There are what appear to be missing default junctions. Not sure if the batch we used just lost the path due to the infection or if they are being obscured by the malware.
Next, download and save to your Desktop the attached file fixlist.txt
Next
[*]Right click FRST.exe and click “Run as Administrator”
[*]When the tool opens click Yes to disclaimer.
[*]Press Fix button.
[]FRST will process the script in Fixlist.txt
[]It will make a log (fixlog.txt) on the desktop. Please copy and paste it to your reply.
Next
Please delete junctionpoints.txt from your desktop and rerun [B]junction.bat by
[*]Right click the file and click run as Adminstator
[*]ok the UAC
[*]a black window will open
[*]when the window closes (it may take a minute or 2) a notepad named junctionpoints.txt will open
[*]it will also be saved to your desktop
Please post the contents of junctionpoints.txt
Please post back with
[]fixlog.txt
[]junctionpoint.txt
Looks like the malware junctions have been removed. The broken default links still are broken. I haven’t seen any reports of the malware causing this. Did you make any changes from the default setup of your computer or try to take ownership of some folders you couldn’t open such as C:\Documents and Settings?
I THINK but don’t know for sure, that this is something different than last time i posed in the link above which was some months ago. Got rid of that one and everything was fine for quite some time. Although i am certainly not an expert hence asking yall for help ;p I’m pretty sure this one is different, the infection popups did not contain the same information
yes i have tried taking ownership of some files previously, i was having a lot of file permission issues.
Folders such as these under C:\ProgramData
Application Data
Desktop
Documents
Favorites
[Start Menu
Templates
are not real folders. They are junctions. Junctions are sort of like a redirect to the actual folder. Windows Vista and up uses them for backwards compatability so older programs can write to the correct location.
If you look at the last junctionspoint.txt you posted you can see the junctions go nowhere.
07/14/2009 01:08 AM Application Data [..]
07/14/2009 01:08 AM Desktop [..]
07/14/2009 01:08 AM Documents [..]
07/14/2009 01:08 AM Favorites [..]
07/14/2009 01:08 AM Start Menu [..]
07/14/2009 01:08 AM Templates [..]
The part in the is the real path. The part just in front of the is the junction. If you try to access the junction you will be presented with an access denied error. These are hard coded into windows and taking ownership may damage them.
THINK but don't know for sure, that this is something different than last time i posed
That looked like an MBR infection. This time it was Zero Access aka Siref. The part with the rogue junctions in the Windows Defender folder is just the latest greatest version.
reason for edit: to add the text to the first quote box
should i be running windows defender with avast? i mean it’s just one more thing running in the backgroud if its not necessary… but if it is, i’ll start it
It’s a different type of program than Avast so there won’t be any conflicts. Whether you want to keep it running is up to you. I just want to make sure it works and we’ve gotten it cleaned up.
Let me know if you are able to start it. We’ll look at the junctions after you post back.
Now let’s see if we can sort out the junctions. Please note that some AV’s may detect this tool. If that happens please disable Avast while you download and run this tool. Disabling windows Defender may be a good idea also.
[*]Extract the contents to it’s own folder
[*]Right click JunctionBox.exe and click “Run as Administrator”
[*]Under profiles select All Profiles and System Junctions from dropdown.
[*]Click Backup Junctions button.
[*]Name the backup file a name you can remember (suggested extension is .ntj) and let the tool run.
[*]When the backup is complete Click Restore Junctions button.
[*]From the list of files select DefaultJunctions.ntj
[]Let the tool run.
[]Please note: the backup process may take some time. The restore process is fairly quick.
After junctionbox if finished please close it and rerun junction.bat like you did before. To avoid confusion with previous copies of junctionpoints.txt you may want to delete the one you have on your desktop now.
While doing the backup AutoIt Error window came up saying Line 348 (File “C:\Users\kris\Desktop\junctionbox\JunctionBox.exe”): Error: Variabble Used without being declared.
After clicking “OK” the program closed.
i have tried running as admin as well as regular user and i’ve also re-downloaded and tried again. I keep getting the same error trying to backup… should i just proceed to the next step or is something else wrong?
Before we try restoring the defaults let’s get a new OTL log.
[*]Right click on OTL.exe and click “Run as Administrator” to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]When the window appears, underneath Output at the top change it to Minimal Output
[*] checkt the box beside “scan all users”
[*]Check the boxes beside LOP Check and Purity Check.
[*]In the window under Custom Scans/Fixes copy and paste the following
also tried changing the name of the exe, same error.