Win 7 Antivirus: Need help getting started

My wife's laptop is running Windows 7 64 bit. Earlier today she encountered the annoying "Win 7 Antivirus" crap (a window for Win 7 Antivirus pops up when trying to run anything and won't allow the program to run). Now, we are unable to do anything on the internet or run most programs because of it. While going through the READ AND RUN I discovered that it won't let me make changes to the User Accounts settings. Per the READ AND RUN instructions, I haven't done anything else because I can't disable user account control. Please let me know where I should go from here.

I've downloaded SAS, MBAM, Combofix, MGTools, and TDDSKiller (just in case) onto a flash drive but haven't put it into the laptop yet until I know I have everything I may need.

 

Hi programmer04,

http://img406.imageshack.us/img406/3189/windowsrepair.gif Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop on the PC with the infection.

Open up this newly created folder and then open the "files" folder (...\windows repair v1.5.8\files)
From here, locate the fix_exe_hijack.inf file and then Right-mouse click it one time, then choose "Install".
Once you have done this, you should now be able to open applications again.

http://img805.imageshack.us/img805/9659/rktigzy.gif Please download RogueKiller to your desktop.

Rename RogueKiller.exe to winlogon.com
Double-click winlogon.com to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the number "2" and press ENTER.
When it is finished -- Notepad will open with the report and the log is saved to your desktop.
Attach RKreport[1].txt to your next message. (How to attach)
You can now type the number "0" and press ENTER to exit RogueKiller.

Then proceed with the Read me first instructions. Remember to disable UAC after you have run RogueKiller. Let me know if you need additional help.

 

Here is the RogueKiller txt file. I had to do that one first since it wouldn't let me open the Windows Repair zip file. Everything worked like a charm. On to completing the READ AND RUN.

 

Finished running everything. I had no problems or errors. SAS detected nothing. MBAM detected a few things, including the winlogon file I created earlier. I deselected that (I'll delete it later). Combofix and MGTools ran fine. So far everything seems to be running fine again.

I do believe there was a problem with java. I've noticed in the past week or so that there seemed to be an update every day, yet when I checked and installed the most recent version through majorgeeks I noticed that my version was old.

 

You should have run a Complete Scan with SAS.

Please do this now and I will review the rest of your logs later today.

 

I'll run the complete scan, but if that's the way it was meant to be done in the first place then someone needs to edit the directions for SAS. The current directions say to leave the selections on the home screen as is and never mentions clicking on the Complete Scan option.

 

Here's the log for the SAS complete scan.

 

http://img825.imageshack.us/img825/2648/hjt.gif Run C:\MGtools\analyse.exe by double-clicking it (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Choose "Do a system scan only" and select the following lines but do not click fix until you exit all explorer windows and all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - MRI_DISABLED - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

After clicking Fix, exit out of Trend Micro HiJackThis - v2.0.4


http://img194.imageshack.us/img194/4930/combofix.gif Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
4d41aec7
[COLOR="DarkRed"]File::[/COLOR]
C:\ProgramData\4d41aec7
[COLOR="DarkRed"]Folder::[/COLOR]
C:\windows\assembly\temp\U
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B33E2BF5-E311-4FE5-957E-BE61417A4E0E}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.txt on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.
http://softvisia.com/users/Night_Raven/Security/cfsdnd2.gif
This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

http://img684.imageshack.us/img684/3557/tdsskiller.gif I want you to read and follow these instructions: TDSSKiller - How to run

http://img17.imageshack.us/img17/3214/baticonvista7.gif Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

 

Here are the latest logs.

 

Your logs are clean now.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Take care and be safe!