Tech Support Forum - View Single Post - Shutdown error

Ried · 03-03-2006, 05:54 PM

Hi Timmy_j,

You are quite a way from being clean as you have quite a collection of various malware here. It is imperative you follow these instructions and provide the logs requested.

You've finally run a scan with HijackThis from Normal Mode, but you didn't post the entire log.

Also, from what I can see, you appear to have 2 Anti-Virus programs running. (Trend Micro and Symantec) You need to choose and run only 1 as 2 AV's will conflict with one another and can cause system instability.

Now, let's get to the fix. In an effort to save a bit of time, I'll try to work with what you've given me.

---------------------------

Please copy this page to Notepad since you will not have any browsers open while you are carrying out these instructions. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

*Note* Alternate download sites for smitrem... http://www.downloads.subratam.org/smitRem.exe
http://www.bleepingcomputer.com/file...ar/smitRem.exe

Download DelDomains.inf
Right-click and select..... Save Target As

To use: Right-click and select....... Install (no need to restart)
**Note** This will remove all entries in the "Trusted Zone"

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Don't run it yet!

---------------------------

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading:
* select Show hidden files and folders.
* Uncheck Hide protected operating system files (recommended) option.
*Also, make sure there is no checkmark beside Hide file extensions for known file types.
* Click OK.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.

---------------------------

Using Windows Explorer, navigate to and delete the following Files and Folders if they still exist.

C:\WINDOWS\SYSTEM32\azebar.xml
C:\Documents and Settings\Johnson family\Local Settings\Temporary Internet Files\Ssk.log
C:\WINDOWS\drsmartload2.dat
C:\WINDOWS\uniq
C:\PROGRAM FILES\COMMON FILES\Totem Shared
C:\PROGRAM FILES\COMMON FILES\VCClient

---------------------------

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

---------------------------

Open Ad-aware and do a full scan. Remove all it finds.

---------------------------

Run Ewido:

Click on scanner
Click on Complete System Scan and the scan will begin.
NOTE: During some scans with ewido it is finding cases of false positives.
You will need to step through the process of cleaning files one-by-one.
If ewido detects a file you KNOW to be legitimate, select none as the action.
DO NOT select "Perform action on all infections"
If you are unsure of any entry found select none for now.
When the scan is finished, click the Save report button at the bottom of the screen.
Save the report to your desktop

Close Ewido

---------------------------

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck everything listed there.

---------------------------

Reboot back into Normal Mode.

Run another online scan at Panda and post the results here along with a new HijackThis log, the smitfiles.txt and the Ewido scan results.

So in your next reply, I will need the following reports:

smitfiles.txt
Ewido results
Panda scan results
HijackThis log from Normal Mode

03-03-2006, 05:54 PM	#12 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Hi Timmy_j, You are quite a way from being clean as you have quite a collection of various malware here. It is imperative you follow these instructions and provide the logs requested. You've finally run a scan with HijackThis from Normal Mode, but you didn't post the entire log. Also, from what I can see, you appear to have 2 Anti-Virus programs running. (Trend Micro and Symantec) You need to choose and run only 1 as 2 AV's will conflict with one another and can cause system instability. Now, let's get to the fix. In an effort to save a bit of time, I'll try to work with what you've given me. --------------------------- Please copy this page to Notepad since you will not have any browsers open while you are carrying out these instructions. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. Download smitRem.exe and save the file to your desktop. Double click on the file to extract it to it's own folder on the desktop. Note Alternate download sites for smitrem... http://www.downloads.subratam.org/smitRem.exe http://www.bleepingcomputer.com/file...ar/smitRem.exe Download DelDomains.inf Right-click and select..... Save Target As To use: Right-click and select....... Install (no need to restart) Note This will remove all entries in the "Trusted Zone" If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates: Ad-Aware SE Setup Don't run it yet! --------------------------- Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading: * select Show hidden files and folders. * Uncheck Hide protected operating system files (recommended) option. Also, make sure there is no checkmark beside Hide file extensions for known file types. Click OK. Next, please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. --------------------------- Using Windows Explorer, navigate to and delete the following Files and Folders if they still exist. C:\WINDOWS\SYSTEM32\azebar.xml C:\Documents and Settings\Johnson family\Local Settings\Temporary Internet Files\Ssk.log C:\WINDOWS\drsmartload2.dat C:\WINDOWS\uniq C:\PROGRAM FILES\COMMON FILES\Totem Shared C:\PROGRAM FILES\COMMON FILES\VCClient --------------------------- Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply. --------------------------- Open Ad-aware and do a full scan. Remove all it finds. --------------------------- Run Ewido: Click on scanner Click on Complete System Scan and the scan will begin. NOTE: During some scans with ewido it is finding cases of false positives. You will need to step through the process of cleaning files one-by-one. If ewido detects a file you KNOW to be legitimate, select none as the action. DO NOT select "Perform action on all infections" If you are unsure of any entry found select none for now. When the scan is finished, click the Save report button at the bottom of the screen. Save the report to your desktop Close Ewido --------------------------- Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck everything listed there. --------------------------- Reboot back into Normal Mode. Run another online scan at Panda and post the results here along with a new HijackThis log, the smitfiles.txt and the Ewido scan results. So in your next reply, I will need the following reports: smitfiles.txt Ewido results Panda scan results HijackThis log from Normal Mode __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."