Can't run programs or connect to internet

[Xerinous]

I can't run the scanner on the infected machine, I'm still having all of the original problems, including the lack of internet connection.

[Dr Jay]

Would you be up to do a data-safe system repair, or do you not have a disc to do that?

[Xerinous]

I don't think we have the disk for it, but I could be wrong. Although I'm not sure I know what that is.

[Dr Jay]

Download Preformat.zip by Noviciate from here and save it to your Desktop. You will need to extract the file.

Right click on the zipped folder and from the menu that appears, click on Extract All...

In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

You should now see a folder with a .vbs file in it. Double click Preformat.vbs to run it and a text file called Preformat.txt should be created in the same folder - either that or you'll get an error message.

Please copy and paste the contents of the text file into your next reply and
then you can delete both of the folders and their contents.

[Xerinous]

I can't get the program to run, I got it onto the machine with no problems but double clicking or clicking and hitting enter don't start the program, nor does right click > open.

[Dr Jay]

I'm very suspicious of something.

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3[/list]

• Double-click on MBRCheck.exe to run it.
  
• It will open a black window...please do not fix anything (if it gives you an option).
  
• When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
  
• A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
• Please copy and paste the contents of that log in your next reply.

[Xerinous]

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:         
Windows Version:      Windows XP Professional
Windows Information:      Service Pack 3 (build 2600)
Logical Drives Mask:      0x000001fd

Kernel Drivers (total 155):
  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
  0x806E4000 \WINDOWS\system32\hal.dll
  0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
  0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
  0xB9F79000 ACPI.sys
  0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xB9F68000 pci.sys
  0xBA0A8000 isapnp.sys
  0xBA670000 pciide.sys
  0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xBA0B8000 MountMgr.sys
  0xB9F49000 ftdisk.sys
  0xBA5AC000 dmload.sys
  0xB9F23000 dmio.sys
  0xB9F10000 nvraid.sys
  0xBA0C8000 \WINDOWS\system32\drivers\CLASSPNP.SYS
  0xBA330000 PartMgr.sys
  0xBA0D8000 VolSnap.sys
  0xB9EF8000 atapi.sys
  0xB9EE1000 nvatabus.sys
  0xBA0E8000 disk.sys
  0xB9EC1000 fltmgr.sys
  0xB9EAF000 sr.sys
  0xB9E53000 mfehidk.sys
  0xB9E3E000 drvmcdb.sys
  0xBA0F8000 PxHelp20.sys
  0xB9E27000 KSecDD.sys
  0xB9E14000 WudfPf.sys
  0xB9D87000 Ntfs.sys
  0xB9D5A000 NDIS.sys
  0xBA108000 ohci1394.sys
  0xBA118000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xB9D40000 Mup.sys
  0xBA138000 \SystemRoot\system32\DRIVERS\nic1394.sys
  0xBA1E8000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xB8E66000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
  0xB8E52000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xBA420000 \SystemRoot\system32\DRIVERS\fdc.sys
  0xBA1F8000 \SystemRoot\system32\DRIVERS\serial.sys
  0xB918B000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xBA428000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xB8E2E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xBA430000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xBA208000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xBA60A000 \SystemRoot\system32\drivers\sscdbhk5.sys
  0xBA218000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA228000 \SystemRoot\system32\DRIVERS\redbook.sys
  0xB8E0B000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA438000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
  0xB8D9F000 \SystemRoot\system32\drivers\ctaud2k.sys
  0xB8D7B000 \SystemRoot\system32\drivers\portcls.sys
  0xBA238000 \SystemRoot\system32\drivers\drmk.sys
  0xB8D49000 \SystemRoot\system32\drivers\ctoss2k.sys
  0xB8D25000 \SystemRoot\system32\drivers\mfeavfk.sys
  0xB8CDA000 \SystemRoot\system32\drivers\mfefirek.sys
  0xBA440000 \SystemRoot\system32\drivers\ctprxy2k.sys
  0xBA248000 \SystemRoot\system32\DRIVERS\IntelC53.sys
  0xB8BB3000 \SystemRoot\system32\DRIVERS\IntelC51.sys
  0xB8B1E000 \SystemRoot\system32\DRIVERS\IntelC52.sys
  0xBA450000 \SystemRoot\system32\DRIVERS\mohfilt.sys
  0xBA458000 \SystemRoot\System32\Drivers\Modem.SYS
  0xBA590000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
  0xB8AD8000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
  0xB8AA4000 \SystemRoot\system32\DRIVERS\NVSNPU.SYS
  0xBA78D000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xB8A90000 \SystemRoot\system32\DRIVERS\mfendisk.sys
  0xBA258000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xBA598000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xB8A79000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xBA268000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xBA278000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xBA460000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xB8A68000 \SystemRoot\system32\DRIVERS\psched.sys
  0xB98A8000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xBA468000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xBA480000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xBA470000 \SystemRoot\system32\DRIVERS\wanatw4.sys
  0xB8A38000 \SystemRoot\system32\DRIVERS\rdpdr.sys
  0xB9898000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xBA478000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xBA488000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xBA610000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB89B2000 \SystemRoot\system32\DRIVERS\update.sys
  0xB9D07000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xB9888000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
  0xB9878000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xBA298000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xBA616000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xB9C3C000 \SystemRoot\system32\drivers\MODEMCSA.sys
  0xB5FE6000 \SystemRoot\system32\drivers\ha20x2k.sys
  0xB5FB9000 \SystemRoot\system32\drivers\emupia2k.sys
  0xB5908000 \SystemRoot\system32\drivers\ctsfm2k.sys
  0xB586C000 \SystemRoot\system32\drivers\ctac32k.sys
  0xB57C0000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0xB8A1C000 \SystemRoot\System32\Drivers\i2omgmt.SYS
  0xBA6B7000 \SystemRoot\System32\Drivers\Cdr4_xp.SYS
  0xBA71B000 \SystemRoot\System32\Drivers\Cdralw2k.SYS
  0xBA666000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xBA723000 \SystemRoot\System32\Drivers\Null.SYS
  0xBA668000 \SystemRoot\System32\Drivers\Beep.SYS
  0xB57A0000 \SystemRoot\system32\drivers\ssrtln.sys
  0xB510E000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xB5106000 \SystemRoot\System32\drivers\vga.sys
  0xBA66C000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xBA66E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xB50FE000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xB50F6000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xB8A10000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xB2D58000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xB2CFF000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xB2CEC000 \SystemRoot\system32\drivers\mfetdi2k.sys
  0xB2CC6000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xB2C62000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xB5F69000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB2C36000 \SystemRoot\System32\drivers\afd.sys
  0xB5F59000 \SystemRoot\system32\DRIVERS\arp1394.sys
  0xB5F49000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xB2C0B000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xB2B9B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB5F39000 \SystemRoot\System32\Drivers\Fips.SYS
  0xB6516000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0xB52F3000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xB50D6000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xB9C30000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xB3609000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0xB12B8000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xAAFFC000 \SystemRoot\System32\Drivers\dump_nvraid.sys
  0xAB541000 \SystemRoot\System32\Drivers\dump_CLASSPNP.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xABC4A000 \SystemRoot\System32\drivers\Dxapi.sys
  0xB3772000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xBA6A6000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32\nv4_disp.dll
  0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
  0xB9828000 \SystemRoot\system32\drivers\drvnddm.sys
  0xAB1A6000 \SystemRoot\system32\dla\tfsndres.sys
  0xAA045000 \SystemRoot\system32\dla\tfsnifs.sys
  0xAFB15000 \SystemRoot\system32\dla\tfsnopio.sys
  0xBA5DC000 \SystemRoot\system32\dla\tfsnpool.sys
  0xB2DCE000 \SystemRoot\system32\dla\tfsnboio.sys
  0xB9818000 \SystemRoot\system32\dla\tfsncofs.sys
  0xAB1A5000 \SystemRoot\system32\dla\tfsndrct.sys
  0xAA02C000 \SystemRoot\system32\dla\tfsnudf.sys
  0xAA013000 \SystemRoot\system32\dla\tfsnudfa.sys
  0xB9C4C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xA9FE6000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xA9FD5000 \SystemRoot\System32\Drivers\adfs.SYS
  0xBA60C000 \SystemRoot\system32\DRIVERS\dsunidrv.sys
  0xA9794000 \SystemRoot\System32\Drivers\HTTP.sys
  0xA9261000 \SystemRoot\system32\drivers\mfeapfk.sys
  0xAB4F1000 \SystemRoot\system32\drivers\mfebopk.sys
  0xA91A0000 \SystemRoot\System32\Drivers\Fastfat.SYS
  0xBA632000 \??\C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
  0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 45):
       0 System Idle Process
       4 System
    1000 C:\WINDOWS\system32\smss.exe
    1056 csrss.exe
    1080 C:\WINDOWS\system32\winlogon.exe
    1124 C:\WINDOWS\system32\services.exe
    1136 C:\WINDOWS\system32\lsass.exe
    1528 C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    1540 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    1560 C:\Program Files\Bonjour\mDNSResponder.exe
    1592 C:\WINDOWS\system32\CTSVCCDA.EXE
    1636 C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    1688 C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
    1764 C:\Program Files\Java\jre6\bin\jqs.exe
    1852 C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    1884 C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    1928 C:\WINDOWS\system32\nvsvc32.exe
    1948 C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    1968 C:\WINDOWS\wanmpsvc.exe
    2016 C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
     116 C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
     408 C:\WINDOWS\explorer.exe
     904 C:\WINDOWS\CTHELPER.EXE
     920 C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
     944 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
     952 C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.exe
     960 C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
     980 C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
     656 C:\WINDOWS\system32\dla\tfswctrl.exe
    1020 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    1036 C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    1476 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
    1684 C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
    1820 C:\Program Files\Common Files\AOL\1144616972\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
    1876 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
     272 C:\Program Files\BellSouth\HelpCenter\bin\sprtcmd.exe
     300 C:\Program Files\Dell Support Center\bin\sprtcmd.exe
     368 C:\Program Files\Java\jre6\bin\jusched.exe
     384 C:\Program Files\McAfee.com\Agent\mcagent.exe
     388 C:\Program Files\DellSupport\DSAgnt.exe
    1916 C:\Program Files\Hewlett-Packard\AiO\hp officejet k series\Bin\hpoorn07.exe
     232 C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
    1268 C:\Program Files\Citrix\ICA Client\pnagent.exe
     896 C:\Program Files\Dell Support Center\gs_agent\dsc.exe
    2692 I:\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00  (NTFS)

PhysicalDrive0 Model Number: NVIDIAMIRROR   149.01G, Rev:

      Size  Device Name          MBR Status
  --------------------------------------------
    149 GB  \\.\PhysicalDrive0   RE: Windows XP MBR code detected
            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644 A


Done!

[Dr Jay]

Fix using MBRCheck.exe

Run MBRCheck.exe again by double-clicking on it.

• Wait until you see the following line: Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  
• Enter 'Y' and then press Enter.
  
• When asked: 'Enter your choice:', select option 2 (Restore the MBR of a physical disk with a standard boot code) and press the Enter key.
  
• Now the program will ask: 'Enter the physical disk number to fix (0-99, -1 to cancel)'
  
• Enter 0 and press the Enter key.
  
• The program will show Available MBR codes followed by a list of operating systems as shown below:
  

  Available MBR codes:
  [ 0] Default (Windows XP)
  [ 1] Windows XP
  [ 2] Windows Server 2003
  [ 3] Windows Vista
  [ 4] Windows 2008
  [ 5] Windows 7
  [-1] Cancel
  Please select the MBR code to write to this drive:
  

• Please select your version of Windows from the list and enter the corresponding number and then press Enter.
  
• When prompted for confirmation: "Do you want to fix the MBR code?". Type the full word Yes (not Y or the fix will not work) and press Enter.
  
• Left-click on the title bar (where program name and path is written).
• From the menu chose Edit -> Select All.
  
• Press the Enter key to copy selected text.
  
• Open Notepad, paste that text into it and save to your desktop as MBRCheck.txt.
  
• When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
  
• Reboot your computer to complete the fix and copy/paste MBRCheck.txt in your next reply.
  
• If your computer does not restart on its own, please restart it manually.

Important Note: The Master Boot Record contains the Partition Table for the hard disk and a a little executable code for the boot start. While fixing the Master Boot Record (MBR) is generally safe, there is a small risk of damaging the MBR, which may cause the computer to not boot up or it may corrupt a partition.

The following are signs of a damaged MBR:

• Invalid Partition Table
• Missing Operating System
• Error loading operating system

If it is the worst case scenario, and your computer cannot boot, please take note of the following:

Please have your Windows CD available, which will allow recovering the boot code via the Windows Recovery Console in case of any problems or install the XP Recovery Console before proceeding with the above fix. Then, if any problems occur, the links below explain how to use and repair the MBR:

• How to use the Recovery Console
• How to fix MBR in Windows XP and Vista

If you do not have a Windows CD available, please let me know. You will need access to a computer that can burn CDs.

[Xerinous]

The MBRcheck method doesn't allow the input, it just runs through really fast and says "Done! Press Enter to exit...".

I can't seem to find our windows disk anymore either.

[Dr Jay]

Allow us to try this...

Download Bootkit Remover to your Desktop.

• You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
  
• After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.
  
• It will show a Black screen with some data on it.
• Right click on the screen and click Select All.
  
• Press Enter
  
• Open a Notepad and press CTRL V
• Post the output back here.

[Xerinous]

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive0
SPTI_Read(): DeviceIoControl() ERROR 1
ERROR: SPTI_Read() fails for \\.\PhysicalDrive0
MD5: 6def5ffcbcdbdb4082f1015625e597bd

     Size  Device Name          MBR Status
 --------------------------------------------
   149 GB  \\.\PhysicalDrive0   OK (DOS/Win32 Boot code found)


Press any key to quit...

[Dr Jay]

Good. There is nothing wrong with the MBR.

Please download Norman Malware Cleaner and save to your desktop.
alternate download link

• Double-click on Norman_Malware_Cleaner.exe to start the program.
  
• Read the End User License Agreement and click the Accept button to open the scanning window.
  
• Click Start Scan to begin.
  
• In some cases Norman Malware Cleaner may require that you restart the computer to completely remove an infection. If prompted, reboot and run the tool again to ensure that all infections are removed.
  
• After the scan has finished, a log file with the date (i.e. NFix_2009-06-22_07-08-56.log) will be created on your desktop with the results.

Note: For usb flash drives and/or other removable drives to scan, use the Add button to browse to the drives location, click on the drive to highlight and choose Ok.

[Xerinous]

Alright, the scan finished and generated the log. Post it?

[Dr Jay]

If the log is not too big, go ahead with posting it. (Sorry for delay )

[Xerinous]

It is quite large, probably not good for posting.

The problems still persist as well.