WONT SHUT DOWN! not sure if its a virus or not

[alaska skier]

here's the report

View attachment FRST.txt

 

[alaska skier]

also, i believe partition 3 is that of a previous unbuntu installation that i had run alongside windows a while back that had not been deleted after i uninstalled it, so no worries there i hope

 

[alaska skier]

i found several restore points in the repair mode, would using one of these work to get rid of the virus? there are several before i started having issues

 

[cottonball]

Need to take a good look at the FRST report. The laptop is a Toshiba, and they have a unique configuration.

In the meantime, do the following:

Please download Malwarebytes Anti-Rootkit:
Malwarebytes : Malwarebytes Anti-Rootkit
Save to the Desktop (easy to find)

Right-click the file and select: Extract here...
Follow ithe Usage instructions on the website from Step 3 to Step 7.
For now, please stop at Step 7.

When the program is done, two reports are created in the mbar folder:
1. system-log.txt
2. mbar-log-2013-02-18 (20-13-32).txt (corresponds to mbar-log-year-month-day (hour-minute-second).txt)

Please provide the mbar-log containing information on what was detected and removed.

 

[cottonball]

On Partition 3...

Toshiba machines have a recovery partition recognized as type 17.
Partition ### Type Size Offset
Partition 3 Primary 15 GB 581 GB

==========================================================
Disk: 0
Partition 3
Type : 17 (Suspicious Type)
Hidden: Yes
Active: No

There is no volume associated with this partition.

This is legit.

 

[alaska skier]

should i download it onto a flashdrive from a clean computer and run malwarebytes in safe mode without networking?

 

[cottonball]

Can you do the following...

After you download MBAR to the Desktop and extract it, right-click the mbar folder that is created, and select: Properties

In the General tab, look at location. It should read:
C:\Users\xxxx\Desktop (where xxxx = your name)

Next, right-click the Command Prompt, and select: Run as Administrator

At the blinking prompt of the Command Prompt, copy/paste the following:
C:\Users\xxxx\Desktop\mbar\mbar.exe (where xxxx = your name)

Does this start MBAR for you?

If can't do, reboot, and select the following from the Advanced Boot Options:
Safe mode with command prompt

Try to run it from:
C:\Users\xxxx\Desktop\mbar\mbar.exe (where xxxx = your name)

If still no-go, then use the USB drive, and change the path:
X:\mbar\mbar.exe (where X = letter of the USB drive)

 

[alaska skier]

weird, says no malware found

View attachment mbar-log-2013-02-18 (19-48-22).txt

 

[alaska skier]

im trying again in safe mode with networking so i could update the scanner, will post results

 

[alaska skier]

FOUND IT! MagniPic, it didn't even disguise itself as i found it in program files a little earlier but didn't think it was it

 

[alaska skier]

here are the reports, the 1str one is the one where it found the file
View attachment mbar-log-2013-02-18 (20-06-46).txt
View attachment mbar-log-2013-02-18 (20-21-10).txt

 

[cottonball]

Please go back to Post #28, and run RogueKiller once again, per those instructions.

Let's see what it reports.

We cannot rely on one program alone to claim victory over the ZeroAccess Rootkit, so, please be patient and bear with me.

 

[alaska skier]

rogue killer is still coming up with everything and it opens a website explaining how to get rid of zeroaccess also known as Max++

here is the website: tigzyrk.blogspot.com/2011/09/rootkit-zeroaccess-max.html

I used the delete feature, scanned again and it came up clean, here is the report before and after the delete
View attachment RKreport[3]_D_02182013_02d2035.txt
View attachment RKreport[4]_S_02182013_02d2040.txt

 

[alaska skier]

thanks cottonball for helping me with this nasty piece of work as i use my computer a lot for school and have learned to now do backups the hard way and am set to go buy a portable hard drive, ill be waiting for you to tell me what to do next, hopefully it's to check that this problem is resolved.

 

[cottonball]

Please post the newest RogueKiller report. Need to see it. Can't operate in the blind.

Never mind!!
Did not see your edit. Overlooked that you already posted the reports.

Need to check both of them, and will be back.

 

[alaska skier]

thanks cottonball

 

[cottonball]

Let's press on...

Please download TDSSKiller:
http://support.kaspersky.com/downloads/utils/tdsskiller.exe
Save to the desktop.
The program can be run in Normal Mode and Safe Mode.

Double-click on TDSSKiller.exe to execute.
Click on Change parameters, and select: TDLFS file system
Press Start scan to begin.

If anything is found, do not change the default options on the scan results.
However, do not use: Delete >> Instead, change to: Skip
Click on: Continue

If prompted to reboot your computer, please consent.

Once the program is done, a log is produced at C:\
It is named: TDSSKiller.Version_Date_Time_log.txt

Please post the contents of the TDSSKiller report in your reply.

I'm signing off for tonight, but will be back during the day. It is 1:10AM here...3 hours difference from Alaska.

 

[alaska skier]

WOW,sorry never realized that time difference, will do the TDSS killer, i have herd good things about this program

 

[cottonball]

TDSSKiller will provide us additional information.

At this point, I am not certain that what RogueKiller found was an active Rootkit, vs. remnants of an infection that is no longer active.

FRST is a very good picker-upper of ZeroAccess, and it did not show there.

What MBAR picked up was an entry that was not definitely identified as ZA.
It does pick up entries that are not Rootkits, and I have tested that on my computer.

All these things get trickier by the minute, and, therefore, one needs to take things one at a time, and evaluate the general consensus (based on reports) of the tools run.

 

[alaska skier]

sorry, had school, will run tdss in safe mode with the parameters given, also, my tech coordinator gave me a program to try called spybot-search and destroy, any thoughts? as i will try this too