Horrible Win32: Downloader NUA Trojan. Please Help!

[pennylane909]

Also i ran the TDSKILLER and found 5 threats.... none curable

[DonZ63]

Hi DonZ63,

Do not give a misreprentation of the facts here

Lighten up, dude. I meant Avast forum malware specialist. My mistake. Go have a cool one and chill out.

[Pondus]

@pennylane909.

You need to start your own topic...

Follow the guide here and attach the logs
http://forum.avast.com/index.php?topic=53253.0

[essexboy]

Hi pennylane909 could you run aswMBR and OTL as per this thread and start your own topic... As soon as you have posted I will have a look see
http://forum.avast.com/index.php?topic=53253.0

Back to Jeff 

[jeffce]

Hi jibbyreznor,

Rerun TDSSKiller and when you get to the new log please attach that. 

[jibbyreznor]

Attached is the TDS Log Jeffe

Thanks again for your help

Jamie

[jeffce]

No...I meant run a new scan with TDSSKiller and attach the new log.  Sorry if I didn't explain well enough. 

[jibbyreznor]

Sorry mate didn't realise you wanted a new one. Here it is. It didn't find anything.
Still no CD drive, have no idea whats happened there!

Thanks again.

[pennylane909]

Sorry i posted it in this because i have the exact same virus....

[jibbyreznor]

Quick Update, CD Drive has returned. Used Microsofts FIXIT program and it has returned Virus remains though.

[jeffce]

Hi jibbyreznor,

Seeing as how you seem to have Ramnit this may be very tricky.  Ramnit is a file infector and there is no telling the degree to which your system is infected unfortunately.  This is only my opinion, but if it were my system and I were infected with Ramnit I would format and reinstall my operating system.  If you would like to continue and attempt to clean your system do the following:


Please download the following programmes to your desktop:

Dr Web Live CD

ImgBurn

Install IMGBurn

• Double click Dr Web
• IMGBurn will open
• Burn the ISO to a cd

• Reboot the infected computer with the CD in the drive
• Ensure that the first boot device is CD - If you are not sure about that then see this page for instructions
  
• As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.

• Use arrow keys to select  DrWeb-LiveCD (Default)
• When the system is loaded, check the disks or folders you want to scan, and click on “Start”.

• The programme will now scan for and cure/delete any malware that it finds.  Allow it to do so 
• Once completed reboot to normal windows
• No log is produced so once in normal windows run a fresh OTL scan and let me know if the problems persist

[jibbyreznor]

Hi,

I ran DR.Web it picked up some stuff then cured or quarantined it.  But the issues still remain. I have attached the latest OTL log for you to take a look at.

Thanks again for your help,

Jamie

[jeffce]

Hi,


Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.  Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  
  
• Double click on ComboFix.exe & follow the prompts.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.  It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet.  The connection is automatically restored before CF completes its run.  If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
4. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
5. If after the reboot you get errors about programs being marked for deletion then reboot, that will cure it.
---------

[jibbyreznor]

Hi, ran combifix, attached is the log. Not sure if running it was meant to solve anything, but it hasn't.

Jamie

[jeffce]

Hi,

Let's see to what extent Ramnit has infected your system.

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


[list=1]

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)[list=1]
• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

• Check
  
• Click the Start button.
  
• Accept any security warnings from your browser.
• Check
  
• Make sure that the option "Remove found threats" is Unchecked
• Push the Start button.
  
• ESET will then download updates for itself, install itself, and begin

scanning your computer. Please be patient as this can take some time.

• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
  
• Push the Back button.
  
• Push Finish
  

http://www.eset.com/onlinescan/
----------