IDP & Crypt AQLW Trojan DDS Log pasted.

Status
Not open for further replies.
Hi,

If you are moving everything are you just going to format the drive and reinstall Windows? If that is what I am understanding than you should be fine to move over personal files like music, pictures, documents and the like. The infection was all over your system so I would be careful with what you transfer other than those I mentioned. If it were me, I would save my music, pictures and documents and that is it...just start over. It is actually a lot faster and you will have the peace of mind that the infection is gone.
 
Curiosity

I am in the middle of moving all my data. I will scan the files once they are on the second disk to make sure they are OK. Then I will reformat and reinstall - However, before that once my data is safely out of the way, I will remove rapport and rerun ComboFix to see if it gives me the error again - it could be that the fact that these files were moved, before the Trojan's were wiped, and the fact that the evidence is that these were moved may be the source of the report of Trojan activity.
I have now run every stand alone ZeroAccess Tool going (Symantec, AVG, Panda - all reporting no infection) - with the exception of ComboFix and ZeroAccess Unhooker. Just out of interest!
 
Ready to take the plunge

Hi.

I have now save all my essential files on my second hard disk, and scanned them for malware. I have found an Xp instalation disk and printed out my key code for XP (Thanks to the Belarch untility).

I removed Rapport from the system but ComboFix still reported ZeroAccess activity.

Is there any web site which can instruct me how to format the XP drive, and how to install the system once again?
 
Hi,

I am getting with one of the techs that work with that to give you the best information on how to do it. I will return as quickly as I can. :)
 
Printer Driver

Hi.

I have a network printer installed via a USB Port - is there any way I can save the driver to my spare drive, and then copy back to a newly formatted C Drive? It will save me hunting for one on the Internet - I an using a Konica Minolta bizhun C250, and last time I had to find a driver it took me some time to install it.

Michael.
 
Format and reinstall - or reinstall retaining data

Hi.

I have read in the past that you can do a reinstall of XP from the disk which will keep the data intact plus some settings - what is your opinion, or that of your colleagues on that option - it should replace all the operating system and hopefully overwrite the corrupted files?
 
Hi,

I have a network printer installed via a USB Port - is there any way I can save the driver to my spare drive, and then copy back to a newly formatted C Drive?
I think that should be fine as long as you are sure that is the driver. Now that you have everything backed up please do the following to format/reinstall your Windows Operating System:

If your system is listed here then there is a restore to factory settings function. The links are clickable

DELL

LENOVO (IBM)

ACER This will download the E-Recovery Zip file. Unzip then run

So you are going to reformat and re-install Windows ?

Preparation is the secret to success so we shall start there :

PREPARATION

1. Ensure you have the following discs
A. Operating System disc or Manufacturers recovery disc.
B. Windows KEY found either in the disc holder for the Windows CD or in a sticker on the side of your system
C. Motherboard drivers disc.
D ISP disc with Modem/DSL drivers and setup.
E. Programme installation discs (i.e. Word, Photo editing etc.) If you have no discs but downloaded them from the Internet then see below.

If you cannot find your windows key on your computer or paperwork , then do the following :

To get your XP Key download to your desktop keyfinder.zip Extract the files and run Keyfinder this will then locate and display the registration number, either print it out or copy it down ensuring that the details are correct

2. Things to back up for an easy transition. First create a BACKUP folder on your desktop with the following subfolders :

MAIL
VIDEOS/MUSIC/PICTURES
DOCS
LICENCES
PROGRAMMES


To create one on your desktop right click a blank space > select NEW > select FOLDER. To create subfolders open the backup folder and on the file menu select new folder

How to back up Outlook Express items

Step 1: Copy message files to the backup folder

Step A: Locate the Store folder

1. Start Outlook Express.
2. Click Tools, and then click Options.
3. On the Maintenance tab, click Store Folder.
4. In the Store Location dialog box, copy the store location. To do this, follow these steps:
a. Put the mouse pointer at one end of the box under the Your personal message store is located in the following folder box.
b. Press and hold the left mouse button, and then drag the mouse pointer across the Your personal message store is located in the following folder box.
c. Press CTRL+C to copy the location.
5. Click Cancel, and then click Cancel again to close the dialog box.

