WONT SHUT DOWN! not sure if its a virus or not

[cottonball]

alaska skier,

To my understanding, winsock is a programming interface that handles input/output requests for Internet applications in a Windows operating system. If there is corruption, certain services can be terminated.

Did some research regarding the following:

Failure to display security and shut down options
The logon process was unable to display security and logon options when CTRL+ALT+DELETE was pressed.
If the operating system does not respond, press ESC or restart the computer by using the power switch.

Oddly enough, the solution that has worked in several cases is using the following to repair and reset Winsock catalog Corruption to its default:

netsh winsock reset

There is no absolute guarantee that it will work in your case, however, nothing else has worked either.

Whether you wish to use or not use the command above is, of course, your prerogative.

Running RKill may provide us some additional information, if you wish to not use the above, or, not now.

 

[alaska skier]

the winsok reset did nothing really if its of any help, i noticed that i am running about 10% higher ram usage than normal, but i cannot see what is running in noraml mode as i cannot run task manager

 

[alaska skier]

also, the RKill report is post #6

 

[cottonball]

Post #6 is for: MGADiag

You need to look at Post #9 and 10 for RKill.

 

[cottonball]

Alternatives for Windows Seven Task Manager:

The Best Free Alternatives to the Windows Task Manager

 

[NoelDP]

Please run SFC /SCANNOW again, and post your full CBS.log file

 

[alaska skier]

here is the rkill report

Rkill 2.4.7 by Lawrence Abrams (Grinler)
Bleeping Computer - Technical Support and Computer Help
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
RKill - What it does and What it Doesn't - A brief introduction to the program - BleepingComputer.com

Program started at: 02/18/2013 01:16:14 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* COM+ Event System (EventSystem) is not Running.
Startup Type set to: Automatic

* Security Center (wscsvc) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Update (wuauserv) is not Running.
Startup Type set to: Automatic (Delayed Start)

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 02/18/2013 01:16:24 PM
Execution time: 0 hours(s), 0 minute(s), and 10 seconds(s)

 

[cottonball]

Hmmm....

RKill shows the following:

* COM+ Event System (EventSystem) is not Running.
Startup Type set to: Automatic
This service supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start

* Security Center (wscsvc) is not Running.
Startup Type set to: Automatic (Delayed Start)
The WSCSVC (Windows Security Center) service monitors and reports security health settings on the computer. The health settings include firewall (on/off), antivirus (on/off/out of date), antispyware (on/off/out of date), Windows Update (automatically/manually download and install updates), User Account Control (on/off), and Internet settings (recommended/not recommended). The service provides COM APIs for independent software vendors to register and record the state of their products to the Security Center service. The Action Center (AC) UI uses the service to provide systray alerts and a graphical view of the security health states in the AC control panel. Network Access Protection (NAP) uses the service to report the security health states of clients to the NAP Network Policy Server to make network quarantine decisions. The service also has a public API that allows external consumers to programmatically retrieve the aggregated security health state of the system.

* Windows Update (wuauserv) is not Running.
Startup Type set to: Automatic (Delayed Start)
This service enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update Agent (WUA) API.


In light of the above, when you get done running SFC /SCANNOW again, and posting your full CBS.log, please do the following:



Please download RogueKiller:
Tlcharger RogueKiller (Site Officiel)


When you get to the website, go to where it says:
(Download link) Lien de téléchargement:

Select the version that applies to your system: x64
Click the dark-blue button to download.

Save to the Desktop

Close all windows and browsers
Right-click RogueKiller and select 'Run as Administrator'

Press: SCAN

A report opens on the Desktop: RKreport.txt

Please provide the RKreport.txt (Mode: Scan) in your reply.
(Please do not delete anything!)



Also, download Farbar Service Scanner
Save to the Desktop

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press: Scan
• FSS creates a log, FSS.txt, on the Desktop.

Please provide the FSS.txt in your reply.

 

[alaska skier]

View attachment 255943
here's the CBS.log

 

[NoelDP]

The CBS log is free of any errors that I can see.

It may be worth running a CheckSUR report - it checks a fair amount of the registry for errors, as well as the file system....

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and attach it to a reply.

