trojan dns changer Vista Cleaning Procedure, Malwarebytes Anti-Malware

[arnie4]

Hello there on major geeks, firstly thanks for reading this, also thanks for all the help you have given me in the past, as its work for me.

I am following the instructions on how to Vista Cleaning Procedure, for the virus called Trojan dns changer, i have managed to run the SUPERAntiSpyware, and it did find a few things, but now i cannot load Malwarebytes Anti-Malware, i have managed to install it, after re naming it following the instructions Rename the downloaded mbam-setup.exe file to mb.exe to help work around certain malware that will block it from being run.
It will not run a scan at all, it just will not load, up it doesn't even say anything , like there is a problem loading it doesn't even come on the screen loading and say there is a problem loading.
I am novice but i do follow the instructions, i even printed all the pages off this site to follow the instruction on how to remove malware.
this Trojan is really bad , its taken my windows explorer over, seem to have better run of it for the moment, on Mozilla , as for anything else nothing. i will not let me open spybot-sd either.
It is also telling me,the dns is wrong. I know whats causing the problem,its just that i really am stuck, when the things i need to use to remove the problem,will not load.
hope you understand what i have written, and thanks for any help you mite have for me. Arnie

[arnie4]

Originally Posted by DomLuc

You have already posted this in the Malware Removal Forum so really you need to wait for an answer there, since as your system is malware infected there are no software solutions outside of that.
Having said that, you need to follow the Read & Run Me First guide (that you are in the middle of) very carefully and try to complete *EVERY* step and not stop on just one. Even if that means using a CDR or USB to download programs on another machine as it explains, and even if you need to launch in Windows Safe Mode as it explains, or even running online scans, as it explains.
When you have attempted to complete every step, it is then that (having made careful note of problems you had) you post all the logs of the steps that you did manage to complete in a new thread there (which you have already started) along with those notes on problems, and any question you have.
You will then get answers and further directions from MajorGeeks trained, expert Authorised Malware Moderators.
If they judge the need for a software solution, then they will direct you back here at their discretion.

Good luck

thanks for that , didn't realize i had posted it in 2 places. as for doing every step a mean every step, that's all i have done for the last 2 days, i know what i have to do and i follow everything to the letter, i gace done it all before, as i said, i printed out all the things i needed to do and followed them to the letter, i follow it all to the letter.
however, it still does not solve the problem of why i cannot in either safe mode or normal mode load malwarebytes, even when i have change the file name, I have found some of the problems with the superantispyware, so i am doing what it is telling me to do. It will not load up malwarebytes. I do not have any other computer to use either.
thank you for letting me know and thanks for the heads up about my double post.

[arnie4]

Originally Posted by DomLuc

Hi Arnie

It is mightily frustrating quite what malware can do to a system and we all appreciate that.
However, if you have an internet connection and Mozilla Firefox browser is working then carry out all the 'online scans' that the guide mentions too.
You say that SuperAntiSpyware did run (and found some things) so you needed to have posted that log as a text attachment to that other thread in Malware Forum, and report to them what happens after you run *each* of those online scans.

Good luck with it - no need to reply back here for the time being, just stick in the Malware Forum.
I do have to say though, they reply to each user in a strict queue of when they first posted, the Malware Experts are busy, so you do sometimes have to wait even a couple of days.

My last piece of advice is this: If your system does *not* hold any personal data that you cannot afford to lose *and* you really can't wait much longer to have your system back and running *and* you have an Operating System recovery CD that is reasonably up to date (ie for Windows XP it is at least Service Pack Two) - then you do have the option to use the CD to perform a *thorough* reformat of your hard drive and then reinstall your Operating System as new. This is a last resort option so please don't take it as if I am specifically advising you to do that - I'm not. Just saying it is a possible option, on which you can get more advice if needed.

Best of luck!

haha i replied to myself then sorry
thank you for the advie Domluc, yes it is very frustrating, l i did have this problem before a long time ago, and i used major geeks to help me with that, that is why i printed everything out, and floowed it like i did before, am still on the same computer when i had the problem last time. its hard to post when you have nothing to post, results i mean. its like it don't won't me to repair it, when i do something to try and get rid then it stops me or over rides me. thanks again and yes i have thought about doing the format , i did think about this morning, just don't won't to lose the pictures of my daughter, that's why i need to get it sorted myself.
i know i need to be patient, i thought i would be able to fix it, like i did last time, the trojan must have gotten stronger. thanks for reading mate, just have to see how i get on!

take care arnie

[arnie4]

Originally Posted by DomLuc

OK Arnie

Hope you don't mind me clarifying a couple of things here because you don't actually answer them directly or specifically. So please bear with me and don't feel put out or offended. Clarity is critical.

