Malware killed my connection

Something has got into my syste and is killing off all executables and has seemingly disabled my internet explorer connections.

I managed to kill off the malware by opening multiple task managers so that it spent a huge amount of time trying to close them whilst I scoured one session looking for the hooky process, which I eventually found and killed.

I didn't have time to note the name, but I reckon I could recreate the conditions if I reboot.

I did manage to run the Manual Disinfection by the same type of tactic and I will upload it here for you.

Any assistance will be gratefully received as my box is currently useless and it seems nothing but a rebuild is going to fix it.

Cheers,

Ian

Additional Note - My PC now won't boot up into standard mode, gets to "Welcome . . ." and the restarts. I can only get into Safe Mode. I am now officially unhappy

Close/unload all the programs excepted AVZ and Internet Explorer

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
QuarantineFile('C:\Documents and Settings\LocalService\Local Settings\Application Data\pvlaolbae\vucalggtssd.exe','');
QuarantineFile('c:\documents and settings\localservice\local settings\application data\pvlaolbae\vucalggtssd.exe','');
TerminateProcessByName('c:\documents and settings\localservice\local settings\application data\pvlaolbae\vucalggtssd.exe');
DeleteFile('c:\documents and settings\localservice\local settings\application data\pvlaolbae\vucalggtssd.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','rpjjkgke');
RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','rpjjkgke');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','rpjjkgke');
DeleteFile('C:\Documents and Settings\LocalService\Local Settings\Application Data\pvlaolbae\vucalggtssd.exe');
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
SetAVZPMStatus(True);
RebootWindows(true);
end.
[/CODE]
After reboot:
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/CODE]
- Upload the C:\quarantine.zip here: [url]http://virusinfo.info/upload_virus_eng.php?tid=83302[/url]
- Make a new log file.
- Attach a new log to your new post..

Things are looking good, but I will won't jump the gun.

New log attached, I await your response.

Cheers,

Ian

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
ClearQuarantine;
QuarantineFile('C:\Documents and Settings\Ian Sullivan\Local Settings\Temp\swt-win32-3449.dll','');
end.
[/CODE]
After reboot:
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/CODE]
- Upload the C:\quarantine.zip here: [url]http://virusinfo.info/upload_virus_eng.php?tid=83302[/url]

Quarantine file uploaded

[QUOTE=Sully2010;672174]Quarantine file uploaded[/QUOTE]the file is clean. Any problem more?

Firstly, thanks for helping me get out of the first part of the mess, I really appreciate it.

The rootkit now seems to be gone, but a couple of effects remain:

1. I can't gain access to the internet via either Chrome or IE.

[B]Chrome error:[/B]

Error 102 (net::ERR_CONNECTION_REFUSED): Unknown error.

[B]IE diag log:[/B]

Last diagnostic run time: 07/18/10 16:55:22 HTTP, HTTPS, FTP Diagnostic
HTTP, HTTPS, FTP connectivity

info HTTPS: Successfully connected to [url]www.microsoft.com[/url].
warn HTTP: Error 12029 connecting to [url]www.microsoft.com:[/url] A connection with the server could not be established
info FTP (Passive): Successfully connected to ftp.microsoft.com.
warn HTTP: Error 12029 connecting to [url]www.hotmail.com:[/url] A connection with the server could not be established
error Could not make an HTTP connection.
info Redirecting user to support call


2. My physical DVD drive is not present in explorer. I also notice that my Magic ISO drives have disappeared.

In Device manager my physical drive and both Magic ISO drives have the following error:

Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)

I assume that the rootkit didn't want me either booting from an optical or applying anything direct from the internet to help kill it and so it has disabled these components somehow.

Any ideas?

[size="1"][color="#666686"][B][I]Добавлено через 20 минут[/I][/B][/color][/size]

OK, I ran Hijackthis and could see that the rootkit had run me through a proxy, I have disabled "use Proxy" in Internet Options and I am now back online. Anything else I should do about this?

This might help

[QUOTE=Sully2010;672217]This might help[/QUOTE]No, this might not. There are not any malware traces either in AVPTool or Hijackthis-Log.

Pls. see here: [url]http://www.google.de/search?q=Error+102+%28net%3A%3AERR_CONNECTION_REFUSED%29%3A&ie=utf-8&oe=utf-8&aq=t&client=firefox-a&rlz=1R1GGLL_de___DE371[/url]

Well, Internet is working again so I am happy about that.

Any ideas on what has happened to my optical subsystem and what I can do about it?

[QUOTE=Sully2010;672255]Well, Internet is working again so I am happy about that.[/QUOTE]What did you do here?
[QUOTE=Sully2010;672255]
Any ideas on what has happened to my optical subsystem and what I can do about it?[/QUOTE]You can ask any specialist in your area.

Internet was restored by un-checking the Use Proxy Server tick-box (Internet Options\Connections\Lan Settings) the after I saw this line in the Hijackthis Log:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5643

I have now restored the Optical subsystem by Uninstalling them from Device Manager and rebooting.

Thanks for all your help here, I am a seasoned IT worker but having an SME in a field alien to me on hand and ready to help like this is really appreciated!

I just wish my co-workers were more like this . . .

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]4[/B][*]Обработано файлов: [B]19[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\documents and settings\localservice\local settings\application data\pvlaolbae\vucalggtssd.exe - [B]Trojan-Ransom.Win32.XBlocker.axp[/B] ( AVAST4: Win32:Zbot-MUO [Trj] )[/LIST][/LIST]