MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 07-13-13, 07:01
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Serious malware infection

Hi. I've recently picked up serious infection of malware on family laptop. Google redirects all search results to pop ups, advertising etc. I have no other browser installed, it won't let me install any other browsers or any of the tools required to check for virus malware or even run the windows security software. Can't access an online scanner due to redirects. I'm lost. Have to use ipad to type this!!!!! Please help
Reply With Quote
Sponsored links
  #2  
Old 07-13-13, 16:09
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

What version of windows are you using?
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #3  
Old 07-13-13, 18:06
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

Windows 7 professional. Toshiba laptop 64 bit. Managed to somehow run an online scan through ESET yesterday and among other things it returned sirefef.EZ trojan. When I tried to install any tools from your READ FIRST thread it returns the ".exe contained a virus and was deleted" message.
Reply With Quote
  #4  
Old 07-14-13, 10:04
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

Please do the below so that we can boot to System Recovery Options to run a scan. There will be two options to choose from. One if you do not have your Windows 7 boot DVD and another when you have your DVD.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Option1: Enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

Option2: Enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:
Quote:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #5  
Old 07-14-13, 12:42
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

OK Thanks, had a bit of trouble as had to download from PS3 onto USB, but think that's got it now
Attached Files
File Type: txt FRST.txt (21.5 KB, 3 views)
Reply With Quote
Sponsored links
  #6  
Old 07-14-13, 14:41
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

Save fixlist.txt to your flash drive.
  • You should now have both fixlist.txt and FRST.exe on your flash drive.

Now reboot back into the System Recovery Options as you did previously.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (See how to attach)

Now boot into normal Windows can continue with the below.

Running MGTools.
Attached Files
File Type: txt Fixlist.txt (596 Bytes, 14 views)
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
The Following User Says Thank You to TimW For This Useful Post:
yellowman7884 (07-14-13)
  #7  
Old 07-14-13, 16:49
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

I'm unable to transfer fixlist.txt file to flashdrive through infected computer. I have no other access to PC/laptop at the moment. Will this be required for further work?
Reply With Quote
  #8  
Old 07-14-13, 17:33
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

OK, I had to open fixlist and type it and save it on notepad. I managed to then run FRST64 with this fixlist and produce the attached log.

You said continue with MGTools, however I am unable to install this to the root C:\ Drive
Attached Files
File Type: txt Fixlog.txt (1.7 KB, 1 views)
Reply With Quote
  #9  
Old 07-14-13, 20:37
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

OK, sorted now. UAC disabled, MGTools run from root C:\ , and MGlogs attached.
Attached Files
File Type: zip MGlogs.zip (178.4 KB, 1 views)
Reply With Quote
  #10  
Old 07-15-13, 09:38
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

Download OTL to your desktop.

Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:
:processes
:killallprocesses
:files
C:\windows\assembly\GAC_32\Desktop.ini
C:\windows\assembly\GAC_64\Desktop.ini
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
  • Then click the Run Fix button at the top.
  • Click the OK button.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista , Win7 or Win8, don't double click, use right click and select Run As Administrator).


Then attach the below logs:
  • C:\MGlogs.zip

Make sure you tell me how things are working now!
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
Sponsored links
  #11  
Old 07-15-13, 13:26
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

O K . OTL has been run. log attached - I think (found it in C:\_OTL)
Getlogs.bat run, and log attached.

Once I did this, I attempted to download firefox and am continuing to get the ".exe contained a virus and was deleted" message.

Don't seem to be getting the redirects and advertising which is a good sign though.
Attached Files
File Type: log 07152013_184306.log (5.4 KB, 1 views)
File Type: zip MGlogs.zip (172.1 KB, 1 views)
Reply With Quote
  #12  
Old 07-15-13, 14:50
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

Save fixlist.txt to your flash drive.
  • You should now have both fixlist.txt and FRST.exe on your flash drive.

Now reboot back into the System Recovery Options as you did previously.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (See how to attach)

Now boot into normal Windows can continue with the below.

Running MGTools.
Attached Files
File Type: txt Fixlist.txt (139 Bytes, 1 views)
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #13  
Old 07-15-13, 15:50
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

Right, I have attached both logs from last instruction for your review.
Attached Files
File Type: txt Fixlog.txt (941 Bytes, 2 views)
File Type: zip MGlogs.zip (178.3 KB, 1 views)
Reply With Quote
  #14  
Old 07-16-13, 13:41
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

That took care of it.

If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
  2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  5. Go to add/remove programs and uninstall HijackThis.
  6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  7. After doing the above, you should work thru the below link


Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #15  
Old 07-16-13, 13:50
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

Unfortunately not. Still unable to install any software - "Firefox setup stub 22.0.exe contained a virus and was deleted", and just attempted to open Microsoft security essentials -"windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item".
Still no redirects or advertising though.
Reply With Quote
Sponsored links
  #16  
Old 07-16-13, 13:54
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

Your logs are clean. I am going to suggest you post in the software forum for further assistance.

Have you tried uninstalling, running CCleaner and then reinstalling?
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #17  
Old 07-16-13, 14:13
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

Many thanks for your assistance anyway. Much appreciated.

I tried to uninstall Security Essentials, run CCleaner and Reinstall as you suggested, however Control Panel shows MSE as a blank icon and says that I don't have sufficient privileges to uninstall.
Regardless, I ran CCleaner and went to Microsoft Security Essentials site to download again but was presented with the same continuous ...contained a virus... that I get when attempting to download any software.

I will do as you have suggested and repost on the Software thread.
Reply With Quote
  #18  
Old 07-16-13, 14:17
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

Please download ComboFix to your desktop. Turn off any AV software you have before you run it. Attach the log when finished. Do not do anything while it is running or it may stall the program.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #19  
Old 07-16-13, 14:59
yellowman7884 yellowman7884 is offline
Private First Class
 
Join Date: May 2007
Posts: 33
Thanks: 6
Thanked 0 Times in 0 Posts
Default Re: Serious malware infection

OK, I had saved combofix to USB drive and unlike other other files, could not transfer to directly to desktop. Only a link to desktop. I know this is not ideal but could not seem to do it any other way.
I ran it anyway and the log is attached.
Attached Files
File Type: txt ComboFix.txt (24.6 KB, 2 views)
Reply With Quote
  #20  
Old 07-16-13, 15:35
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,667
Thanks: 445
Thanked 4,644 Times in 4,384 Posts
Default Re: Serious malware infection

Looks like some malware leftovers,so please go to the Read and Run First instructions and get me the requested logs ( RogueKiller and Hitman in particular).
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
Sponsored links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Possible Malware infection wormgod Malware Removal 13 07-03-12 07:52
Malware infection Thorn Malware Removal 2 09-04-10 18:10
Malware Infection - hlp please auxder Malware Removal 4 07-12-08 14:16
I have to believe that this IS from Malware Infection - ? grc123 Software 11 05-27-08 17:10
Possible Malware infection yarafie Malware Removal 4 12-03-07 01:38


All times are GMT -5. The time now is 15:14.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger