After effects of security live platinum malware

clueless86 · Aug 19, 2012

I'm afraid I'm completely clueless at fixing PC problems, hence the amount of detail I'm going to go into, apologies if a lot of it is not required:

* Have Windows 7 64bit operating system

* Got Live Security Platinum virus about 2 weeks ago, searching forums managed to find a fix to stop the pop up using a fake activation code and downloaded malwarebytes software to supposedly remove the virus. However an icon for LSP still appeared in Hidden Icons on task bar afterwards. Was concerned but didn't think any more of it as PC appeared fixed.

* almost 2 weeks after supposedly remove virus, LSP popped up again as before. Used same fake activation code to stop pop up. Then somehow through properties managed to find the folder causing problems in C:/programdata, deleted the dodgy files by renaming them which allowed me to delete them.

*Decided to use Microsoft Essentials to ensure PC was now fully clean. When opened it, it had stopped working so I fell into the trap many others have of uninstalling it and reinstalling it again (I had removed the malwarebytes program from PC in case they conflicted)

* Started a scan which found 2 Sirefef trojans within seconds, but then this kicked off the reboot loop where the PC restarts within a minute or two of running to stop the trojans from being removed.

* Luckily have other computer and found following post with similar problem:
http://forums.majorgeeks.com/showthread.php?p=1748049#post1748049

* Tried today to follow instructions however when tried to do the advanced boot part, instead of giving me the options mentioned by thisisu, PC went straight into trying to repair the problem and the only option it gave was to restore the PC to fix it. There was no option to go into command prompt. It gave no indication as to when it restored my PC to, however Microsoft Security Essentials is not on the PC now so its not forcing a reboot every two seconds, and the dodgy file in C:/programdata is not there.

* Despite not knowing where my PC is up to, novice that I am decided to throw caution to the wind and still run the scan and search suggested by thisisu using Farbar Recovery Scan Tool to see if this could still help.

* I have attached the scan results and search results, however I don't know whether these are still applicable now that the PC has restored itself, and the scan and search was done after the restore (i.e when Microsoft Security Essentials is not active and the PC is not rebooting).

Any sort of advice as to how to find out where the PC decided to restore itself back to, how I can find out if my PC is still infected, how I can get Microsoft Essentials back on the PC without it having a hissy fit again, and whether the solution in the post above will still be relevant to fixing my PC would be much appreciated! Basically I need all the help I can get, as I don't know what to do to ensure the PC is fixed and clean. Many thanks in advance!!!

TimW · Aug 19, 2012

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNCTION PROPERLY.

Please re-run it properly. Here are the instructions:

Please do the below so that we can boot to System Recovery Options to run a scan. There will be two options to choose from. One if you do not have your Windows 7 boot DVD and another when you have your DVD.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Option1: Enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

Option2: Enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)

clueless86 · Aug 21, 2012

Hi,

Thanks for the advice, it's taken two days to do but please find attached the required info...

TimW · Aug 21, 2012

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST.exe on your flash drive.

Now reboot back into the System Recovery Options as you did previously.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (See how to attach)

Now boot into normal Windows can continue with the below.

Running MGTools.

clueless86 · Aug 21, 2012

I've run the fix on command prompt in System Recovery as instructed, however when the computer boots up I now get a blue screen and then it goes to Windows Error Recovery and automatically begins startup repair with the only option being restore (if I cancel it tells me the current repair operation cannot be cancelled, if I ask it to start windows normally instead then it goes back to the blue screen and then startup repair again. I've attached the fixlog.txt below.

TimW · Aug 21, 2012

Then try doing a system restore to before the infection and download and run MGTools.

clueless86 · Aug 21, 2012

Thanks, MGTools scan worked fine first time round. I've attached the MGLogs.zip file

TimW · Aug 22, 2012

Looks good.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.

Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Log in or Sign up

After effects of security live platinum malware

clueless86 Private E-2

Attached Files:

FRST.txt

Search.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

clueless86 Private E-2

Attached Files:

FRST.txt

Search.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Attached Files:

Fixlist.txt

clueless86 Private E-2

Attached Files:

Fixlog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

clueless86 Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member