Topic: HIDEOUS VIRUS!!!

[HAIRHEAD]

I STRONGLY recommend anyone affected to check out; GEEKS TO GO, or MAJOR GEEK for TONS of FREE artillery and advice on getting rid of viruses,malware,etc...

Cheers,

[mlinder]

I STRONGLY recommend anyone affected to check out; GEEKS TO GO, or MAJOR GEEK for TONS of FREE artillery and advice on getting rid of viruses,malware,etc...

Cheers,

They can just get it here, from me and others who do this for a living.

[333]

Mark is lucky that we don't have his phone number.  We'd be callin' him all the time.

[mlinder]

Mark is lucky that we don't have his phone number.  We'd be callin' him all the time.

Um, I think you DO have my number... just don't put it up here.

[Zaipai]

I've had some good luck with Malwarebytes.
It can find and clean a lot of stuff.

If not, give up and do what I did - switch to Linux.
-K

+1 for Linux!

Also, Just a note, we use MicroSofts Security essentials virus scan on all 30,000 PCs at work and have no problems with viruses at least sense Oct/Nov when we pushed it out. Its also way easier on system resources since most if its frame work is already in Windows.

As for Linux we run ClamAV because we are a belts and suspenders kinda IT shop. Good thing too because some one posted a Linux screensaver (package part of Xscreensaver) on gnome-look and it got a few Linux folks. So no one is immune however Linux is way low on the target list for these guys, its about the money and the money is in numbers and the numbers is Windows PC's..

Just my 2 cents.. Also nice work mlinder you posted great directions..

.: Scott :.

[Laminar]

That image is broken

Gah, beating by hotlinking. Fixed.

[Gordon]

Crap!  My computer has some nasty malware, too!

I can't even use it.  I'm on the computer at work right now.  It started out by redirecting any google or yahoo search, and constantly bringing up advertisment pop-ups in IE, even though I always use Firefox.  I ran multiple scans with Spybot S&D, Malware Bytes, Avast, and ComboFix, all in normal mode and in safe mode.  A lot of items were detected and removed, but now Windows won't even open.

The computer will boot up just fine, but then when it prompts me to choose whether I want to log in as the Owner or Administrator, regardless of the which one I choose, it will log in and then immediately log out.

Do I need to do a system recovery?  If so, what will that do, if anything, to the files on the hard drive?   

[mlinder]

Crap!  My computer has some nasty malware, too!

I can't even use it.  I'm on the computer at work right now.  It started out by redirecting any google or yahoo search, and constantly bringing up advertisment pop-ups in IE, even though I always use Firefox.  I ran multiple scans with Spybot S&D, Malware Bytes, Avast, and ComboFix, all in normal mode and in safe mode.  A lot of items were detected and removed, but now Windows won't even open.

The computer will boot up just fine, but then when it prompts me to choose whether I want to log in as the Owner or Administrator, regardless of the which one I choose, it will log in and then immediately log out.

Do I need to do a system recovery?  If so, what will that do, if anything, to the files on the hard drive?   

If you can wait til tomorrow, I will help you with this, ok?

[Gordon]

If you can wait til tomorrow, I will help you with this, ok?

I'd be happy to wait if you can help!  

I have a PalmTx that I can get online with at home.  It's really hard to navigate this website on it, but I think it's do-able.  I'll check in tomorrow morning.  Thanks!

[mlinder]

If you can wait til tomorrow, I will help you with this, ok?

I'd be happy to wait if you can help!  

I have a PalmTx that I can get online with at home.  It's really hard to navigate this website on it, but I think it's do-able.  I'll check in tomorrow morning.  Thanks!

Ima go watch season finale of Heroes. You have a machine you can download stuff to and burn a CD? Or do you have an OS disk? We have some registry fixing to do.
Your winlogon regestry entry has been changed by the malware from the proper 'userinit' to something else.
If not, we can prolly do this from the logon screen.

[Gordon]

You have a machine you can download stuff to and burn a CD? Or do you have an OS disk? We have some registry fixing to do.

Neither, unfortunately.  That's our only computer, and it came with XP installed and no disk.  I can't download or burn anything at work either. 

Gotta get back to work for now...

[mlinder]

OK, we'll try this a different way.

Quick try here, ok?

at the login screen, try cntrl+alt+del, see if we can't bring up the task manager.
At the task manager, hit "new task".
Type in "regedit"
If it lets you in, go to

hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon

in there, over to the right, you'll see a dword named userinit

right click it, go to 'change value' or whatever and put in "userinit.exe" without the quotes.

Save it, restart, then follow my instructions from the begining of this thread.

If that doesn't work, Ill need you to get somewhere you can download and burn an .iso for us to fix this.

[Achmed]

Check out the big brain on Brett! You're a smart motherfukker, aren't you.

It's cool you guys are helping each other out.

[Laminar]

Ima go watch season finale of Heroes. You have a machine you can download stuff to and burn a CD? Or do you have an OS disk? We have some registry fixing to do.
Your winlogon regestry entry has been changed by the malware from the proper 'userinit' to something else.
If not, we can prolly do this from the logon screen.

Did they finally figure out a plot for this season? I hung on through the past few seasons but about 4 or 5 episodes into this one I gave up - it was a mess, with little to no continuity or excitement, at least for me.

[mlinder]

Check out the big brain on Brett! You're a smart motherfukker, aren't you.

It's cool you guys are helping each other out.

The metric system!

I'm here to help, when I'm not here to hurt.

[mlinder]

Ima go watch season finale of Heroes. You have a machine you can download stuff to and burn a CD? Or do you have an OS disk? We have some registry fixing to do.
Your winlogon regestry entry has been changed by the malware from the proper 'userinit' to something else.
If not, we can prolly do this from the logon screen.

Did they finally figure out a plot for this season? I hung on through the past few seasons but about 4 or 5 episodes into this one I gave up - it was a mess, with little to no continuity or excitement, at least for me.

Yeah dude, there's a reason it was all disjointed like that. I felt the same way as you, but kept watching. It comes together, more or less.

[Duke McDukiedook]

That show had good potential- then they took a big dump on the viewers mid-first season and haven't stopped shoveling it since.

I stopped watching after the a couple of eps into season 2.

[Laminar]

I think less people #$%*ing and conniving and more wrecking-#$%*-with-superpowers would have kept my attention better. But then again, I enjoyed Transformers 2.

[mlinder]

Gordon, are you going to be able to have access to a computer that works, with a CD burner?

Please let me know.

[333]

Mark is lucky that we don't have his phone number.  We'd be callin' him all the time.

Um, I think you DO have my number... just don't put it up here.

Actually, I think I deleted it before I could write it down.  It's okay.  I know how to get you if I really need you.

[Frostyboy]

This is all very interesting. I'm not experiencing any particular problems, however just like maintaining a SOHC, I thought I'd run combofix just to see if my machine is healthy.
It produced a text file a mile long that means diddly squat to me. I'm not sure if it found anything or not.
mlinder, you sound like a very generous IT type of guy. Can you interpret the report if I post it or send it to you?
I don't want to impose, it's just from your comments here:
"I'm here to help, when I'm not here to hurt." it sounds like you might.
Feel free to tell me to go my own way if it's a problem. Cheers. 

[mlinder]

Just post the first page here. f it found something, the list will start with "other deletions".

Happy to help.

[Frostyboy]

Thanks for that. Below is all that is under "Other Deletions" but there's many pages more to it. There's a long list in "Find3M Report". Is that of any significance?

((((   Other Deletions   ))))
c:\documents and settings\Willie\My Documents\cc_20090715_1253.reg
c:\program files\Common Files\Real\WeatherBug\MiniBugTransporter.dll

Cheers.

[mlinder]

Nope.

You did have a bit malware there.
Weatherbug, whichc is pretty mild, but then that other is a registry change. No idea what it is.
Lookis like you are ok, though, just keep running your regular anti-malware and antivirus programs, on a regular schedule.

[Frostyboy]

Thanks mlinder,
You've put my mind at rest. I can explain the other entry there. I often run a little proggy called CCleaner. It clears out temp files, web history etc & asks if I want to back up before it changes anything. That's one out of quite a number that are still on the machine. Going by the file name it was a backup created on 15 July 09. I wonder what was different for it to pick that one. Never mind, all's good.
Cheers