Step B: Copy the contents of the Store folder

1. Click Start, click Run, press CTRL+V, and then click OK.
2. On the Edit menu, click Select All.
3. On the Edit menu, click Copy, and then close the window.

Step C: Paste the contents of the Store folder into the backup folder
1. Double-click the Mail Backup folder to open it.
2. Right-click inside the Mail Backup folder window, and then click Paste.

Step 2: Export the Address Book to a .csv file

Important Make sure that you follow this step if you use multiple identities in Outlook Express.

Microsoft Outlook Express 5.x and Microsoft Outlook Express 6.0 use a Windows Address Book (.wab) file to store Address Book data. The individual data for each identity is stored in a folder by user name within the .wab file that is used.

The only way to separate the Address Book data for different identities is to export the data to a .csv file while you are logged in as a specific identity. If the .wab file becomes dissociated from the user identities, the data can be exported only as one total. In this case, the data cannot be exported folder by folder.

There is another reason to export the .wab file to a .csv file. If the .wab file not exported to a .csv file, but the .wab file is shared with Microsoft Outlook, the addresses are stored in the personal folders (.pst) file in Outlook. When you export the file to a .csv file by using the File menu in Outlook Express, the correct contacts are exported. However, if the Address Book is shared with Outlook, you cannot use the File menu option to export from the Address Book. This option is unavailable.

To export the Address Book to a .csv file, follow these steps:

1. On the File menu, click Export, and then click Address Book.
2. Click Text File (Comma Separated Values), and then click Export.
3. Click Browse.
4. Select the Mail Backup folder that you created.
5. In the File Name box, type address book backup, and then click Save.
6. Click Next.
7. Click to select the check boxes for the fields that you want to export, and then click Finish.
8. Click OK, and then click Close.


Step 3: Export the mail account to a file

1. On the Tools menu, click Accounts.
2. On the Mail tab, click the mail account that you want to export, and then click Export.
3. In the Save In box, select the Mail Backup folder, and then click Save.
4. Repeat these steps for each mail account that you want to export.
5. Click Close.

Step 4: Export the newsgroup account to a file

1. On the Tools menu, click Accounts.
2. On the News tab, click the news account that you want to export, and then click Export.
3. In the Save In box, select the Mail Backup folder, and then click Save.
4. Repeat these steps for each news account that you want to export.
5. Click Close.


Favorites/Bookmarks

To export the Favorites folder, follow these steps:

1. Start Internet Explorer
2. On the File menu, click Import and Export, and then click Next.
3. Click Export Favorites and then click Next.
4. Click Favorites and then click Next.
5. Type the name of the file that you want to export the favorites to. By default, the export file is named Bookmark.htm.
6. Select the folder to backup in as your newly created one
7. Click Next and then click Finish.


Personal Documents

1. Open your document processing programme
2. Select options
3. Generally there will be the option to select your save folder
4. Change this to the backup subfolder
5. Save all your files to this location

Videos/Pictures

1. Right click your music file folder(s) and select copy
2. Right click the backup folder and select paste
3. Repeat until all folders are copied to the backup folder

Licence numbers from installed software

1. Start each programme that you have a licence for
2. In the main menu select HELP > ABOUT
3. Generally this is where you will find your licence key
4. Copy the key to a text file along with the programme name and save to the backup folder
licenceam3.th.jpg


Latest version of your Anti-virus and Firewall

Download the latest version from the website and save to your backup folder

Download all installed programs that you wish to keep and do not have disc for

Download the latest version from the website and save to your backup folder



Now you have completed that you will need to copy the entire contents of your new folder to one of the following : USB stick or CD/DVD disc

To do this right click the backup folder and select copy
Then right click the drive (CD or USB) that you are saving to and select paste


FORMATTING PARTITIONING AND INSTALLING

This will totally wipe your hard drive and re-install a fresh copy of Windows. Depending on the original version you have you may need to download SP2, and you will definitely need all the windows updates. To this end you will need to install your Antivirus and Firewall before even attempting to go online.


1. Insert the Windows XP CD into your computer and restart your computer.

2. If prompted to start from the CD, press SPACEBAR. If you miss the prompt (it only appears for a few seconds), restart your computer to try again.

3. Windows XP Setup begins. During this portion of setup, your mouse will not work, so you must use the keyboard and it should preferebly be a PS2 keyboard s your USB ports may not be operational.

