Stubborn malware & lost network connections, please help

[metalgecko]

Hi everyone,

I'm trying to help a friend who's having problems on WinXP. There are two
issues, which are probably related.

(1) AVG keeps reporting that it's finding three problems, but can't get rid
of them:
-Trojan horse rootkit-agent.di
-psw.online-games_r.de
-win32/heur (two instances)

(2) All network interfaces have stopped working. In Device Manager, they
show up with the little yellow exclamation mark thingy on them, and Windows
reports "Cannot load driver for this device (code 39)". The 'Troubleshoot'
button doesn't do anything. All attempts so far to re-install the network
device drivers have led back to the same situation.

My approach so far has been to try and shift the infections first, but the
problem is that without network access, the utilities that I've tried
(including ATF Cleaner and MalwareBytes) won't run, because they expect to be
able to update themselves from the Internet, which without a working network
interface they can't do. We've also tried running winsock.fix to see if that
would get one of the network connections back, and it didn't.

I'm going over to my friend's house on Saturday to take a look at it, so if
anyone has any ideas as to how we can get one of the network interfaces
working again or how we can shift these infections without needing to connect
to the Internet, I'd be very grateful for any suggestions.

I don't know too much about the PC off the top of my head, but if memory
serves I think it's a Fujitsu Siemens, about three years old (Pentium 4
maybe), with an on-board Ethernet port (Via Rhine 2, I think) and a wireless
card, don't know which make/model.

Thanks

J.

 

[Kayman]

Hi everyone,

I'm trying to help a friend who's having problems on WinXP. There are two
issues, which are probably related.

(1) AVG keeps reporting that it's finding three problems, but can't get rid
of them:
-Trojan horse rootkit-agent.di
-psw.online-games_r.de
-win32/heur (two instances)

(2) All network interfaces have stopped working. In Device Manager, they
show up with the little yellow exclamation mark thingy on them, and Windows
reports "Cannot load driver for this device (code 39)". The 'Troubleshoot'
button doesn't do anything. All attempts so far to re-install the network
device drivers have led back to the same situation.

My approach so far has been to try and shift the infections first, but the
problem is that without network access, the utilities that I've tried
(including ATF Cleaner and MalwareBytes) won't run, because they expect to be
able to update themselves from the Internet, which without a working network
interface they can't do. We've also tried running winsock.fix to see if that
would get one of the network connections back, and it didn't.

I'm going over to my friend's house on Saturday to take a look at it, so if
anyone has any ideas as to how we can get one of the network interfaces
working again or how we can shift these infections without needing to connect
to the Internet, I'd be very grateful for any suggestions.

I don't know too much about the PC off the top of my head, but if memory
serves I think it's a Fujitsu Siemens, about three years old (Pentium 4
maybe), with an on-board Ethernet port (Via Rhine 2, I think) and a wireless
card, don't know which make/model.

Preferred practice is to 'flatten' and rebuild a computer that has been
exposed to malware.
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx
http://technet.microsoft.com/en-au/library/cc512595.aspx

Clean Install Windows XP
http://www.elephantboycomputers.com/page2.html#Reinstalling_Windows - What
you will need on-hand
--and--
http://www.michaelstevenstech.com/cleanxpinstall.html
--or-- (even better because its illustrated and more reader friendly)
How Do I Install WindowsXP
http://xphelpandsupport.mvps.org/how_do_i_install_windows_xp.htm

It is defenitely advantageous to create an 'image' of the operating system
and create a data/file backup of the affected PC.
The image can then restored to the impacted PC and the user's data/file is
subsequently restored to the operating system.

An experienced and properly prepared user can do that in substantial less
time than scanning with complex and sophisticated AV applications.

Alas, since many users are less prepared and/or lacking the experience;
Scanning with an AV apps. is the only option, unless the user consults a
computer technician.
If you're one of the many less-experienced users, try to go through the
succeeding steps 1-4:

1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
(w/out quotation marks into the box, then click the 'OK' button. Select
your drive (presumably WinXP (C and click OK.
http://support.microsoft.com/kb/310312

3.Using a surrogate computer, download/execute:
http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html

3a.Insert the rescue disk into the infected computer and scan the system
for virus infections.

After successful execution:
4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

Additional references:
Malicious Software Removal Tool
http://www.microsoft.com/security/malwareremove/default.mspx
(Skip: Run an Online Scan of Your PC for Malicious Software).

How to optimize or reset Internet Explorer
http://support.microsoft.com/kb/936213
Applies to: Windows Internet Explorer in Windows Vista

How to use Reset Internet Explorer Settings (RIES)
http://support.microsoft.com/kb/923737
Read: "What you must know"
Applies to: Windows Internet Explorer for Windows XP and
Windows Internet Explorer 7 in Windows Vista

GMER - is an application that detects and removes rootkits.
http://www.gmer.net/index.php

For additional assistance in relation GMER scan results consult either:
http://www.thespykiller.co.uk/index.php?board=3.0
--or--
http://antirootkit.com/forums/index.php?sid=9e746bb696ac0bb38781ffe4361c3a17

CCleaner - Free
Cleans temporary internet files, cookies, history, recent urls, application
MRUs, etc. ...(*Tune out the registry scanning/fixing option!*)
http://www.ccleaner.com/download/builds/downloading-slim

If Windows Defender is utilized go to Applications, under Utilities
uncheck "Windows Defender" (so it won't delete the history of WD).
If you wish, click 'Options' button the 'Settings' [check] 'Run CCleaner
when the computer starts'.
--or--
Setup CCleaner to Automatically Run Each Night in Vista or XP
http://www.howtogeek.com/howto/wind...-automatically-run-each-night-in-vista-or-xp/

Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html

Good luck

 

[metalgecko]

Had a look at my friend's PC yesterday, tried the various cleanup and
anti-malware tools suggested, and a few others, made some progress but sadly
the machine still has some pretty major problems, I'm going back next weekend
to do a clean rebuild. Thanks for the advice.