Antivirus 2010

Discussion in 'Malware Help (A Specialist Will Reply)' started by Vitaperuro, Sep 28, 2010.

  1. Vitaperuro

    Vitaperuro Private E-2

    Fixing wife's bosses computer.

    So, here is this rogue antivirus and I can't get rid of it. I've installed and tried running. both in safe mode and normal.

    • Malwarebytes
    • Super Anti-Spyware
    • ESET NOD32
    • Adaware
    • tried using Hijack this to create a log but it shuts down part way through scan
    • AVG works but detects absolutely nothing

    I can not navigate to any online scanners as whatever is on the computer is blocking certain sites. I was able to use Panda Online scanner and it detected

    Trj/CI.A but did not remove it.

    it also seems that the the boot.ini has been changed because despite trying to load into diagnostic mode it constantly changes back to Selective Startup +Load StartUp items
    I am not sure what else I can do.
     
    Last edited: Sep 28, 2010
    Vitaperuro, Sep 28, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Major Geeks!

    Please read ALL of this message including the notes before doing anything.

    Pleases follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide


    and attach the requested logs when you finish these instructions.

    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.


    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:


    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this aother user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
    ​
     
    TimW, Sep 29, 2010
    #2
  3. Vitaperuro

    Vitaperuro Private E-2

    I generated a log of start up items using Hijackthis. I still can not get the hijackthis program to finish doing a scan. So, right now this is all I can show you.
     

    Attached Files:

    Vitaperuro, Oct 2, 2010
    #3
  4. Vitaperuro

    Vitaperuro Private E-2

    Now here is something I don't understand, how is this virus or malware capable of killing any process that is actively scanning the computer. I just had it shut down IE because I was scanning the processes with an online scanner. Then it adds those processes to a list of somesort that Anti-Virus 2010 uses to make it so you can no longer open that program. Which btw its done now to IE.
     
    Vitaperuro, Oct 2, 2010
    #4
  5. Vitaperuro

    Vitaperuro Private E-2

    Just finished ComboFix. Took some doing to get this to run.


    added a root repeal log.
     

    Attached Files:

    Last edited: Oct 2, 2010
    Vitaperuro, Oct 2, 2010
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Are you able to run SAS and MBAM? I also need the log from running C:\MGTools.exe --> C:\MGLogs.zip.
     
    TimW, Oct 3, 2010
    #6
  7. Vitaperuro

    Vitaperuro Private E-2

    Neither SAS and MBAM will run on the computer. It only gets part way through the scan and as soon as it reaches a point somewhere in the registry the program closes down.
     
    Vitaperuro, Oct 3, 2010
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Does that happen in safe mode? And I still need the MGLogs.zip. Can you run that?
     
    TimW, Oct 3, 2010
    #8
  9. Vitaperuro

    Vitaperuro Private E-2

    It happens regardless of what I am in. Safe Mode or Normal. Its pretty odd. Here is the MGLog file you asked for. Sorry for taking so long, been busy the last couple days.
     

    Attached Files:

    Vitaperuro, Oct 6, 2010
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing a cause for this in your logs. Why don't we have you do an online scan>
    eSet Online Scan.
     
    TimW, Oct 6, 2010
    #10
  11. Vitaperuro

    Vitaperuro Private E-2

    I'll give it a try.
     
    Vitaperuro, Oct 6, 2010
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Attach the log when it is done. :)
     
    TimW, Oct 6, 2010
    #12
  13. Vitaperuro

    Vitaperuro Private E-2

    here's the eset log found viruses
     

    Attached Files:

    Vitaperuro, Oct 6, 2010
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Sweet....now run it again, save the log and keep running it until it comes back clean. Attach each log.
     
    TimW, Oct 6, 2010
    #14
  15. Vitaperuro

    Vitaperuro Private E-2

    Yeah! Its the first scan thats actually been able to finish. lol Maybe I can put my hair back in my head now.
     
    Vitaperuro, Oct 6, 2010
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Just keep running it until it comes back clean. Maybe we can lick this thing yet!! :)
     
    TimW, Oct 6, 2010
    #16
  17. Vitaperuro

    Vitaperuro Private E-2

    I finished running the ESET online again and it came back with 0 finds. Unfortunately I had a duh moment and forgot to make a log of the scan. =( I am running it again to be sure though and will make sure to get a copy of the scan log to you.
     
    Vitaperuro, Oct 7, 2010
    #17
  18. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If it came back clean, then we are good. Just run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Oct 7, 2010
    #18
  19. Vitaperuro

    Vitaperuro Private E-2

    Ok, second scan came away clean. I am still having issues with MBAM and internet explorer. I can run SAS if I run it from the root directory. There is no longer Antivirus 2010 popping up and trying to run scans which is great but the issue of those programs not working worries me.
     

    Attached Files:

    Last edited: Oct 7, 2010
    Vitaperuro, Oct 7, 2010
    #19
  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Does MBAM not run on any of the user accounts? What problems are you having with IE> redirects still?

    Please go to C:\MGTools\analyse.exe and run it. Attach the log.
     
    TimW, Oct 7, 2010
    #20
  21. Vitaperuro

    Vitaperuro Private E-2

    MBAM, IE and now it seems analyse.exe all give the following error on all Users.

    Windows cannot access the specific device, path or file. You may not have appropriate permissions to access the item.

    I am going to run a full scan using SAS which seems to work now and see if that will clear this issue up.

    [EDIT] I uninstalled MBAM and reinstalled it, that seems to have cleared up the issue.
     
    Last edited: Oct 7, 2010
    Vitaperuro, Oct 7, 2010
    #21
  22. Vitaperuro

    Vitaperuro Private E-2

    Fixed HiJackThis
     

    Attached Files:

    Vitaperuro, Oct 7, 2010
    #22
  23. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The HJT log is good. What issues are you still having, if any?
     
    TimW, Oct 8, 2010
    #23
  24. Vitaperuro

    Vitaperuro Private E-2

    IE will not open at all. Since this is the Web Browser that the computer owner uses I would like to get it working. I can not re-install it because the install scans for malicious viruses and says there is something on the computer.

    Running SAS turns up a few things but MBAM runs clean.

    I have installed AVG 2011 and I am running a scan right now.
     

    Attached Files:

    Vitaperuro, Oct 9, 2010
    #24
  25. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    SAS only found items in the system restore folders. Those can only be removed by toggling system restore.

    Let me know what the scan finds.
     
    TimW, Oct 9, 2010
    #25

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds