[GLFAC]

My Toshiba laptop is infected with the worm.win32.netsky virus and I need help removing it. I have Windows XP. My anti-virus expired before I had a chance to re-install and now I have the worm. I cannot install anything through my CD Rom drive. I have ran ad-aware and it did not help at all. I tried installing Norton Internet Security 2010 from a CD I purchased and it won't allow me to. It's so bad I'm lucky when my computer even boots up and when it does it freezes most of the time before I can do anything not to mention all the pop-ups for Internet Security 2010 that it wants me to purchase. This alien being has taken over my computer. I need help please!

[Advertisements]

Hello GLFAC and

I am Thomas (Tom is fine) and I'm going to help you fix your problem.

Before we begin, here are some guidelines which will help us both in fixing your problem.

• Malware removal is not instantaneous and will take a number of steps to complete. Please continue to carry out the steps requested until I let you know that your computer appears clean.
• Please do no attach logs or post them in Quote/Code boxes unless requested.
• I suggest you print or save any instructions I give you for easy reference. We may be using Safe mode and you will not always be able to access this thread. You can copy and paste these instructions into Notepad and then save the text file to your Desktop. If you need any help with this or further clarification, please let me know.
• When posting logs, please ensure Word Wrap is turned off in Notepad. Open Notepad, select Format on the menu bar and make sure that Word Wrap is unchecked.
• Please follow the steps exactly in the same order posted. If you can't perform a certain step, or you're unsure on what to do, please stop and let me know.
• If in doubt about anything, please ask.

Please follow the guide here and post back with the requested logfiles.

[schrauber]

Hello GLFAC and

I am Thomas (Tom is fine) and I'm going to help you fix your problem.

Before we begin, here are some guidelines which will help us both in fixing your problem.

• Malware removal is not instantaneous and will take a number of steps to complete. Please continue to carry out the steps requested until I let you know that your computer appears clean.
• Please do no attach logs or post them in Quote/Code boxes unless requested.
• I suggest you print or save any instructions I give you for easy reference. We may be using Safe mode and you will not always be able to access this thread. You can copy and paste these instructions into Notepad and then save the text file to your Desktop. If you need any help with this or further clarification, please let me know.
• When posting logs, please ensure Word Wrap is turned off in Notepad. Open Notepad, select Format on the menu bar and make sure that Word Wrap is unchecked.
• Please follow the steps exactly in the same order posted. If you can't perform a certain step, or you're unsure on what to do, please stop and let me know.
• If in doubt about anything, please ask.

Please follow the guide here and post back with the requested logfiles.

[GLFAC]

Hi Tom,
Well before I heard back from you I hired Norton to remove the virus. They
removed it, did a scan and it appeared to be clean. Then they installed NIS
2010 which after the fact they claim to be incompatible with Windows XP. It
appears Norton REMOVED a critical file which was infected and now I cannot
boot up my computer. When I try it brings me to c: prompt and will not allow
me to go any further. They asked me to contact Toshiba to get the Windows XP
CD however Toshiba tells me that if I use it it will wipe out my files and
restore back to original configuration. Norton of course is telling me
differently. If I would have known this in the first place I could have done
that myself without their help (what help?). Is there any help you can
provide me?
Thanks,
Greg

[schrauber]

Hi,

Sure, I think we can fix this . Only thing we need is an empty CD .


OK this file is big Print these instruction out so that you know what you are doing

Two programmes to download

First

ISOBurner this will allow you to burn OTLPE ISO to a cd and make it bootable. Just install the programme, from there on in it is fairly automatic. Instructions

Second

• Download OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 292Mb in size so it may take some time to download.
• When downloaded double click and this will then open ISOBurner to burn the file to CD
• Reboot your system using the boot CD you just created.
  
  Note : If you do not know how to set your computer to boot from CD follow the steps here
  
• Your system should now display a REATOGO-X-PE desktop.
• Double-click on the OTLPE icon.
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start. Change the following settings
  • Change Drivers to Safe List
• Under the Custom Scan box paste this in
  
  /md5start
  iaStor.sys
  nvstor.sys
  atapi.sys
  nvata.sys
  iastorv.sys
  /md5stop
  
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\_OTL\MovedFiles
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the OTL.txt file in your reply.

[GLFAC]

Tom,
I did as you asked and after I booted my computer with the cd the REATOGO-X-PE started running and then my computer shut off and now I cannot even start it. It's completely dead! What happened? In fact the a/c adapter is not even lighting when plugged in. Everything is dead! This is very disturbing!
Greg

Edited by GLFAC, 23 February 2010 - 03:51 PM.

[GLFAC]

Hi Tom,
I have to apologize to you.......my head was not screwed on very tight. I'm embarrassed to say that the a/c adapter was never plugged in and my battery died. Again I am so sorry for getting so angry. Please accept my apology.
Greg

[GLFAC]

 OTL.Txt   94.11KB   311 downloads

[schrauber]

Hi

No need to apologize


Run OTLPE

• Under the Custom Scans/Fixes box at the bottom, paste in the following

  :OTL 
  O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O21 - SSODL: boluhayob - {db1fbed5-c950-4e0d-867a-ca1ac8cfd847} - C:\WINDOWS\System32\pedisasa.dll File not found
  O21 - SSODL: dukoragik - {c699d605-71e9-478a-959d-fe48faec242b} - C:\WINDOWS\System32\pedisasa.dll File not found
  O21 - SSODL: gawopajiy - {e8e0c893-7552-461b-9a74-0301edbb72d4} - C:\WINDOWS\System32\behubaza.dll File not found
  O21 - SSODL: honowopaf - {4a358bda-287d-413d-9910-d1f9b69e86c2} - C:\WINDOWS\System32\pedisasa.dll File not found
  O21 - SSODL: latifarab - {75c4e716-b24c-49ae-9aba-f33915b32985} - C:\WINDOWS\System32\pedisasa.dll File not found
  O21 - SSODL: tefinohaz - {74168882-af76-4fea-a4e7-a3de80d24cd9} - C:\WINDOWS\System32\pedisasa.dll File not found
  O21 - SSODL: yodosobey - {03497c2c-f92c-475f-9965-6ea895093303} - C:\WINDOWS\System32\rotirufe.dll File not found
  O21 - SSODL: zagokagiy - {b22af8d9-bf21-455c-b18a-c07353feeb4f} - C:\WINDOWS\System32\behubaza.dll File not found
  O22 - SharedTaskScheduler: {03497c2c-f92c-475f-9965-6ea895093303} - jugezatag - C:\WINDOWS\System32\rotirufe.dll File not found
  O22 - SharedTaskScheduler: {4a358bda-287d-413d-9910-d1f9b69e86c2} - jugezatag - C:\WINDOWS\System32\pedisasa.dll File not found
  O22 - SharedTaskScheduler: {74168882-af76-4fea-a4e7-a3de80d24cd9} - mujuzedij - C:\WINDOWS\System32\pedisasa.dll File not found
  O22 - SharedTaskScheduler: {75c4e716-b24c-49ae-9aba-f33915b32985} - tokatiluy - C:\WINDOWS\System32\pedisasa.dll File not found
  O22 - SharedTaskScheduler: {b22af8d9-bf21-455c-b18a-c07353feeb4f} - tokatiluy - C:\WINDOWS\System32\behubaza.dll File not found
  O22 - SharedTaskScheduler: {c699d605-71e9-478a-959d-fe48faec242b} - kupuhivus - C:\WINDOWS\System32\pedisasa.dll File not found
  O22 - SharedTaskScheduler: {db1fbed5-c950-4e0d-867a-ca1ac8cfd847} - jugezatag - C:\WINDOWS\System32\pedisasa.dll File not found
  O22 - SharedTaskScheduler: {e8e0c893-7552-461b-9a74-0301edbb72d4} - tokatiluy - C:\WINDOWS\System32\behubaza.dll File not found
  [2010/02/10 17:39:24 | 000,000,000 | RH-- | M] () -- C:\WINDOWS\System32\pajarate
  [2010/02/10 09:40:03 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Yterifigocixaf.bin
  [2010/02/12 17:25:37 | 000,000,296 | ---- | M] () -- C:\WINDOWS\Tasks\xypqhrkf.job
  
  :Files
  C:\WINDOWS\system32\drivers\atapi.sys|C:\WINDOWS\ServicePackFiles\i386\atapi.sys /replace

• Then click the Run Fix button at the top
• Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
• Please post that log in your next reply.

Edited by schrauber, 24 February 2010 - 11:23 AM.

[GLFAC]

How do I copy and paste? The laptop is not recognizing my external hard drive and I don't have an internet connection on it either.

I finally figured it out......I ran the scan however the log would not open.

Edited by GLFAC, 24 February 2010 - 01:51 PM.

[schrauber]

Hi,

When you ran the scan, please try to reboot your system into normal windows now .

[GLFAC]

I'm assuming the boot menu should display "HDD"........if so it will not reboot

[schrauber]

Hi,

Did OTLPE produce a logfile from the fix? Please post it, also please post back with a fresh OTLPE logfile. Please use the same settings as the first time.

