AVG NOT WORKING for SHEUR2.AXIY and GENERIC14.ZAR

Hi all,

Okay, so I figured I was over run by a virus. Ran my AVG, it decided to tell me I had over 59 issues... Here's the list. I am thinking, since I have searched the post for this specific type of Trojan, you haven't encountered it yet. Other versions of it yes, but nothing listed with this extention.

One problem is with the Anti Virus Program a fake anti virus "warning me to run the program because I am infected", that keeps coming up. I might have solved that not to sure just yet. ( Most likely NOT.)

My Mozilla Firefox keeps redirecting me to a Dutch version of Google. And then redirecting me completely to other websites. I have to copy and paste in order to get to a website for help, no link clicking.


The Trojan's I have found are

Generic14.zar
Sheur2.axiy
Sheur2.axpx
Generic14.zdr

Next on the list are these all starting with C:\Documents and Settings\Owner\Local Settings\temp\

msxm171.exe

Also these:

a.exe, b.exe, c.exe, d.exe, e.exe, f.exe, g.exe, h.exe, i.exe, j.exe, k.exe, l.exe, m.exe, n.exe, o.exe, q.exe, r.exe, s.exe, t.exe, u.exe, y.exe, z.exe

( No p,v, or w, I might have missed them)

And these:

az.exe, ay.exe, ax.exe, aw.exe, av.exe, au.exe, at.exe, as.exe, ar.exe, aq.exe, ap.exe, ae.exe, ad.exe, ac.exe, ab.exe, aa.exe, ao.exe, an.exe, am.exe, al.exe, ak.exe, aj.exe, ai.exe, ag.exe, af.exe

And of-course these:

a0.exe, 9.exe, 8.exe,7.exe,6.exe,5.exe,4.exe, 2.exe, 2a9.exe 0.exe

( 3 and 1 are not listed but let's not rule them out sha'll we?)


These are screwing with my command prompt, and wont let me access ANYTHING. Meaning I can't access my Control Panel, System, nor start up my computer in Safe Mode. I can't run Msconfig, or Run any commands to search to have Windows help. I can't get into my System Restore to turn it off, so I can clean out the computer. And now when I click on a program, it asks which file I want to open it with via, Wordpad, Notebook, Paint... and it just won't open it up. ( Unless I boost it with my Advanced System Care.) Then the program will open. ( It says C:\Windows\System32\rundll32.exe) an ERROR when trying to open it.

I have currently on my computer, AVG 8.5 Free Edition, Malwarebyte's AnitMalware, Iobit 360 Security, and Advanced System Care.



I have updated my AVG with updates everything is updated.

Help???? lol

 

I also forgot to add

Trojan Downloader Generic8.BJDN

Could it get worse? lol

AVG's Virus Definitions don't even list them, I ran a search.

 

Welcome to Major Geeks!

Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

• If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First. If TDSSserv is not found, just continue on with the READ & RUN ME.
  • TDSSserv Non-Plug & Play Driver Disable

READ & RUN ME FIRST. Malware Removal Guide

• If something does not run, write down the info to explain to us later but keep on going.
• Do not assume that because one step does not work that they all will not.

• After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
​

 

Elder,

I am having issues with the Read and Run me first...

I HAVE read it...lol and this is what happens....( After extensive searches I have found that this is a virus contracted from facebook users and the like)

I have gone and deleted everything I don't use, plan on using or just for the heck of it said goodbye to it. I have ran my CCleaner. Done everything needed with CCleaner.

I also have ran my Iobit Smart defrag. I only have 1 Antivirus running and that is AVG, ( currently I need to uninstall it because this virus has decided to attack it) I only have 1 firewall up and thats the Windows firewall.

House Cleaning. Let's just say I am pretty much at a basic house. My Java is updated to 6 update 14.

All Quarantines have been emptied.

Here's were it gets tricky.

In Configuration and Setup I opened up the files for viewing. I CAN NOT put Msconfig in NORMAL start up mode becase the virus has posted itself to my startup programs. If I use normal mode then the virus runs itself. I need help with this!!!!!

What do I do in order to finish the last of the read and run me? I have everything downloaded and am waiting to make sure, I can run all these programs in NON NORMAL mode.... The combofix, superanit spyware.... etc...

Please let me know....

 

Also if I do put it in NORMAL Mode and then try to restart windows I can't get it started in safe mode. I get a blue screen telling me windows has encountered a problem and if this is the first time you have seen this reboot in safe mode by pressing F8.

I will try to do the read and run me steps again and let you all know. Including normal mcsonfig.

 

Ok, I finally was able to start in normal mode.
Here are my logs....

 

And the last log

 

Hello,

Thank you for posting your logs, I am currently reviewing over them. Can you please also attach your C:\MGlogs.zip. Thanks.

 

Here is the Mglogs,

Sorry thought I posted it...