 

[alaska skier]

here is the rogue killer report, looks bad

RogueKiller V8.5.1 _x64_ [Feb 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : Download RogueKiller (Official website)
Blog : tigzy-RK

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Safe mode with network support
User : Stephen Kagerer [Admin rights]
Mode : Scan -- Date : 02/18/2013 14:19:17
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[Microsoft][HJNAME] notepad.exe -- C:\Windows\System32\notepad.exe [7] -> KILLED [TermProc]

¤¤¤ Registry Entries : 6 ¤¤¤
[TASK][SUSP PATH] MagniPicUpdaterTask{7CB4CF25-B289-400F-A672-4E00FCD112E6}.job : C:\ProgramData\Premium\MagniPic\MagniPic.exe /schedule /profile "C:\ProgramData\Premium\MagniPic\profile.ini" [-] -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_TrackProgs (0) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] Desktop.ini : C:\windows\Assembly\Desktop.ini [-] --> FOUND

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\windows\system32\drivers\etc\hosts



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MK6475GSX +++++
--- User ---
[MBR] a7e0b95e3524175fc84db50334f68ff0
[BSP] 9ea1ced1571f36b81b112b3982abe1b2 : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 593552 Mo
2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 1218668544 | Size: 15427 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1]_S_02182013_02d1419.txt >>
RKreport[1]_S_02182013_02d1419.txt

 

[alaska skier]

zeroacess is a botnet, ow i just need to get rid of it

scanning with farbar service scanner now

 

[alaska skier]

here's the farbar report

Farbar Service Scanner Version: 18-02-2013
Ran by Stephen Kagerer (administrator) on 18-02-2013 at 14:25:38
Running from "C:\Users\Stephen Kagerer\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Network
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is offline
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.


System Restore Disabled Policy:
========================


Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.

BITS Service is not running. Checking service configuration:
The start type of BITS service is OK.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

[alaska skier]

ill do further research on zero access and how to get rid of it

 

[cottonball]

You do not need to. Please follow these instructions.

Since we are dealing with ZeroAccess, let's approach the issue in a mode before Windows starts.

Need some information in order to proceed...

Confirming the Operating System on the involved computer is Windows Seven 64-bit.

Also, do you have the Repair your computer option in the Advanced Boot Options menu?

To find out:




Restart the computer.

• As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
• Is the Repair your computer option listed?

If you do not have the option above, do you have your Windows installation CD/DVD available?


And last, do you have a clean USB flash drive available, and do you have access to another computer?

 

[alaska skier]

that explains why i was able to use my computer!!!! it wasent connected to the botnet so it was able to function withought the wireless connection, from here on out i will not be using any networking on this laptop and reply from my mothers laptop

 

[alaska skier]

yes i do to both, lets get this guy!

 

[cottonball]

Stay cool...

You may want to print these instructions so you can have access to follow them.
Also, you may want to read them once befor you apply them.

Please plug a flash drive into a clean computer.

Go to Start > Computer

• Double-click Computer, and select the flash drive.
• Right-click and select: Format
• Press Start on the Format prompt..

Next, download Farbar Recovery Scan Tool:

Farbar Recovery Scan Tool Download
Select the 64-bit download.

Save the program to the >>> USB flash drive.
Remove the drive from the clean computer.

Next, plug the flash drive into the infected computer.



>>>Restart the computer.

• As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select your language settings, and click: Next
• Select your User account and click: OK (If you did not set a password, leave blank.)

On the System Recovery Options menu you get the following options:

• Startup Repair
  [*]System Restore
  [*]Windows Complete PC Restore
  [*]Windows Memory Diagnostic Tool
  [*]Scan your computer's memory for errors.
  [*]Command Prompt

Select: Command Prompt

• In the Command window, at the bliking cursor type notepad and press: Enter
• In Notepad, under the File menu select: Open
• Double-click Computer, find the flash drive letter, remember what letter it is, click on it, and press: Open
• Close out of Notepad.
• Click the Command window
• Type x:\frst64.exe, and press: Enter
  Note: Replace the drive letter x with the drive letter of your flash drive!

The tool starts and prepares to run. Follow the prompts.

• Click Yes to the disclaimer.
• Press: Scan
• When done, the program saves the FRST.txt report, on the flash drive.

Click the Command prompt window, and type exit, and press: Enter


Back at the System Recovery Options, press: Restart

When the computer boots back into Windows, please provide the FRST.txt in your reply.
It is located in the USB flash drive.


Need to go out for a while to get some chow. Will get right back here when I get back. By then, you will have the report ready. Please do not use the infected computer for now.

 

[Jacee]

Never mind ..

 

[alaska skier]

doing it right now