4. On the Welcome to Setup page, press ENTER.

5. On the Windows XP Licensing Agreement page, read the licensing agreement. Press the PAGE DOWN key to scroll to the bottom of the agreement. Then press F8.
xpsetup2windowsxplicenkz1.th.jpg


6. This page enables you to select the hard disk drive on which Windows XP will be installed. Once you complete this step, all data on your hard disk drive will be removed and cannot be recovered. This will initially show your current Windows installation. Press D to delete the partion , and then press L when prompted. This deletes your existing data.
xpsetup3partitiondz0.th.jpg


7. This page will be where you now format your hard drive after the deletion of old Windows. Select the option shown
xpsetup4formatlg2.th.jpg


8. You will now see a progress bar as the disc is formated, go for a cup of tea as this will take a while.
xpsetup5formatprogresspu9.th.jpg


9. Now you will need to set up your keyboard for the right language and currency
xpsetup7regionalandlanjg8.th.jpg


10. This is where you will enter your product key. This will be with the install disc or on a sticker on the side of your system
xpsetup9yourproductkeyae1.th.jpg


11.When you reach this stage then say activate later as we do not wish to go online yet.
xpsetup19readytoactivabz4.th.jpg


12. Again leave this one for now we will register later
xpsetup20readytoregistye8.th.jpg


13. On this page set up the users that will be on your system
xpsetup22whowillusethfy8.th.jpg


14. The system will now continue to load and you now have a clean system

PREPARATION FOR FIRST USE

1. If you need SP2 then insert the disc and install now, following the prompts

2. From your backup disc install the following:

a. Antivirus
b. Firewall

You will need to reboot for both programmes.

3. Install any required motherboard drivers (e.g. wireless etc.)

4. Install any required programmes from Disc or the backup folder.

5. Install your ISP disc if that is required to get you online.

6. Go online and Update :

a. Your Antivirus
b. Windows


NOW REINSTALL YOUR E_MAIL SETTINGS

How to restore Outlook Express items


Note To restore items when you use multiple identities in Outlook Express, you may have to re-create the identities before you follow these steps. Repeat each step as needed for each identity.

Step 1: Import messages from the backup folder


1. On the File menu, point to Import, and then click Messages.
2. In the Select an e-mail program to import from box, click Microsoft Outlook Express 5 or Microsoft Outlook Express 6, and then click Next.
3. Click Import mail from an OE5 store directory or Import mail from an OE6 store directory, and then click OK.
4. Click Browse, and then click the Mail Backup folder.
5. Click OK, and then click Next.
6. Click All folders, click Next, and then click Finish.

Step 2: Import the Address Book file

1. On the File menu, click Import, and then click Other Address Book.
2. Click Text File (Comma Separated Values), and then click Import.
3. Click Browse.
4. Select the Mail Backup folder, click the address book backup.csv file, and then click Open.
5. Click Next, and then click Finish.
6. Click OK, and then click Close.

Step 3: Import the mail account file

1. On the Tools menu, click Accounts.
2. On the Mail tab, click Import.
3. In the Look In box, select the Mail Backup folder.
4. Click the mail account that you want to import, and then click Open.
5. Repeat these steps for each mail account that you want to import.
6. Click Close.

Step 4: Import the newsgroup account file

1. On the Tools menu, click Accounts.
2. On the News tab, click Import.
3. In the Look In box, select the Mail Backup folder.
4. Click the news account that you want to import, and then click Open.
5. Repeat these steps for each news account that you want to import.
6. Click Close.

Import Favorites to Internet Explorer

1. In Internet Explorer, click File , and then click Import.....Export
2. In the Import/Export Wizard, click Next.
3. Select Import Favorites, and then click Next.

Note By default, Internet Explorer creates a Bookmark.htm file in your Documents folder. However, you can import favorites that are saved under another name. To do this, click Browse, select a file or type a location and file name, and then click Next. Alternatively, click Browse, and then click Next to accept the default.

4. Select the folder where you want to put the imported bookmarks, and then click Next.
5. Click Finish.
 
Been busy - but a further question

Hi

Work has taken its demands of my time, and I can snatch a moment of two between jobs - however before I take the plunge, there is an XP wizard which can save both files and settings to another drive or set of disks (FAST - files and settings transfer) found under Programs/Accessories/System Tools. As I would like to preserve the settings - will I risk transferring the Trojan using this wizard?
 
Hi,

No problem. I have been fighting with final exams this week myself. :)

Well...I can't give you any guarantees that the infection won't transfer using that tool. The tool may unintentionally pick up a file that it believes is good and move it even though the file is infected.

Your system was one of the most heavily infected systems I have seen and I think that your best course of action would be to manually save your pictures, personal files and music to a USB drive or CD. Once you have that, follow the instructions to format and reinstall your system that I have provided. :)
 
Reinstall & Exams

I will have to get a clear run, but will get back with a Report when the deed is done. I guess Monday.

I trust you will do well in your exams and you deserve to get on. Gosh it take me back 32 years to when I face my finals.

With my prayers and good wishes.

Michael.
 
NTLDR is missing can't reinstall windows

Now when I reboot, I am getting the "NTLDR is missing" error, and although I can access the BIOS boot menu (ESP) and choose the hard disk - which it duly boots into, whenever I choose the CD Rom Drive, it does pick Setup and simply returns the "NTLDR is missing" error thus I cannot even to begin a fresh install! Are there and colleagues who could help with this?
 
On my way

I by passed the problems of the missing NTLDR by booting into Windows via the Bios Boot Menu, put the CD into the Drive clicked set up - and I am on my way! I will let you know the progress.

Again hope all goes well the the exams - no need to reply just cram a few more moments of revision!
 
A story with a moral

Hi Jeff

I tried to short cut the task by doing a repair install. My XP Disk is SP2. My system was SP3. Well it installed OK - but problem was that ie6 was now installed and would not work (mismatch of files some new, and the reinstall consisted of older old - this gives 'Ordinal not found error'). Installed ie7. Did not work. Rolled back to ie6 - installed various fixes from the internet - a shortcut worked (linking to the ie folder in the Program Files directory) - but on clicking the Desk Top icon, it simply created an i.e. (non working) short cut - but no i.e. coming to life. Click it again, and another short cut is created - and so on. I am not the first to have seen this - again tried all manner of fixes but still the problem remained. The workaround is to ignore the Desktop icon (remove it) and work from the shortcut.

Out of curiosity I ran combofix - and lo and behold a familiar message "You are infected with Rootkit.ZeroAccess! etc)!

Well the moral of this story - is forget about any i.e. worries - the rootkit Trojan is still in place, and only a format and fresh install will work. I have opted for a full format - (rather than the quick format - belt and braces approach); so at this very moment I am looking a the progress line for the format 55% thus far.

Will post updates as and when.

The help required is post reinstallation. What is the best trojan defence? AVG failed me - is there a program that would have stopped the infection in its tracks?

I hope your exams are going well - what is your subject?
 
Hi,

only a format and fresh install will work.
Unfortunately with this infection, sometimes that is the only choice. I think you are making the right decision. :)

What is the best trojan defence? AVG failed me - is there a program that would have stopped the infection in its tracks?
I use Avast antivirus which in my opinion is very good. I also like Microsoft Security Essentials, but be sure to only use one of these. Using two active antivirus programs can seriously degrade the performance of a computer.
You can look over them at the following links:
Microsoft Security Essentials
Avast
 
Update options not available

The install went OK - however the tick boxes in the "Choose updates to download and install" in the Automatic Updates are greyed out and already ticked which means I cannot choose to refuse an update - its all or nothing! So I am installing them one by one via the MS Update Website usinng the Belarc Adviser to inform me of the missing updates - a slow business - but that way I can get to choose which update to download.

How are the exams going?
 
Greyed out tick boxes solved

I downloaded KB898461 Package Installer for Windows and on a reboot the update choices were all there.

Also the missing NTLDR was solved. In the Bios there is a boot order - Removable media, CD, HDD in that Order - however there is another screen which lists the HDDs and the first on the list was the second slave drive which lack an operating system. I modified that to make the Disk on C drive the first and rebooted straight in Windows Xp.

So I guess the case is closed - and many many thanks for your assistance.

I just have to reinstall all my programs and data!:thanks:
 
:bigthumb: You are more than welcome. I know you made the right choice with your system.
-----------

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance.

If you are the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
----------
 
Status
Not open for further replies.
Back
Top