[Essexboy]

I definitely need to look in the affected user account as that is where the problem appears to lie... Lets try a different analysis tool from that account. This is a command version of the programme so hopefully it will run from the affected account

Download OTS to your Desktop and double-click on it to run it

• Make sure you close all other programs and don't use the PC while the scan runs.
• Select All Users
• Under additional scans select the following
  Reg - Disabled MS Config Items
  Reg - Drivers32
  Reg - NetSvcs
  Reg - SafeBoot Minimal
  Reg - Shell Spawning
  Evnt - EventViewer Logs (Last 10 Errors)
  File - Lop Check
  
• Under the Custom Scan box paste this in
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  %systemroot%\*. /mp /s
  hklm\software\clients\startmenuinternet|command /rs
  hklm\software\clients\startmenuinternet|command /64 /rs
  CREATERESTOREPOINT
  
• Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
• When the scan is complete Notepad will open with the report file loaded in it.
• Please attach the log in your next post.

[Advertisements]

I tried running the program but I received the error message saying the program failed to execute after the scan completed. That said, no log was produced. I'm going to try and run it again though.

[rvold7871]

I tried running the program but I received the error message saying the program failed to execute after the scan completed. That said, no log was produced. I'm going to try and run it again though.

[Essexboy]

OK lets be really sneaky and use a very old analysis programme - the malware may not recognise it

From the infected account

Please RIGHT-CLICK HERE and Save As (in IE it's "Save Target As", in FF it's "Save Link As") to download Silent Runners.

• Save it to the desktop.
• Run Silent Runner's by doubleclicking the "Silent Runners" icon on your desktop.
• You will receive a prompt:
  
  • Do you want to skip supplementary searches?
    click NO
• If you receive an error just click OK and double-click it to run it again - sometimes it won't run as it's supposed to the first time but will in subsequent runs.
• You will see a text file appear on the desktop - it's not done, let it run (it won't appear to be doing anything!)
• Once you receive the prompt All Done!, open the text file on the desktop, copy that entire log, and paste it here.

*NOTE* If you receive any warning message about scripts, please choose to allow the script to run.

[rvold7871]

The old scanner didn't seem to work. I never got the prompt to skip the supplementary searches...? I let it run for over a half hour and it didn't do anything. I did run the OTS in safe mode on the admin account, and I'll attach that log right now.

Attached Files

•  OTS.Txt   315.33KB   153 downloads

Edited by rvold7871, 08 June 2011 - 06:06 PM.

[rvold7871]

Nevermind. I went to Andrew's website and I downloaded the .zip file. It's working as we speak

[rvold7871]

When I tried running the script, a dialogue box appeared, saying "Some files extracted from Silent Runners.zip were modified or new files were created. Do you wish to put them in the archive? When I click yes, WinRAR: Diagnostic messages window appears, saying C:\Documents and Settings\Nutrition City\Local Settings\Temp\Silent Runners.zip: Cannot create C:\Documents and Settings\Nutrition City\Local Settings\Temp\Silent Runners.zip; Access is Denied. When I click close, more of the first messages appear, and if I click no, nothing happens. All of a sudden, I get a dialogue box with the dreaded red X titled "Windows Script Host" and here's what it says:

Script: C:\DOCUME~1\NUTRIT~1\LOCALS~1\Temp\Rar$DI92.000\Silent Runners.vbs
Line: 6128
Char: 6
Error: Not enough storage is available to complete this operation.
Code: 8007000E
Source: SWbemObjectEx

With an OK button on the bottom.

Now I'm also getting the all-to-familiar window titled "firefox.exe - Bad Image" which says, "The application or DLL C:\Program Files\Mozilla Firefox\xul.dll is not a valid Window image. Please check this against your installation diskette.

THEN, I get a window without a title, with the dreaded red X saying,

Script: C:\DOCUME~1\NUTRIT~1\LOCALS~1\Temp\Rar$DI12.3609\Silent Runners.vbs
Line: 726
Char: 3
Error: The system cannot find the file specified.
Code: 80070002
Source: (null)

With an OK button on the bottom.

Now most of my applications, when I double-click the icons, come up with an error message titled, "enter title of window here" with the familiar red X, saying:
Automation error
Insufficient system resources exist to complete the requested service.

With an OK button on the bottom.

Other programs give the error message, "C:\Program Files\"enter title here"\"enter title here"\.exe is not a valid Win32 application.

[Essexboy]

Apart from the affected account, how is the rest of the computer running. As this looks more like a corrupted user account now, and the only cure for that would be deletion

[rvold7871]

The rest of the computer seems to work fine, so it's probably a corrupted user account? What should I do from there? Is there an easy way to backup everything to a new account?

[Essexboy]

It just so happens that MS has a solution for this full details here

Once you are happy let me know and I will remove my tools and tidy you up

[rvold7871]

Will do. Thank you so much for helping me out! I'll have the report by Wednesday I'm thinking.

[Essexboy]

Ok let me know how it goes

[rvold7871]

I can't find an "advanced" tab in the "create user account menu"...?

[Essexboy]

Are you logged in as administrator ? As that is the only one with the necessary permissions

[rvold7871]

Yes. I've tried every account - they're all administrators but I can't access any "advanced" options in the User Account window.

It should also be noted that I uninstalled uTorrent and the attacks have stopped but the computer is still extremely slow and unresponsive at times.

[Essexboy]

Could you delete your current copy of combofix by right clicking

Then download and run a fresh copy please

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.