MBAM'd a Trojan, explorer.exe won't openSolved/Closed

Question

Hi,
A few days ago I contracted the Fake MS Security Essentials virus that is going round. I believe that it installed itself through a java backdoor - as the java splash logo came up, then firefox froze and crashed, and then the virus began spamming me with dialogs trying to warn me about viruses (oh, the irony!) and trying to sell me their anti virus software.

I am on a very tight schedule this week and so I thought I would start work on it immediately. I did the following:


I downloaded Rkill.exe to a USB and renamed it to trav7.exe. I then ran it on the infected PC - the virus processes were killed. Hurrah!

In order to remove them for good, I did an MBAM scan. I hibernated my PC overnight, resumed it in the morning, and went to school. When I came back, it had found about 24 infected files. I presuemd some of these were from previous events. I instructed MBAM to quarantine the files.

MBAM told me it had to restart in order to finish this process. I chose yes. I can't wait to see how much faster my computer is without all that nasty malware, I thought.

My computer rebooted. Or at least it tried to. It began to load Vista, then showed me a balck screen with a movable cursor on. About 2 seconds later, my mobo made a small noise, and my computer restarted. This cycle repeated each time I tried to restart the computer. 

My computer prompted me to open the Recovery Console (this has OEM branding). The Vista Repair Environment told me that I needed to do a System Restore. I did this.

Some slight progress. Windows now boots to the same black screen with movable cursor, but this is stable, and I'm able to bring up task manager. Explorer.exe is not running. I try to open it using task manager - I get a command line window which flashes for a second but no more. I use task manager to try a further system recovery. I do this.

Still the same state of affairs. Black screen, movable cursor, can open task manager but can't launch explorer.


I'd be very grateful for any assistance in this matter. My current plan of action is:


Purchase xHDD

Create an Ubuntu Live CD

Use Ubuntu to back up my personal files

Reinstall Vista

Move my personal files back to my original HDD.


This obviously carries a LOT of associated hassle as I will effectively have to reinstall every piece of software I own. It also runs the risk of transferring the infection via my xHDD. This infection could not have come at a worse time for me (my university application form is due this week, as is a major assignment), so the quickest and most painless way is really what I am after. My dad has suggested that I simply take it to a local PC Engineer because he is worried that if I try meddling the virus coudl start deleting our personal files - is this something I should be worried about?


Thanks VERY much in advance,

Matt

Ambucias · Accepted Answer

Greetings Matt,

The procedure you followed to kill the trojan was the best but the reason why you were prompted to restore gets me.  Did you reboot after running RKill?

Anyhow, at least you have the task manager to work with.

We may be able to overcome.  As we may not be in the same time zone, you may need to be patient.

Tell me with the task manager how you try to launch explorer.exe.  Do you get a message following your attempt?

I will try to get my partner on your case also, jack4all, and we will work as a team.

Catch you later

P.S. Patience is a vertu.

Ambucias · Answer

Thank you Matt.  Most interesting I must say! (But grotesque)

I am usually in the virus/security environment.

I would like jack4all's opinion and advice on this.  He should be on line soon.

Please stand-by

jack4rall · Answer

Hello,

First thanks to my friend "Ambucias"

Try this 1.

1) When you switch ON your computer, start tapping the "F8" key to get

"Windows Advanced Options"( if boot menu appears, press "Esc" key and keep

tapping the F8 key)

2) Select "Safe Mode with Networking"

3) Click on Start --> In search box, type regedt32 and press Enter.

Registry Editor will be opened. Navigate to the following location

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

At the right side, find the strings shell & userinit and check the following

shell value data should be
Explorer.exe

userinit value data should be
C:\WINDOWS\system32\userinit.exe,

If shell and userinit are having different data values then change it as mentioned

above.

Just double click shell and userinit and enter the data values as

shell --> "Value data" should be
Explorer.exe

userinit --> "Value data" should be
C:\WINDOWS\system32\userinit.exe,

Note: there is "," at the end of userinit.exe

Once again download "Malwarebytes' Anti-Malware" from the below link.

https://ccm.net/downloads/security-and-maintenance/4621-malwarebytes-anti-malware/

Update it and perform "Full Scan"

Note : Default selected option is "Quick Scan"

Good Luck.

Matt · Answer

Hi,

Thanks for the help - (un)fortunately the registry values were just as they should be, so this isn't the problem.

I'm now on the infected PC using an Ubuntu Live CD and I have retrieved the MBAM log. 

Malwarebytes' Anti-Malware 1.50

www.malwarebytes.org



Database version: 5302



Windows 6.0.6000

Internet Explorer 7.0.6000.16757



13/12/2010 16:44:53

mbam-log-2010-12-13 (16-44-53).txt



Scan type: Full scan (C:\|S:\|)

Objects scanned: 699871

Time elapsed: 3 hour(s), 52 minute(s), 11 second(s)



Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 2

Registry Data Items Infected: 3

Folders Infected: 3

Files Infected: 26



Memory Processes Infected:

(No malicious items detected)



Memory Modules Infected:

(No malicious items detected)



Registry Keys Infected:

HKEY_CLASSES_ROOT\idid (Trojan.Sasfix) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{73E0BD4D-0A0F-4C5D-BDB0-FC2B18ADDE1A}_is1 (Rogue.ErrorWiz) -> Quarantined and deleted successfully.



Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{0B2E3ADD-830D-5AFC-171F-273EDF331439} (Spyware.Passwords.XGen) -> Value: {0B2E3ADD-830D-5AFC-171F-273EDF331439} -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Trojan.Agent) -> Value: Shell -> Quarantined and deleted successfully.



Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.



Folders Infected:

c:\Users\Family\AppData\Roaming\ErrorWiz (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\program files\ErrorWiz (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\ErrorWiz (Rogue.ErrorWiz) -> Quarantined and deleted successfully.



Files Infected:

c:\Users\Family\AppData\Roaming\Efseab\saixo.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\program files\ErrorWiz\ErrorWiz.exe (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\562422.exe (Trojan.GBFE) -> Quarantined and deleted successfully. 

// ^ I THINK THIS IS THE FAKE MS SECURITY TROJAN

c:\Users\Family\AppData\Local\71638.exe (Trojan.GBFE) -> Quarantined and deleted successfully.

 //^ I THINK THIS IS ALSO PART OF THE FAKE MS SECURITY TROJAN

c:\Users\Family\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\5VQ7E5W1\setup1014[1].exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\5VQ7E5W1\setup1014[2].exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\5VQ7E5W1\inst[1].exe (Trojan.GBFE) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\DJL1RH1F\fda[1].exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\microsoft\Windows	emporary internet files\Content.IE5\K3MNMANZ\212[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\Temp\CD73.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\Temp\8A19.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\Temp\A21C.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\Temp\1F6.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Roaming\hotfix.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\Users\Family\downloads\gsfq32.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

c:\Users\Family\downloads\errorwiz_setup.exe (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\Users\Family\downloads\fbx200611_2_converter_win.exe (Adware.BetterInternet) -> Quarantined and deleted successfully.

c:\Windows\System32\madCHook.dll (MadCodeHook) -> Quarantined and deleted successfully.

c:\program files\ErrorWiz\blockprocess.dll (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\program files\ErrorWiz\errorwiz.exe.manifest (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\program files\ErrorWiz\unins000.dat (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\program files\ErrorWiz\unins000.exe (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\ErrorWiz\errorwiz on the web.pif (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\ErrorWiz\ErrorWiz.lnk (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\ErrorWiz\uninstall errorwiz.lnk (Rogue.ErrorWiz) -> Quarantined and deleted successfully.

c:\Users\Family\AppData\Local\Temp\explorer.dat (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Matt · Answer

Hi,

I have tried this fix, and it has also not worked :(

There is one interesting thing I've noticed:

If I open regedit from the Windows OS and navigate as directed, Shell is "explorer.exe". If I open it from the command prompt in the recovery console, it is "cmd.exe /k start cmd.exe"

MBAM'd a Trojan, explorer.exe won't open

5 responses

Similar discussions

Subscribe To Our Newsletter!