Can’t open Webpages, and System Restore isn’t working.

Can anyone help? My partner’s PC is running Windows XP SP 3. Problems began this morning with a Windows message saying that the computer was infected. Another message said that the AVG Update had failed to connect. Ran AVG scanner, which said it had found and removed 13 viruses, including SHeur.CQKK from several folders (infecting something called brastk.exe – not sure where that comes in but a quick Google just now seems to show that it’s a problem, and I’m not sure whether I need to do something further about it), SHeur.CQJZ, Agent.AHRN and Agent.3.R.
I next tried to update AVG, and got a failed to connect error message. Tried to connect to other webpages through Firefox, and got only blank white pages, except for my Yahoo Mail sign-in page – although when I did sign in got only a blank page again. Got exactly the same results in Internet Explorer, except it gave an error message saying that “Internet Explorer cannot display the webpage.” It had a button to test whether the Internet connection was working – confirmed that it was. I tried connecting through both browsers with the firewall (ZoneAlarm) and AVG turned off – still the same results.
I next tried System Restore to try to return to a state before the problem occurred. Got as far as the Confirm Restore Point window, pressed the Next button, but nothing happened. As suggested in a thread in Tech Arena Community I tried System Restore in Safe Mode – but still nothing happened when I got to the Next button on that window.
Following a suggestion on something I’d googled I ran CCleaner and then WinsockxpFix. Neither helped.
On various reboots I’ve been getting a window saying that “The system has recovered from a serious error”. It invites me to send an error message to Microsoft, but it just results in a connection to a blank webpage. I’ve also been getting another message saying that “Disk Defragmenter NTFS Module has encountered a problem and needs to close” though I haven’t started the Defragmenter.
Don’t know what to try next. All suggestions gratefully received.

Have your tried running your scans in "Safe Mode"?

I do recommend that you scan your system with free online scanners like Microsoft Windows Live OneCare, Norton PC Checkup, etc. just to be sure.
Here are the links:
http://onecare.live.com
http://www.symantec.com

TheGreatOne has suggested nice option but atlthogh Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS.And if u going to reformat and again OS installation then you should not backup any .exe files because they may be infected. Your photos, music, doc's should be ok but to be safe, scan them with your anti-virus before you copy them back to your pc.
Good luck :thumbup1:

My Brother just backup all your Data and Simply format it.

I am having these exact issues - has anybody found any solution other than reformatting?

Downloaded, ran and still have the same issues... =/

I will give that a shot and let you know how it turns out.


I'd hate to think someone else had this problem, couldn't find a solution and had to format all because I was unwilling to come back and share!

Quote:

---

Originally Posted by JoeFrat

My Brother just backup all your Data and Simply format it.

---

I too suggest that. With so many problems occurred, the computer seems to be seriously affected with either viruses or corrupted system files due to some unknown reasons. It will be difficult to completely recover from this problem with the help of AVG or any other antivirus programs, however good they may be.

moonferret, I too have exactly the same issues and it only happened this Friday 31st of October. Our home PC has certainly been infected and I have exactly the same messages regarding infection, NTFS Disk Defrag and System recovered from serious...

Here's what I noticed though, all the web sites that don't work are the ones that could help us eliminate the infection. So microsoft updates, Symantec, Panda, PC Tools Spyware Doctor etc. If you try other sites, they are fine including the parts of Microsoft site that do not have updates. Even the system restore has been 'disabled' to prevent getting your system to a previous working state. So I am certain this is by design rather than coincidence.

Everyone's suggestion of reformatting is really not an option for us because of all the software and license keys that we don't have. They are not pirate versions but got the PC from my previous employer and windows was OEM.

So if anyone has any smart ideas on how to get the updates please inform us. I am sure if we can get all these products searching and destroying we would substantially free ourselves from the problem.

Finally I think it is important to try and find solutions for these new issues to help the community. If this issue does spread, I think it would be hugely damaging.

All,

Well I have spent many, many hours on this problem and I have had to address each of the issues individually. Firstly I wanted to disinfect the PC and get updates working and then work on the other problems.

So I have a solution which resolved the majority of the issues but took quite a bit of work. Here are a few things I suggest you try.

1. Backup registry (I just exported it)
2. Create a restore point
3. Go to www.malwarebytes.org, download, install and run. (Full scan) Probably have to restart.
4. Repeat 1&2
5. Download windows defender from MS, http://www.microsoft.com/windows/pro...r/default.mspx install and run. (Full scan)
6. Repeat 1&2
7. Download Hitman Pro http://www.softpedia.com/get/Interne...tman-Pro.shtml. This is a beta version but you should be able to get the full version from http://www.hitmanpro.nl/. Install and run. (Full scan)
8. Repeat 1&2
9. Go to Microsoft updates and make sure you are up to date with everything for you OS.
10. Update your anti virus (mine was Panda) and do a full scan.
11. Re-boot and check the issues.

Please try all the above and tell me if you get stuck anywhere. If you achieve all of the above, you should have resolved quite a few if not the majority of your problems.

If you have specific problems after that please post them and I will hopefully have some more ideas.

At least we won’t have to reformat the disk!

Best of luck

start PC in safe mode
delete files brastk.exe from %systemroot% & %systemroot%\system32
delete files beep.sys from dll cache and driver filder in system32
reboot
update Antivirus and scan for virus
try to replace svchost.exe (u can get it from another PC)
or
start commandPrompt and type sfc /scannow
insert windows XP CD
reboot
and cross your finger & pray ....:thumbup1:

My son's PC had this problem.