[GLFAC]

Hi Tom,
Below is the old log file and below that is the new log file.
Thanks,
Greg

Old Log File:

========== OTL ==========
Registry value HKEY_USERS\Administrator_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\boluhayob not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1fbed5-c950-4e0d-867a-ca1ac8cfd847}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\dukoragik not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c699d605-71e9-478a-959d-fe48faec242b}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\gawopajiy not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8e0c893-7552-461b-9a74-0301edbb72d4}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\honowopaf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a358bda-287d-413d-9910-d1f9b69e86c2}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\latifarab not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75c4e716-b24c-49ae-9aba-f33915b32985}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\tefinohaz not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74168882-af76-4fea-a4e7-a3de80d24cd9}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\yodosobey not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03497c2c-f92c-475f-9965-6ea895093303}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\zagokagiy not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b22af8d9-bf21-455c-b18a-c07353feeb4f}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{03497c2c-f92c-475f-9965-6ea895093303} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03497c2c-f92c-475f-9965-6ea895093303}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{4a358bda-287d-413d-9910-d1f9b69e86c2} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a358bda-287d-413d-9910-d1f9b69e86c2}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{74168882-af76-4fea-a4e7-a3de80d24cd9} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74168882-af76-4fea-a4e7-a3de80d24cd9}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{75c4e716-b24c-49ae-9aba-f33915b32985} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75c4e716-b24c-49ae-9aba-f33915b32985}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{b22af8d9-bf21-455c-b18a-c07353feeb4f} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b22af8d9-bf21-455c-b18a-c07353feeb4f}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{c699d605-71e9-478a-959d-fe48faec242b} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c699d605-71e9-478a-959d-fe48faec242b}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{db1fbed5-c950-4e0d-867a-ca1ac8cfd847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1fbed5-c950-4e0d-867a-ca1ac8cfd847}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{e8e0c893-7552-461b-9a74-0301edbb72d4} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8e0c893-7552-461b-9a74-0301edbb72d4}\ not found.
File C:\WINDOWS\System32\pajarate not found.
File C:\WINDOWS\Yterifigocixaf.bin not found.
File C:\WINDOWS\Tasks\xypqhrkf.job not found.
========== FILES ==========
File C:\WINDOWS\system32\drivers\atapi.sys successfully replaced with C:\WINDOWS\ServicePackFiles\i386\atapi.sys

OTLPE by OldTimer - Version 3.1.30.1 log created on 02262010_143847


New Log File:

========== OTL ==========
Registry key HKEY_USERS\Administrator_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\boluhayob not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1fbed5-c950-4e0d-867a-ca1ac8cfd847}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\dukoragik not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c699d605-71e9-478a-959d-fe48faec242b}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\gawopajiy not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8e0c893-7552-461b-9a74-0301edbb72d4}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\honowopaf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a358bda-287d-413d-9910-d1f9b69e86c2}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\latifarab not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75c4e716-b24c-49ae-9aba-f33915b32985}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\tefinohaz not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74168882-af76-4fea-a4e7-a3de80d24cd9}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\yodosobey not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03497c2c-f92c-475f-9965-6ea895093303}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\zagokagiy not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b22af8d9-bf21-455c-b18a-c07353feeb4f}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{03497c2c-f92c-475f-9965-6ea895093303} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03497c2c-f92c-475f-9965-6ea895093303}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{4a358bda-287d-413d-9910-d1f9b69e86c2} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a358bda-287d-413d-9910-d1f9b69e86c2}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{74168882-af76-4fea-a4e7-a3de80d24cd9} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74168882-af76-4fea-a4e7-a3de80d24cd9}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{75c4e716-b24c-49ae-9aba-f33915b32985} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75c4e716-b24c-49ae-9aba-f33915b32985}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{b22af8d9-bf21-455c-b18a-c07353feeb4f} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b22af8d9-bf21-455c-b18a-c07353feeb4f}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{c699d605-71e9-478a-959d-fe48faec242b} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c699d605-71e9-478a-959d-fe48faec242b}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{db1fbed5-c950-4e0d-867a-ca1ac8cfd847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1fbed5-c950-4e0d-867a-ca1ac8cfd847}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{e8e0c893-7552-461b-9a74-0301edbb72d4} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8e0c893-7552-461b-9a74-0301edbb72d4}\ not found.
File C:\WINDOWS\System32\pajarate not found.
File C:\WINDOWS\Yterifigocixaf.bin not found.
File C:\WINDOWS\Tasks\xypqhrkf.job not found.
========== FILES ==========
File C:\WINDOWS\ServicePackFiles\i386\atapi.sys not found.

OTLPE by OldTimer - Version 3.1.30.1 log created on 02242010_145205

[schrauber]

Hi,

• Double-click on the OTLPE icon.
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start. Change the following settings
  • Change Drivers to Safe List
• Under the Custom Scan box paste this in
  
  /md5start
  iaStor.sys
  nvstor.sys
  atapi.sys
  nvata.sys
  iastorv.sys
  /md5stop
  
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\_OTL\MovedFiles
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the OTL.txt file in your reply.

[GLFAC]

Hi Tom,
First I want to thank you for all the time you've spent helping me. I REALLY appreciate it! Norton finally conceded that they could not be of any further help....as if they didn't cause enough problems already......I said thanks but no thanks! Attached is the file OTL.txt.
Thanks,
Greg

Attached Files

•  OTL.Txt   89.55KB   273 downloads