Results 1 to 2 of 2

Thread: Infection,doesnt go by reinstall,should format all disks?

  1. #1
    Junior Member
    Join Date
    Jun 2011
    Posts
    1

    Default

    I keep getting malware that blocks access to antimalware sites. I reinstall windows,no help. cant run ERUNT/DDS. Running Win XP Sp1(cannot update cause of malware) I suspect Conficker.
    Running GMER now,when ready posting log.
    Cannot download MBAM.
    I DL'd Avast! from download.fi.
    It says something like cannot format program when starting DDS/ERUNT installer.(quick translation from Finnish)

    Quote Originally Posted by sportcrazy60 View Post
    I keep getting malware that blocks access to antimalware sites. I reinstall windows,no help. cant run ERUNT/DDS. Running Win XP Sp1(cannot update cause of malware) I suspect Conficker.
    Running GMER now,when ready posting log.
    Cannot download MBAM.
    I DL'd Avast! from download.fi.
    It says something like cannot format program when starting DDS/ERUNT installer.(quick translation from Finnish)
    GMER 1.0.15.15640 - http://www.gmer.net
    Rootkit scan 2011-06-01 22:59:49
    Windows 5.1.2600 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 Maxtor_6Y080L0 rev.YAR41VW0
    Running: c02tzb7e[1].exe; Driver: E:\DOCUME~1\Sampsa\LOCALS~1\Temp\kwlyqpoc.sys


    ---- Kernel code sections - GMER 1.0.15 ----

    .text ntoskrnl.exe!KeInitializeInterrupt + B67 804DA23C 1 Byte [06]

    ---- User code sections - GMER 1.0.15 ----

    .text E:\WINDOWS\System32\svchost.exe[952] ntdll.dll!NtQueryInformationProcess 77F76035 5 Bytes JMP 06979DD2
    .text E:\WINDOWS\System32\svchost.exe[952] NETAPI32.dll!NetpwPathCanonicalize 71C12B51 5 Bytes JMP 06979D72
    .text E:\WINDOWS\System32\svchost.exe[1128] ntdll.dll!NtQueryInformationProcess 77F76035 5 Bytes JMP 00849DD2

    ---- Services - GMER 1.0.15 ----

    Service E:\WINDOWS\system32\svchost.exe (*** hidden *** ) [AUTO] felyv <-- ROOTKIT !!!

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv@DisplayName Microsoft Universal
    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv@Type 32
    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv@Start 2
    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv@ErrorControl 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv@ObjectName LocalSystem
    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv@Description Hallitsee IP-suojausk?yt?nt?? ja k?ynnist?? ISAKMP/Oakley (IKE)- ja IP-suojausohjaimen.
    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv\Parameters
    Reg HKLM\SYSTEM\CurrentControlSet\Services\felyv\Parameters@ServiceDll E:\WINDOWS\System32\liqywiqb.dll

    ---- Files - GMER 1.0.15 ----

    File E:\Documents and Settings\Sampsa\Local Settings\Temporary Internet Files\Content.IE5\WX6BCXIN\page3[1] 14792 bytes
    File E:\Documents and Settings\Sampsa\Local Settings\Temporary Internet Files\Content.IE5\WX6BCXIN\CA2G85YG.php 3154 bytes
    File E:\Documents and Settings\Sampsa\Local Settings\Temporary Internet Files\Content.IE5\WX6BCXIN\CAKJM36V.php 3120 bytes

    ---- EOF - GMER 1.0.15 ----
    GMER log.

    Because i cant edit here comes a whopping triple post.
    I cant run even paint/pinball or anyhng!
    Last edited by tashi; 2011-06-02 at 00:00. Reason: Merged three posts, please don't add.

  2. #2
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi

    I reinstall windows
    A reinstall isnt the same thing as a reformat and reinstall. A simply reinstall will not remove malware.
    Your post is several days old if you still need help simply reply back.

    You shouldnt be using the machine until its clean and it should have no network connectivity. If your not sure how to stop connectivity then just power it off.
    How Can I Reduce My Risk?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •