Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Hijack Log- Fake Visa Verification Site [CLOSED]

Started by decane , Jun 23 2008 10:03 PM

  • This topic is locked This topic is locked

#91
fenzodahl512
Posted 04 July 2008 - 12:57 PM

fenzodahl512

  • Malware Removal
  • 9,863 posts
Ok, let see if those two files are still there...

Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
EmptyTemp
purity
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


Post the OTMoveIT2 log here..
  • 0

Advertisements

#92
decane
Posted 04 July 2008 - 01:16 PM

decane

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 105 posts
The machine rebooted.

Explorer killed successfully
< EmptyTemp >
File delete failed. C:\WINDOWS\temp\bca4e2da.$$$ scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\fa56d7ec.$$$ scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.
< purity >
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07042008_150712

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\bca4e2da.$$$ scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\fa56d7ec.$$$ scheduled to be moved on reboot.
  • 0

#93
fenzodahl512
Posted 04 July 2008 - 01:32 PM

fenzodahl512

  • Malware Removal
  • 9,863 posts
Ok.. Those files are still there.. I'm calling the big guns now.. Waiting for their reply..


Thank you for being patience with me..

Regards
fenzodahl512
  • 0

#94
decane
Posted 04 July 2008 - 01:50 PM

decane

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 105 posts
Ok. Lets do it. Thanks.
  • 0

#95
fenzodahl512
Posted 04 July 2008 - 02:32 PM

fenzodahl512

  • Malware Removal
  • 9,863 posts
Hello.. It seems we need to run fix via Recovery Console..


First, please restart your computer and, you'll see the option for the Recovery Console... Choose that!

Please refer here for step-by-step information regarding Recovery Console


Once you enter Recovery Console, you will have Which Windows installation would you like to log onto question.. Choose the number that direct you to C:\WINDOWS (usually 1) and press Enter..


At Type the Administrator password request, enter the password and press Enter. (If you do not set the password, simply press Enter.


The Recovery Console is now fully loaded. At C:\WINDOWS, please type fixmbr and press Enter.. Follow all the prompt...


After it finish.. Please restart your computer and tell me about it...
  • 0

#96
decane
Posted 04 July 2008 - 03:03 PM

decane

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 105 posts
dumb question - how do I access the recovery console?

I don't have the XP disk. It was preinstalled on my laptop.

I tried to hold down F8 when I rebooted, but it didn't provide a recovery console option.

I then rebooted and held down R. It allowed me to select recovery console, but it did not ask me for a password. Instead it compressed something and then rebooted. I'm not doing something right.

Thanks.
  • 0

#97
fenzodahl512
Posted 04 July 2008 - 04:18 PM

fenzodahl512

  • Malware Removal
  • 9,863 posts

dumb question - how do I access the recovery console?

I don't have the XP disk. It was preinstalled on my laptop.

I tried to hold down F8 when I rebooted, but it didn't provide a recovery console option.

I then rebooted and held down R. It allowed me to select recovery console, but it did not ask me for a password. Instead it compressed something and then rebooted. I'm not doing something right.

Thanks.


No... It is not a dumb question.. :)


Ok.. please refer to website below:

http://www.howtogeek...-on-windows-xp/


Skip the above part and start reading from Accessing the Recovery Console part..

Do you see the screen below?

Posted Image

Please just choose Microsoft Windows Recovery Console via your arrow key and then press Enter.. (Don't press F8)

Then you will see below screen..

Posted Image

Type 1 and press Enter

Next, at C:\WINDOWS just type fixmbr and press Enter.. Then just follow the instruction (if any)..

Restart your computer and tell me about it..


p/s: You might need to print this for your review :)
  • 0

#98
decane
Posted 04 July 2008 - 09:42 PM

decane

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 105 posts
I'm back. I'm able to see the first screen. I selected the Recovery Console Option, but it doesn't take me to the 2nd screen pictured in your email.

Instead I get a screen that says:
NTDLR is compressed.
Press Ctrl+Alt+Del to restart

I'm unable to type anything on this screen. The only thing I can do is restart.

I'm never presented the C:Windows nor can I enter a password or type in fixmbr.
  • 0

#99
decane
Posted 05 July 2008 - 06:46 AM

decane

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 105 posts
It's 8:45am. I'm back on and ready to get rid of this thing :)
  • 0

#100
fenzodahl512
Posted 05 July 2008 - 09:16 AM

fenzodahl512

  • Malware Removal
  • 9,863 posts

It's 8:45am. I'm back on and ready to get rid of this thing :)



Hello decane, sorry for the delay.. Currently I'm consulting the experts regarding your computer problem.. Please bear with me.. It seems we have a toughie here :)


Regards
fenzodahl512
  • 0

Advertisements

#101
decane
Posted 05 July 2008 - 09:31 AM

decane

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 105 posts
No problem. Do you think the issues that I'm having with the Recovery console are related to the malware?
  • 0

#102
fenzodahl512
Posted 05 July 2008 - 09:41 AM

fenzodahl512

  • Malware Removal
  • 9,863 posts

No problem. Do you think the issues that I'm having with the Recovery console are related to the malware?



To be honest, you have a dangerous rootkit called mbr rootkit.. MBR is Master Boot Record..

More information about MBR can be found below:

http://en.wikipedia....ter_boot_record

In order to fix your MBR, we need to do it via Recovery Console.. Unfortunately, you can't access it (even after you install Recovery Console)..

I need to wait for expert input before I can give you further instruction (or if I find something new and good).. If you can find a Windows XP cd, it would be very handy I believe.. Can you find one?
  • 0

#103
decane
Posted 05 July 2008 - 10:02 AM

decane

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 105 posts
I don't have an XP CD because it was came pre-installed on my laptop. They didn't provide any physical CDs.

I don't want to do this yet, but would reformatting the laptop eliminate the problem. Approximately, how long would the reformatting process take?
  • 0

#104
fenzodahl512
Posted 05 July 2008 - 10:06 AM

fenzodahl512

  • Malware Removal
  • 9,863 posts
Erm.. before we thinking about re-formatting.. Please navigate below website..

http://h10025.www1.h...p;product=12455


Please follow instruction from Alternate steps and then tell me about it...


Regards
fenzodahl512
  • 0

#105
decane
Posted 05 July 2008 - 11:17 AM

decane

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 105 posts
:) I literally compressed the files within the last 2 weeks. I was running out of space so I did it. Afterwards someone told me that it could present problems in the future. I guess they were right.

I don't have any CDs so I'm going to try the 2nd option.

I should have something to post within the next 30 minutes.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP