Antivir Solution Pro attacks & backdoor spam galore

bennyboytx · Jul 27, 2010

I have two computers, Desktop (XP) and Laptop (7). On the Desktop, Browsing sites yesterday (on Chrome) and then one link for a file in some cache made AVG alert. Thought the problem was taken care of, but Antivir Solution Pro popped up, and did it's usually trickery. My DSL provider came to my doorstep the next morning to tell me I had been put on a spam blacklist, and insisted I disconnect till the virus/trojan/rogue backdoor thing is killed. I found Geekstogo guide first, and went through their steps, which seem to be very similar to Major Geeks.

Booted into safe mode. Cleared all TEMP, backup up registry. Installed MBAM, updated, did quick scan, did a full scan. Got some threats removed. Ran Spybot: Search and destroy, update, scan. Got rid of AVG & other unnecessary programs. Got MSE, update, quick scan, full scan. I also used Rkill somewhere along that journey.

Booted into normal. A couple pesky Temp files (WINDOWS & LOCAL SETTINGS) still resided because they claimed to be running. I ran MBAM and MSE again, picked up some more stuff. Just to be sure, I restarted, booted with AVG rescue CD, ran that and it claimed it was clean.

Some Threats I Noticed
File called _ex_08.exe (? along those lines) was in TEMP
Error at start up with a .dll called tcaplc in \WINDOWS? Noticed Start up entry in Spybot with weird Equevuues? name trying to run tcaplc.dll with reference to rundll32
My Firefox built in search redirects me to hxxp://search.search-star.net/ with google

I thought i was clean but the problem just re-appeared on my Laptop with Antivir Solution Pro, which I did scan a little beforehand. One thing I saw before this happened was a weird Java 6 splash screen appear on the Laptop then go away. Right now I'm typing this on the Desktop

I've uninstalled Adobe Reader and all JAVA on both computers as a precaution. I also disabled System Restore to clear out all those. The laptop is currently gettings a full MBAM scan on all drives.

I still have all the logs from MBAM. I have not used OTL/Hijack This because I do not know how it works, so please post some instruction if you request a log.

TimW · Jul 28, 2010

Welcome to Major Geeks!

Please keep this thread confined to one system, either the desktop or the laptop and start a new thread for the other system.

Are you still working with Geekstogo? If you are, stay with them as it is a waste of resources for either them or us to be posting on two sites!

Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****

Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this aother user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

Log in or Sign up

Antivir Solution Pro attacks & backdoor spam galore

bennyboytx Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member