Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Infected Computer with possible backdoor Trojans and rootkits [Solved]


  • This topic is locked This topic is locked

#16
BohoGypsy

BohoGypsy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 38 posts
This is the only thing that happens

Attached Files

  • Attached File  CBS.txt   361bytes   45 downloads

  • 0

Advertisements


#17
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,967 posts
Seems large. Where you able to upload the file to the link above?
  • 0

#18
BohoGypsy

BohoGypsy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 38 posts
No, I wanted you to take a look first. It says nothing on it....
  • 0

#19
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,967 posts
It is 0662225 bytes. It will take some time to notepad to collect that information. But it isn't empty.
  • 0

#20
BohoGypsy

BohoGypsy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 38 posts
okay, let me know the next steps to take. I am trying to finish a resume at the moment....
  • 0

#21
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,967 posts
We can make it smaller.

Press the Windows Key+R. At the Run window copy and paste the following command (including the quotation marks) and click OK:

cmd /c findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >"%Userprofile%\desktop\sfcdetails.txt"

A report, (sfcdetails.txt) will be produced on your desktop. See if Notepad can open it or have it uploaded to the link above.
  • 0

#22
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,967 posts
It is late here. Will check on you in the AM.
  • 0

#23
BohoGypsy

BohoGypsy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 38 posts
I am sorry, but I wasn't near my computer yesterday. I tried what you said, and nothing happens.
  • 0

#24
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,967 posts
Lets do this in an Administrator Command prompt.



Press Start, type CMD and press the CTRL+SHIFT+ENTER keys simultaneously. This should open the Adminitrator Command Prompt. At the Prompt copy and paste the following command (including the quotation marks) and press Enter:

findstr /c:"[SR]" C:\Windows\logs\cbs\cbs.log >"%Userprofile%\desktop\sfcdetails.txt"

A report, (sfcdetails.txt) will be produced on your desktop. See if Notepad can open it or have it uploaded to the link above.
  • 0

#25
BohoGypsy

BohoGypsy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 38 posts
That worked! Here it is attached. I will be around all day today. Let's see if we can get this fixed!

Attached Files


  • 0

Advertisements


#26
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,967 posts
All it comes to the following files, which wouldn't affect the performance of the computer.

tzres.dll.mui
lmhosts.sam
tcpmon.ini
Windows Exclamation.wav
settings.ini


Lets check the services and MBR.

Please download the latest version of TDSSKiller from here and save it to your Desktop.
  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
    Posted Image
  • Put a checkmark beside loaded modules.
    Posted Image
  • A reboot will be needed to apply the changes. Do it.
  • TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  • Then click on Change parameters in TDSSKiller.
  • Check all boxes then click OK.
    Posted Image
  • Click the Start Scan button.
    Posted Image
  • The scan should take no longer than 2 minutes.
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
    Posted Image
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    Posted Image
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  • A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

  • 0

#27
BohoGypsy

BohoGypsy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 38 posts
Here is the log...also I did run this a few weeks ago and it quarantined items.

Attached Files


  • 0

#28
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,967 posts
Run TDSSKiller and delete the following:

\Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
\Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip


Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • OTL should now start. Change the following settings
    • Change Drivers to All
    • Change Standard Registry to All
    • Under File Scans, change File age to 30
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt (first run only). These are saved in the same location as OTL.
    • Please post the contents of the OTL.txt file and attach the Extras.Txt, if any, in your next reply.

How is the computer doing?
  • 0

#29
BohoGypsy

BohoGypsy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 38 posts
I will go ahead and do that. It seems okay, it just won't run any scans. It freezes. Except, we had about 4 hours of horrific thunderstorms here and the power went out well I was using my computer {my battery doesn't work}. After we got power back, my computer went to that grey screen that said it had to repair windows. It wanted to use system restore, but I clicked cxl. Also, I noticed that when I Google my "name" items show up all over "spam" pages, including things that were private on my computer and Facebook. I can only think malicious tracking cookies? Thanks for all your help. I really appreciate it.
  • 0

#30
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,967 posts

I will go ahead and do that. It seems okay, it just won't run any scans. It freezes. Except, we had about 4 hours of horrific thunderstorms here and the power went out well I was using my computer {my battery doesn't work}. After we got power back, my computer went to that grey screen that said it had to repair windows. It wanted to use system restore, but I clicked cxl. Also, I noticed that when I Google my "name" items show up all over "spam" pages, including things that were private on my computer and Facebook. I can only think malicious tracking cookies? Thanks for all your help. I really appreciate it.

To help remove the cookies in your computer, use Superantispyware.

Download and scan with SUPERAntiSpyware (Free for Home Users) and follow these instructions

If you feel the your information has been exploited, change your password on all these sites. That should provide some protection.

Please download Farbar Service Scanner and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

Keep me posted.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP