[Inactive] VMalwarebytes removed all programs?-dang kids

My kids HP home school computer had a virus...

SOOO---my wife downloaded Malwarebytes and ran it.

Everything except Malwarebytes, adobe and IE are gone...

IE still has a problem that it HIJACKS any of the searches (which was the original problem+ more)...

I tried to open in Safemode and use SYSTEM RESTORE. It allows SYSTEM RESTORE to start but, once you pick a point to restore from and hit NEXT...it runs for a minute..then stops...If you click NEXT again, it does nothing until you pick a new restore point.

Any help appreciated.

Welcome aboard https://discussions.virtualdr.com/

Please, complete all steps listed here: http://discussions.virtualdr.com/sho...d.php?t=167915

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================================================

Let's see, if we can recover your missing features.
Download and run UnHide
Let me know, if it worked.

Your reply seemed 'generic'...

The computer will not allow me to download and does not recognize the CD rom anymore.

The welcome part of the reply with instructions is given to all new members
here in the intensive care forum.


The pertinent part of the reply to you directly is below the double line.

Can you download the program on another computer and transfer/run it
via a thumb drive?

Quote:

---

Your reply seemed 'generic'...

---

I didn't want to sound rude, so I simply won't comment.

Broni----I am sorry if I offended you, It was a loong day.

Anyway, UNHIDE did work.

All the programs are back but:

-IE is still being hijacked when I do a search.
-I can not get Malwares to download or copy from a usb
-I have AVG 2012. When I run it, it finds problems but can not fix them all

***I will be out of town for 3-4 days so my reply moving forward might be slightly delayed.

Good news :)

Complete required steps when ready...

Reopened.

Ok,

I started with MALWAREBYTES...
The computer will no not connect to the internet.
So could not update prior to running.

Here is the log


Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.04.08

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Parent :: K12-E92297E4956 [administrator]

4/27/2012 1:31:47 PM
mbam-log-2012-04-27 (13-31-47).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 204013
Time elapsed: 7 minute(s), 46 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\WINDOWS\Temp\0.13905803992966592 (Exploit.Drop.9) -> Quarantined and deleted successfully.

(end)

Last night I ran Malwares and GMER.

Nothing detected but, not able to connect to the internet thru WIRELESS or when I plug cable directly in.

Transfer the logs to a thumbdrive, as a example, and post using a different computer.

The Malwares LOG is posted above...

here is the GMER log.


MER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-04-28 17:06:41
Windows 5.1.2600 Service Pack 3
Running: dqve4unt.exe; Driver: C:\DOCUME~1\Parent\LOCALS~1\Temp\pwndaaod.sys


---- Files - GMER 1.0.15 ----

File C:\WINDOWS\$NtUninstallKB6093$\2809841349 0 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871 0 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\@ 2048 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\cfg.ini 256 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\Desktop.ini 4608 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\L 0 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\L\ydobhgbn 162816 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\oemid 170 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\U 0 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\U\00000001.@ 2048 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\U\00000002.@ 224768 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\U\00000004.@ 1024 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\U\80000000.@ 66560 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\U\80000004.@ 1024 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\U\80000032.@ 115712 bytes
File C:\WINDOWS\$NtUninstallKB6093$\3795514871\version 908 bytes

---- EOF - GMER 1.0.15 ----

Go on....

I have posted the two logs....
Appears all the virus is gone but, I am unable to connect to the internet with this computer. When I use wireless or plug in, it is unable to aquire network address.

There are two more scan logs that we need.. pls see the instruction thread..

aswMBR.exe and dds scans are the next two :)

aswmbr downloaded to thumbdrive, was copied desktop...but when I double click, it does not run.
DDS- when I click on MIRROR 1, a blank page loads. MIRROR 2 loads in spanish, when I try to start the download, it does nothing.

Download TDSSKiller and save it to your desktop.

• Extract (unzip) its contents to your desktop.
• Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
• If an infected file is detected, the default action will be Cure, click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

Was able to download TDSSKILLER and extract it but, it will not run.

I did put it on another computer and it ran...

***After looking online, the AQUIRING NETWORK ADDRESS ERROR that prevents me from getting internet access might be a separate issue? Information online says I have to reset the IP address***

Do NOT do anything than what I ask you to do.

Please download and run ListParts by Farbar (for 32-bit system) to your desktop.

Please download and run ListParts64 by Farbar (for 64-bit system) to your desktop.

Click on Scan button.

Scan result will open in Notepad.
Post it in your next reply.

Here is the results

ListParts by Farbar Version: 12-03-2012 03
Ran by Parent (administrator) on 04-05-2012 at 13:30:46
Windows XP (X86)
Running From: C:\Documents and Settings\Parent\Desktop
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 67%
Total physical RAM: 446.26 MB
Available physical RAM: 146.26 MB
Total Pagefile: 1051.94 MB
Available Pagefile: 636.74 MB
Total Virtual: 2047.88 MB
Available Virtual: 2002.98 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:74.53 GB) (Free:33.73 GB) NTFS ==>[Drive with boot components (Windows XP)]
2 Drive d: (27243) (CDROM) (Total:0.46 GB) (Free:0 GB) CDFS
3 Drive e: (MSSS_Media32) (Removable) (Total:0.48 GB) (Free:0.43 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 75 GB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 75 GB 32 KB
Partition 2 Unknown 2544 KB 75 GB
======================================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C NTFS Partition 75 GB Healthy Boot
======================================================================================================

Disk: 0
Partition 2
Type : 17 (Suspicious Type)
Hidden: Yes
Active: Yes

There is no volume associated with this partition.
======================================================================================================

****** End Of Log ******

We'll see about your internet connection in a moment but first we have to take care of rootkited partition.

WARNING!
Proceed with extreme caution!
Deleting wrong partition will result with your computer being unusable.
If you have any doubts, ask.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download GETxPUD.exe to the desktop of your clean computer

• Double click on GETxPUD.exe
• A new folder will appear on the desktop.
• Open the GETxPUD folder and click on the get&burn.bat
• The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
• Insert blank CD into your CD drive.
• Click on Start and follow the prompts to burn the image to a CD.
• Boot bad computer from the CD
• Click Menu then Terminal Emulator
• Type parted /dev/sda set 1 boot on
• Press Enter
• Type parted /dev/sda rm 2
• Press Enter
• Remove xPUD CD, reboot, run aswMBR and post the log

Still with me?