Here's how I fixed it

• Uninstalled AVG8, Installed trial of Windows OneCare and ran scan -- found 3 malwares
• downloaded HiJackThis 2.0.2 onto USB stick (using another PC)
• installed onto infected PC -- It showed me PC had malware "karna.dat" in "%progfiles%\Google", so Fixed it (in HiJackThis)
• downloaded Malwarebytes' Anti-Malware onto USB stick (using another PC)
• Installed onto infected PC -- There were some regsvr32 errors during install which I ignored
• Ran quick scan -- found 22 malwares
• Anti-Malware software needed me to reboot to delete some files

After reboot, the PC was pretty much back to being fully usuable -- I could get to web sites. After reboot

• OneCare reported another malware - "Yaludle.A" - fixed
• Ran Anti-Malware full scan

I must say Malwarebytes' Anti-Malware is impressive and I think it may have sorted things out on its own, without all the other steps

Update to above post -- Anti-Malware full scan reported 3 more malwares.
uninstalled OneCare and reinstalled AVG8 free -- when MS release OneCare for free I'll start using it!

If anybody cares, here's the first Anti-Malware log -- one of these buggers is causing the problems moonferret described:

Malwarebytes' Anti-Malware 1.30
Database version: 1306
Windows 5.1.2600 Service Pack 2

13/11/2008 13:26:20
mbam-log-2008-11-13 (13-26-20).txt

Scan type: Quick Scan
Objects scanned: 47065
Time elapsed: 3 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 3
Files Infected: 13

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\core (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Ipwindows (Trojan.Rond) -> Quarantined and deleted successfully.
C:\Casino (Adware.Casino) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\?ssembly (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Mozilla Firefox\Components\ffcomponent.dll (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\WINDOWS\msacm32.drv (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\151521953112.CPX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\151521953121.CPX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\wr.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSbawe.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSfflo.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSkwvp.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSppes.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSqxos.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSytqy.log (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\drivers\TDSSovxn.sys (Rootkit.Agent) -> Delete on reboot.

Many, many thanks to all those who made contributions here. Thanks to you I’ve solved the problem.
I’m sorry to have been so long in acknowledging your help, but in fact I didn’t find it until yesterday evening. After I’d made the original post I had some message which made me think I’d somehow failed in doing so. Not succeeding in finding other solutions I was gearing myself up to do a reinstallation of Windows, when I thought I’d google the name of the virus (SHeur.CQKK) to see if there were any recent queries – to come up with my own posting and your replies.
For anyone else who comes across the problem, I solved it by starting with the simplest suggestion from JoshGreifer which was to install Malwarebytes' Anti-Malware and run a quick scan. That unearthed 12 nasties. After removing those I was able to connect to the Internet and update the program, and ran another quick scan which revealed 3 more. I then ran a full scan which found something described as a Trojan Downloader lurking in C:\System Volume Information\ _restore{C8B1AEBE-D57F-4DD6-9AAD-A70D8BCC12B7}\RP51\A0021382.sys (Trojan.Downloader).
I had only about half an hour of relieved triumph however. Flushed with the success in solving that computer’s problem, I decided that perhaps I could solve a little problem on my own computer where the AVG automatic update was disabled. I uninstalled then reinstalled AVG – and lost any facility to re-enable my wireless connection. As the problem seems unconnected to the previous one and I may be able to get advice from my ISP, I’ll start a new thread on it if I need further help.
In the meantime may I reiterate my grateful thanks for your help – a real sense of there being a supportive community out there.
A question though – how did the infections get through Zone Alarm and AVG, and are there other precautions one should be taking?

I have been having this exact problem Moonferret described, with the lack of the serious error report.... After reading (thanks a ton for the suggestions!) and working through the proposed solutions, I hit some snags.

I can run (couldn't visit the sites, as was mentioned earlier) Windows OneCare, AVG, and Adaware... but, they did not fix the problem in windows or in safe mode, I am unable to even install Hijack this and Malware bytes!

I can't system restore (even in safe mode with command prompt, it still won't go beyond the next), nor can I install/run these last two programs in safe mode.


Does anyone have a suggestion as to what I might do to force or allow these two programs to be installed?

try SMITFRAUDFIX. it is a free download that will nuke the malware prosses that prevent you from installing anti -anything.use the second option and follow the instuctions. after it reboots, you should be able to install anti virus/malware/spyware apps to clean your pc

do you have a windows disc that you can do a repair from?
That would be the next option I would try. If you got some of the nasties out, sometimes it corrupts some windows files leaving parts of the os useless. Give that a try if you can.

Update:

Fixed. :thumbup1:



If anyone else has this problem here is what I did to fix it.


Control Panel/System/Hardware/Device manager

From there, select view on the top, and check 'display hidden devices'
Once done, go to 'plug and play drivers' and then find 'TDSS.serv' (or something like that) and right click and disable it.

Restart your computer, you can now install and run Malewarebytes which will eliminate the program.


As an interesting note, I have Windows Onecare which said my computer was fine, except for a Windows update, once TDSS.serv was disabled Windows Onecare started popping up saying it was finding all sorts of stuff.


It's a nasty little guy, messes with your root and registry files.

This should fix it all up fine.

Thanks all for the tips!