.
good morning!!
i ran aswMBR again and it went a little different this time…it stopped at:
C:\Documents and Settings\Administrator\Local Settings\Application Data… (I couldnt see the rest)
the computer immediately restarted…when it was done booting I got a message saying “Microsoft Windows has recovered from a serious error…” these were the errors that occured:
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\WERb1d8.dir00\Mini072912-01.dmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\WERb1d8.dir00\sysdata.xml
Going to try it in safemode now…
Thanks
Jack
aswMBR ran complete in Safe Mode…here’s the log…
Hi JackSession,
It looks ok. We’ll check one more thing. There should be a file on your desktop called mbr.dat. Rename it to mbr.txt and attach it to your next reply.
hi oldman…not sure if i didnt that right…no program to open dat files
hi oldman…i saw this on another posting:
“WARNINGUnfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.”
was my deal this bad? should i assume my info has been compromised?
thanks
jack
Hi JackSession,
I thought I had suggested that you change all your passwords to any forums or financial institutes that you may deal with but looking back throught the topic I don’t see it. I think changing you passwords should be enough.
The mbr checks out clean.
Any issues?
Poat back after you are finished and I’ll give you some instructions to safely transfer some tools to your other computer.
From your desktop, please delete, if present
[]any notepads/logs that we created
[]GMER (df807stx.exe)
[]aswMBR.exe
[]mbr.txt
[]aswMBR.txt
[]TDSSKiller
[*]RogueKiller
Next
Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /uninstall
Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.
I suggest you keep MBAM. Keep it updated and use it regularly.
Some Recommendations and prevention tips
Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall.
I suggest either for a resident antispyware program.
- If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.
Click FIREWALL for links and tutorials to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware, IMO)
You should also use Spyware Blaster to help immunize your computer.
- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.
OR
A guide to understanding and using the hosts file.
Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS
Please read the info on disabling the DNS Client before installing a custom hosts file.
-Secure your Internet Explorer
From within Internet Explorer click on the Tools menu and then click on Options.
[*]Click once on the Security tab
[*]Click once on the Internet icon so it becomes highlighted.
[*]Click once on the Custom Level button.
[*]Change the Download signed ActiveX controls to Prompt
[*]Change the Download unsigned ActiveX controls to Disable
[*]Change the Initialize and script ActiveX controls not marked as safe to Disable
[*]Change the Installation of desktop items to Prompt
[*]Change the Launching programs and files in an IFRAME to Prompt
[*]Change the Navigate sub-frames across different domains to Prompt
[*]When all these settings have been made, click on the OK button.
[*]If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
-
Keeping your Windows up-to-date is crucial to your computer’s security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis
-
Make sure you have reset Automatic Updates to your chosen optionClick your start button > Control Panel > System
-
Keep your antivirus program updated, as well as any other security programs you have.
-More tips and programs can be found HERE
Please post back if you have any problems.
ill will do all of this stuff tomorrow and see…i really appreciate your help
the only issue is my gf has been complaining about youtube and other video content slowing down since we did this stuff…i turned mbam and avast! completely off and it still seems to be doing it…any ideas?
other than that everything is running smoothly
Thanks!
Jack
Hi JackSession,
Other than when we ran combofix and the OTL fix the rest of the scans we did were just scans that will not remove anything. I looked at both the combofix log and the OTL fix and there doesn’t seem to be anything related to what you are describing in either of those. We did empty a bunch of temporary caches, flash being one of them.
Try updating Flashlayer perhaps?
Hi Oldman,
Cleaned everything up as instructed. Installed Windows Defender and SpywareBlaster. Have Malwarebytes and Avast! running. Also updated the Flash Player and Firefox. Everything is running great!!
I need to get a USB stick before I can do this stuff on the other computer. I will either start a new topic or continue here when I am ready…whichever you prefer.
I really appreciate your help here- Very informative and professional.
Thank You!!
Jack