Win 7 unable to use or create restore point after fbi virus

[johndd]

After being attacked and removing fbi virus I'm unable to use or create restore points. Tried repair and wmi.dat. Any other suggestions would be appreciated.

 

[Jacee]

Follow the instructions here, then see if you can set a clean restore point Remove the FBI MoneyPak Ransomware or the Reveton Trojan

 

[johndd]

Thanks will give a try.

 

[VistaKing]

Farbar Service Scanner

Click here :ar: Farbar Service Scanner to DOWNLOAD

Place file into your desktop

Place a check mark next to the following options

• Internet Services
• Windows Firewall
• System Restore
• Security Center
• Windows Update
• Windows Defender

Press the Scan button

Farbar Service Scanner will create a log, called FSS.txt, on the Desktop. Upload the FSS.txt with your reply

 

[gregrocker]

I recommend wiping the HD with Diskpart Clean Command to get a perfect Clean Reinstall .

It will likely save time in the long run dealing with all of the surprises left behind even when you clean up a serious infection.

 

[johndd]

You may be right but I'll give the other fixes a try first thing tomorrow.

 

[VistaKing]

Run this tool as well

Farbar Recovery Scan Tool


32-bit Version OS Farbar Recovery Scan Tool <==== Download Link

Drag the FRST.exe from the Downloads folder to your Desktop

Right click on FRST.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.


Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[johndd]

Here are the files.

 

[VistaKing]

Upload the FSS.txt file

 

[VistaKing]

Don't Run


Open Notepad . Inside Notepad paste the highlighted text


start
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKLM\...\Run: [] - [x]
HKLM\...\Run: [TaskTray] - [x]
HKCU\...\Run: [AdobeBridge] - [x]
URLSearchHook: (No Name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No File
ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ]
C:\ProgramData\20tb6z.dat
C:\ProgramData\dziw0q.pad
C:\ProgramData\as98213.txt
C:\ZD267718
C:\ProgramData\20tb6z.dat
testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!
end


Inside Notepad

click on File > Save As
File Name : Fixlist.txt
Save as type: All Files
Location: Destkop

Open up FRST.exe again . Click on the [Fix] button . Once its complete it will create a new log called Fixlog.txt upload that log.

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Delete and confirm the prompt.

:ar: Your computer will be rebooted automatically. A text file will open after the restart.

Upload the log : The log file is at C:\AdwCleaner[Sn].txt


Also run

TDSSKILLER

download link :ar: TDSSKiller

Save the file to the Desktop

Right-click the program and select:

When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System
Click: OK


Press: Start Scan


If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
If malicious objects are found, they show in the Scan results.
Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)


When done, the tool outputs its log to the disk with the Windows Operating System, normally C:\


Logs have a name like:
C:\TDSSKiller.X.X.X_12.04.2013_15.31.43_log.txt


Please post the TDSSKiller log in your reply.

 

[VistaKing]

Please download MGADiag and save it to your desktop.

:ar: Double click

icon on your desktop.

:ar: Click on the

button

:ar: Click on the

button

:ar: Paste the log inside the box . Highlight all of the text then code wrap by pressing on the # icon on the top .

 

[cottonball]

johndd,

:warn: Please do not run the following fixlist: :warn:
Post #10: [URL]http://www.sevenforums.com/system-security/297891-win-7-unable-use-create-restore-point-after-fbi-virus.html#post2469684[/URL]
This matter requires further research by VistaKing.

The above stems from the following entry showing in your FRST report:
testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!

There are Rootkit infections that turn off the driver integrity check by adding an entry to the Boot Configuration Data (BCD).

Please check on the following:
At the bottom right of the Desktop, does it say something like: "Test Mode, Windows 7, Build XXXX" ?

(X=number)


:info: Edit:

As confirmed by VistaKing, there is no Rootkit driver present.

No "Test Mode, Windows 7, Build 7601" notice is present on the screen.

The entry: "testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!" appears to be a leftover from an infection, and needs removed from the BCD.

:ar: Proceed with the previous fixlist (Post #10) only after removing all illegal software and/or tools from the computer.

Let's hope the few unsigned drivers are not essential for booting...

 

[johndd]

Nothing on the bottom right.

 

[johndd]

Here is the fss file.

 

[johndd]

Here is the adw cleaner file. TDSSKiller reported no issues. Tried creating restore point got-Access Denied: (0x80070005).

 

[johndd]

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-TMVMJ-BBMRX-3MBMV
Windows Product Key Hash: 55n8g6xdzhe4AOWhmTzdzQoLfa4=
Windows Product ID: 00426-292-0000007-85614
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {C3464DE8-0B31-4A58-A2B1-76D58C38084E}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.130505-1534
TTS Error: T:20111207202007485-
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{C3464DE8-0B31-4A58-A2B1-76D58C38084E}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-3MBMV</PKey><PID>00426-292-0000007-85614</PID><PIDType>5</PIDType><SID>S-1-5-21-2326662721-1753859907-3392161002</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>GA-78LMT-S2P</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>FB</Version><SMBIOSVersion major="2" minor="4"/><Date>20111017000000.000000+000</Date></BIOS><HWID>6CFB3D07018400FC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>B10K   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: U1BMRwEAAAAAAQAABAAAAEsQAAAAAAAAYWECAEj9FbNc9I+FR7XMAROJf9ybj7SsIEe8hMh9DOFKXc0xX1zar0ij2yw5TuEWOxCEM7UuNpzkgJsgBYnlgWOpCrmWo1Nepzt5+XJuKTMzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAx4dZsxs/sxaQSZh6DCEuBH/7uI1FTTozdREdrmsoB/1FYOzmhKxZJ+6Fp571HxQiozkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM

Licensing Data-->
Input Error: Can not find script file "C:\Windows\system32\slmgr.vbs".

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 1:4:2012 05:36
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Not Registered - 0x80070005
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MgAAAAEABAABAAIAAAABAAAAAQABAAEAeqhguP4LEDNU8uCoGIhOms5wrsD0AbjpFA8=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            GBT           GBTUACPI
  FACP            GBT           GBTUACPI
  HPET            GBT           GBTUACPI
  MCFG            GBT           GBTUACPI
  MSDM            GBT           GBTUACPI
  TAMG            GBT           GBT   B0
  SSDT            AMD           POWERNOW
  SLIC            DELL          B10K

 

[Golden]

File Scan Data-->
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100

Install this update, then create a new MGADIAG report and post it in your next reply.

 

[johndd]

Already installed update.

 

[Golden]

Please follow this:

http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

 

[VistaKing]

Remove the software that you installed with the KeyGen . If you want further help .