My avast! AV 5 PRO warns me that my pc is infected by Win32:Cycler-G.
C:\system volume information\microsoft\services.exe [L] Win32:Cycler-G [Trj] (0)
I must say that sometimes a pop-up ad appears - unwanted pop-up ads!
I’ve tried some AV scanners and the Malwarebyte’s…
Due to the message maximum allowed length, I will post my hijackthis separately.
I thank u in advance.
Logfile of Trend Micro HijackThis v2.0.4
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankhttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://home.microsoft.com/intl/br/access/allinone.asp http://support.asus.com/common/asusTek_sys_ctrl.cab http://www.ipix.com/viewers/ipixx.cab http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab http://www.srtest.com/srl_bin/sysreqlab_ind.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1239379044390 http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab https://www14.bancobrasil.com.br/plugin/GbpDist.cab http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab #Id_String1 .6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe
–
I suggest:
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
Use MBAM (or SUPERantispyware or even Spyware Terminator ) to scan for spywares and trojans. If any infection is detected, it is better and safer to send the infected file(s) to quarantine (Chest), rather than simply deleting them.
Test your machine with anti-rootkit applications . I suggest avast! antirootkit or Trend Micro RootkitBuster .
Make a HijackThis log to post here or this analysis site . Or even submit the RunScanner log to to on-line analysis.
Clean your Hosts file (replacing it) with HostsMan tool.
Disable System Restore and then reenable it again.
Immunize your system with SpywareBlaster .
Check if you have insecure applications with Secunia Software Inspector .
Step 7 should help deleting that infected points, shouldn’t it?
We will have to do Essexboy’s suggestion.
Please download BootRemover to your desktop.
This is a rar file. If you do not have a program on your computer to open it then download and install 7-Zip or Peazip .
Extract Remover.exe to your desktopRun as Administrator (if on Vista/7)
Post the resultant log, please.
We will have to do Essexboy’s suggestion.
Please download BootRemover to your desktop.
This is a rar file. If you do not have a program on your computer to open it then download and install 7-Zip or Peazip .
Extract Remover.exe to your desktopRun as Administrator (if on Vista/7)
Post the resultant log, please.
done!
here it is:
Bootkit Remover version 1.0.0.1www.esagelab.com
\.\C: → \.\PhysicalDrive0
Size Device Name MBR Status
298 GB \.\PhysicalDrive0 Unknown boot code
Unknown boot code has been found on some of your physical disks.
Press any key to quit…
thanks a lot for trying to help me.
If ComboFix doesn’t work, you will have to fix the MBR.
Download ComboFix by sUBs onto your Desktop as a different name.
Open Notepad and copy this text in the code box and paste it onto Notepad without copying the word “code”.
File::
C:\System Volume Information\Microsoft\smss.exe
C:\System Volume Information\Microsoft\services.exe
Save as CFScript.txt onto your desktop then drag the file onto ComboFix.
Combofix will not kill this I am afraid
@ECHO OFF
START remover.exe fix \\.\PhysicalDrive0
EXIT
Next you will need to create the batch fix to do that copy and paste [b]ALL[/b] of the above in the quote box to a notepad file.
Then in the text file go to [b]FILE > SAVE AS [/b] and in the dropdown box select [b]SAVE AS TYPE [/b] to[b] ALL FILES [/b]
Then in the [b]FILE NAME [/b] box type [b]fix.bat[/b]
This will create a batch file
Then run fix.bat by double clicking you may see a black box appear this is normal
On completion
Run Bootkit remover again with no switches as we did at first and copy the data
Then run Combofix
Combofix will not kill this I am afraid
@ECHO OFF
START remover.exe fix \\.\PhysicalDrive0
EXIT
Next you will need to create the batch fix to do that copy and paste [b]ALL[/b] of the above in the quote box to a notepad file.
Then in the text file go to [b]FILE > SAVE AS [/b] and in the dropdown box select [b]SAVE AS TYPE [/b] to[b] ALL FILES [/b]
Then in the [b]FILE NAME [/b] box type [b]fix.bat[/b]
This will create a batch file
Then run fix.bat by double clicking you may see a black box appear this is normal
On completion
Run Bootkit remover again with no switches as we did at first and copy the data
Then run Combofix
thanks man.
the bootkit log:
Bootkit Remover version 1.0.0.1www.esagelab.com
\.\C: → \.\PhysicalDrive0
Size Device Name MBR Status
298 GB \.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
Press any key to quit…
now I’m gonna run combofix.
system
July 2, 2010, 2:24am
10
Combofix will not kill this I am afraid
@ECHO OFF
START remover.exe fix \\.\PhysicalDrive0
EXIT
Next you will need to create the batch fix to do that copy and paste [b]ALL[/b] of the above in the quote box to a notepad file.
Then in the text file go to [b]FILE > SAVE AS [/b] and in the dropdown box select [b]SAVE AS TYPE [/b] to[b] ALL FILES [/b]
Then in the [b]FILE NAME [/b] box type [b]fix.bat[/b]
This will create a batch file
Then run fix.bat by double clicking you may see a black box appear this is normal
On completion
Run Bootkit remover again with no switches as we did at first and copy the data
Then run Combofix
thanks man.
the bootkit log:
Bootkit Remover version 1.0.0.1www.esagelab.com
\.\C: → \.\PhysicalDrive0
Size Device Name MBR Status
298 GB \.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
Press any key to quit…
now I’m gonna run combofix.
error trying to run combofix.
system
July 2, 2010, 3:28am
11
need your help now!
system
July 2, 2010, 3:30am
12
gosh! how can I recover it?!??? :o
system
July 2, 2010, 3:37am
13
actually, after running the bootkit remover…
system
July 2, 2010, 3:55am
14
I’m trying hard to run the windows recovery console but I’m not used to it…
system
July 2, 2010, 4:05am
15
The windows Recovery Console will show a command prompt.
Type CHKDSK/r then press Enter .
Type FixMBR then press Enter . It will fix the MBR.
system
July 2, 2010, 2:29pm
17
Do you have another computer that is not infected? If so, we will try OTLPE.
First
On a non-infected computer, download ISOBurner and install the program.
Instructions on How to Use ISOBurner .
Next
Download OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 276.7Mb in size so it may take some time to download.
When downloaded double click and this will then open ISOBurner to burn the file to CD
Reboot your system using the boot CD you just created.
Note : If you do not know how to set your computer to boot from CD follow the steps here
As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads Smiley
Your system should now display a Reatogo desktop.
Note : as you are running from CD it is not exactly speedy
Double-click on the OTLPE icon.
Select the Windows folder of the infected drive if it asks for a location
When asked “Do you wish to load the remote registry” , select Yes
When asked “Do you wish to load remote user profile(s) for scanning” , select Yes
Ensure the box "Automatically Load All Remaining Users " is checked and press OK
OTL should now start.
Under the Custom Scan box paste this in
/md5start
Press Run Scan to start the scan.
When finished, the file will be saved in drive C:\OTL.txt
Copy this file to your USB drive if you do not have internet connection on this system.
Right click the file and select send to : select the USB drive.
Confirm that it has copied to the USB drive by selecting it
You can backup any files that you wish from this OS
Please post the contents of the C:\OTL.txt file in your reply.
Essexboy will have a look at your OTL log.
system
July 2, 2010, 4:28pm
18
Do you have another computer that is not infected? If so, we will try OTLPE.
First
On a non-infected computer, download ISOBurner and install the program.
Instructions on How to Use ISOBurner .
Next
Download OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 276.7Mb in size so it may take some time to download.
When downloaded double click and this will then open ISOBurner to burn the file to CD
Reboot your system using the boot CD you just created.
Note : If you do not know how to set your computer to boot from CD follow the steps here
As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads Smiley
Your system should now display a Reatogo desktop.
Note : as you are running from CD it is not exactly speedy
Double-click on the OTLPE icon.
Select the Windows folder of the infected drive if it asks for a location
When asked “Do you wish to load the remote registry” , select Yes
When asked “Do you wish to load remote user profile(s) for scanning” , select Yes
Ensure the box "Automatically Load All Remaining Users " is checked and press OK
OTL should now start.
Under the Custom Scan box paste this in
/md5start
Press Run Scan to start the scan.
When finished, the file will be saved in drive C:\OTL.txt
Copy this file to your USB drive if you do not have internet connection on this system.
Right click the file and select send to : select the USB drive.
Confirm that it has copied to the USB drive by selecting it
You can backup any files that you wish from this OS
Please post the contents of the C:\OTL.txt file in your reply.
Essexboy will have a look at your OTL log.
thanks fellow.
After you ran the batch file did the system reboot ?
When you went to recovery console and typed FIXMBR what did windows report ?
system
July 3, 2010, 12:00am
20