1. You said you were able successfully to run Superantispyware, and it found some things. So you *must* have a text log of those scan results, so you *must* have that to 'attach' to your malware forum thread.

2. You can't have yet tried those 'online' scans (see here: http://forums.majorgeeks.com/showthread.php?t=80343 )
that I referred to from the Read & Run me First Guide since I mentioned it (there hasn't been enough time) and so can you please say very clearly have you previously run them or will you now attempt them?

Thanks Arnie!

Hiya Domluc i have no problem in answering any questions at all with you, as thats what am here for, to help myself to fix the problem. so no worries with what you ask me.

to the first question, yes i did run superantispyware today and last night, last night it found 39 problems , but it kept of freezing, today i managed to scan it in safe mode and the modem disconnected. i found 3 things with that scan. so i have to find the log for that?? and send it to malware? , the only reason i have not posted the results is, it says post all th logs at the same time, but i understand now if i need to post it, if i am not getting any further with the problem i have got.

to question number 2, no i have not used the scans you have just posted , because the problem i have stops me from doing so, so i am unable to get any logs that way,hope that make sense. also my internet connection , keep going off an being taking over by the trojan changer.

I will not try and do the alternative scan and try and find the post for the log from the superantispyware.

thnaks for being so quick Arnie

[arnie4]

Originally Posted by arnie4

Hiya Domluc i have no problem in answering any questions at all with you, as thats what am here for, to help myself to fix the problem. so no worries with what you ask me.

to the first question, yes i did run superantispyware today and last night, last night it found 39 problems , but it kept of freezing, today i managed to scan it in safe mode and the modem disconnected. i found 3 things with that scan. so i have to find the log for that?? and send it to malware? , the only reason i have not posted the results is, it says post all th logs at the same time, but i understand now if i need to post it, if i am not getting any further with the problem i have got.

to question number 2, no i have not used the scans you have just posted , because the problem i have stops me from doing so, so i am unable to get any logs that way,hope that make sense. also my internet connection , keep going off an being taking over by the trojan changer.

I will not try and do the alternative scan and try and find the post for the log from the superantispyware.

thanks for being so quick Arnie

i have attached the log to the malware site

[arnie4]

Originally Posted by DomLuc

Great - they are more or less the answers I was looking for.

1. YES - if you *do* have a SAS log, then YES do attach it to your Malware Thread.

2. Of course, if you literally cannot do any online scans, you can't do them. But I have to sadly say I still get confused by your answers because I cannot pin you down to say simply, in short order 'Yes, I tried to surf to (for example) Eset Online Scanner but it would not load to that page, or any of the others.' Because now you say you will try them again?

Anyway, If you can find the SAS log, then I suggest you post it in your Malware Thread, with a *short*, point by point description of the other steps you cant complete, and how you have tried the online scans and what happens when you do.
It is best to make your posts there as *concise* and clear as you can - bullet point style is best.

Good luck

thanks again, i will try and do the online scan, am sorry but i have lost one page of the download of how to do all this, , so i missed the online scan, i will try that now and see what happens.
i have posted the log from the superantispyware thanks again mate!

[arnie4]

Originally Posted by DomLuc

Great - they are more or less the answers I was looking for.

1. YES - if you *do* have a SAS log, then YES do attach it to your Malware Thread.

2. Of course, if you literally cannot do any online scans, you can't do them. But I have to sadly say I still get confused by your answers because I cannot pin you down to say simply, in short order 'Yes, I tried to surf to (for example) Eset Online Scanner but it would not load to that page, or any of the others.' Because now you say you will try them again?

Anyway, If you can find the SAS log, then I suggest you post it in your Malware Thread, with a *short*, point by point description of the other steps you cant complete, and how you have tried the online scans and what happens when you do.
It is best to make your posts there as *concise* and clear as you can - bullet point style is best.

Good luck

how do i attach the online scan to the thread? am using trend micro at the moment, as i cannot use Internet Explorer for anything, it keeps redirecting me to pay for things web sites. am using Mozilla at the moment!!

[arnie4]

Originally Posted by DomLuc

Copy and paste the results into 'Notepad' (start > all programs > accessories > notepad') then go 'File > Save As > 'Trend Micro Online Scan Results'

DON'T attach them to your Malware Thread one by one!

Do all the online scans you can - save the results (by copy and paste if necessary) one by one, then either attach them altogether, or better still if their are more than 3 right click on all of them and create a ZIP file and attach that one zip file and name that zip file 'online scan results'.

thanks i will try my best, they are not all supported on mozilla some won't run, and as i said earlier Internet Explorer will not work.
just tried a rootkit and it said my system operation not supported, so i will try as many as possible mate thank you!

[arnie4]

Originally Posted by DomLuc

Great - they are more or less the answers I was looking for.

1. YES - if you *do* have a SAS log, then YES do attach it to your Malware Thread.

2. Of course, if you literally cannot do any online scans, you can't do them. But I have to sadly say I still get confused by your answers because I cannot pin you down to say simply, in short order 'Yes, I tried to surf to (for example) Eset Online Scanner but it would not load to that page, or any of the others.' Because now you say you will try them again?

Anyway, If you can find the SAS log, then I suggest you post it in your Malware Thread, with a *short*, point by point description of the other steps you cant complete, and how you have tried the online scans and what happens when you do.
It is best to make your posts there as *concise* and clear as you can - bullet point style is best.

Good luck

had to scrap the trend scan it froze on me, managed to used the bitdefender, with the internet explorer though, taking long time to scan mate!!

[TimW]

If you are going thru a router, you will need to reset it to factory settings.

[arnie4]

Originally Posted by TimW

If you are going thru a router, you will need to reset it to factory settings.

not got a router Tim its cable modem!

[arnie4]

[QUOTE=arnie4;1339840]thanks i will try my best, they are not all supported on mozilla some won't run, and as i said earlier Internet Explorer will not work.
just tried a rootkit and it said my system operation not supported, so i will try as many as possible mate thank you!
also mate, when i go in to (system configuration) the boot mode, i cannot tick any of these boxes, as you say you need all the info!

1)safe boot mode
2)minimal
3)alternate shell
4)active directory
5)network)
6)no gui boot
7)boot log
8)blase video
9)os boot imformation
10)make all boot settings permanent.
the only reason i have posted it and found this out, is because i tried to reboot in safe mode, so i just tried to see if any boxes would tick , as you can see they do not!
cheers again m8.
this is a software problem??

[arnie4]

Originally Posted by DomLuc

Great - they are more or less the answers I was looking for.

1. YES - if you *do* have a SAS log, then YES do attach it to your Malware Thread.

2. Of course, if you literally cannot do any online scans, you can't do them. But I have to sadly say I still get confused by your answers because I cannot pin you down to say simply, in short order 'Yes, I tried to surf to (for example) Eset Online Scanner but it would not load to that page, or any of the others.' Because now you say you will try them again?

Anyway, If you can find the SAS log, then I suggest you post it in your Malware Thread, with a *short*, point by point description of the other steps you cant complete, and how you have tried the online scans and what happens when you do.
It is best to make your posts there as *concise* and clear as you can - bullet point style is best.

Good luck

hello again dom sorry for leaving this with you, not sure where am supposed to post it a just need some help, i don't won't to lose the pictures of my daughter, they are from her being 2 till now , she is 5, so many year of them. so the new thing is the speed of my pc,
i run on 20meg download, today my computer is running on about 0.50meg, super slow its worse than dial up. i usually get a min of 14meg download speed. it is really sad, would it fixed if i repaired it with my windows vista disc, not a full format, just the repair part on the disc??
please asking for help thank you dom

[arnie4]

Originally Posted by DomLuc

The best thing is to copy all those Photos (and any other personal data you want to keep safe) to CDs or a USB Pen Drive as soon as possible.
You'll then know they are safe.

i understand that , i have an external hard drive m8 which was not plugged in to the tower when i got this virus , so the virus or trojan or whatever isn't in the external hard drive, but i think if i try and move the files of my hard drive to my external hard drive, that i would only pass the virus to the external hard drive then , that way i would lose even more.
is it possible to move my things from the computers hard drive to my external hard drive, with out the virus going in there to??

thanks for the answers mate!

[arnie4]

Originally Posted by DomLuc

Burn the Pics to a CD or DVD (depending on what CD writer or DVD writer drive you have) or USB Pen Drive. Just make sure you use a good CD/DVD writing program (such as your Vista inbuilt one or CDBurnerXP on majorgeeks.com) and set it to verify the data when it is burning.

Now you have the data on a disk. You can scan that disk for malware on another system, now or at a later date, that has *good* security, or on your own system when it is up and running.
If you have internet connection right now, and you are not doing anything else, you can gradually email the pics to yourself, or another free email account that gives large free storage space, such as Googlemail. That way you have the pics on disc and you have them on an email provider's server.

thanks a lot for that Dom. i would never of thought of doing that emailing them to myself , that's well cool, thanks a lot Dom

[arnie4]

Originally Posted by DomLuc

You're welcome!

i finely got the malwarebytes to run after 3 days lol. what ever Tim did when he told me to do must of got it out of the registry. that seem to make it work, then as i was scanning it still tried to stop me from scanning, it kept saying, that my software was not responding, its a really nasty bloody trojan i know that mate.
thanks again