PC Infected by potentially new virus - system check disk was needed

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Jomox, Aug 6, 2011.

  1. Jomox

    Jomox Private E-2

    I've got my friends PC here which as been infected, but let me tell you the story before going on as I feel it's important as there could be an unknown virus on the machine.

    My friend brought some software of ebay from a seller with good feedback, thus he thought everything was good. He extracted the files ok, and scanned them with malwarebytes, sas and avg, no infected files found. But when he tried to load the .exe nothing happened, even after running as admin, it would come up with the do you want to allow so and so program and he would go yes but then nothing loaded.

    So he thought it must be a corrupt file, so he contacted the ebay seller about it but got no response for a few hours, in that time he noticed on firefox some sites would not load correctly, like sometimes they would load but more often then not they would not load at all, but in Safari or IE all sites where loading fine (He reinstalled FF but it was the same)

    Little later he got a response from the ebay seller saying sorry about the problem the exe must have been corrupt, so sent him a new exe, this time the software installed fine but there was problems with the program, bugs etc so it did not work correctly. So my friend asked for his money back and that he's not happy etc, this is when things turned bad, to cut a long story even shorter, the seller went mad in some emails refused to send him his money back, his ebay account was deleted and he told my mate directly in email that he's sent him a virus and that his AVG software is a "foul word here" like he is, and that his AVG cannot do anything.

    How did he know that he was running AVG etc? And sorry if the story is not fully clear, I think you get the gist of it though, he's reported it all to ebay (could be reason account got deleted maybe the guy has hacked other buyers)

    Anyway he got me round to have a look. I've done the normal scans and there's a number of files found. Upon the first restart though the K drive had to do a system scan due to error checking (this is where the .exe was saved also) there's a number of files found, but I don't know if this potentially new virus can be found that he's been sent, and he refuses to put his system online untill it's fixed as he's worried about the guy getting any personal information from his PC. (He dont save card details etc on there)

    Logs attached. (SAS scan took over an hour)

    Thanks in advance for helping.
     

    Attached Files:

  2. thisisu

    thisisu Malware Consultant

    Hi Jomox,

    I will review your logs. Please be patient as there is a lot of information to review.
     
  3. thisisu

    thisisu Malware Consultant

    Hi Jomox,

    I'm afraid I have some bad news. Your friend's PC is full of cracks and illegal software most likely including the Windows 7 copy that is running. Please review the below link:

    Warning about Porn, Keygens, Cracks, and other Illegal Software

    As a matter of forum policy and for us to properly clean PCs of malware, all illegal software must be removed during the cleaning process. If you do not like this policy then do not request our help. Also, any fix that we would potentially provide would delete all of this software which is what Malwarebytes has already tried to do.

    Your friend needs to purchase a legal copy of Windows 7 and then reinstall from scratch.
     
  4. Jomox

    Jomox Private E-2

    I warned him about the keygen thing a few times in the past, as it's just bad news for many reasons, but he's willing to start buying sw now, though since hes starting buying he's got attacked also, he don't feel safe and is very frustrated, and he just wants to get rid of any software which is causing problems.

    But he does buy all his games, and some software. (Most games on steam) he's just told me some software he could not afford so took a risk, but says he's stupid for making the mistake of messing around with dodgy stuff.

    He brought the PC of someone else with the OS already installed, he says he was informed it's all okay, looks okay to me but I don't know how to look into that.

    I'll make sure he don't mess around with dodgy software/keygens again.

    Many thanks for the help again.
     
    Last edited: Aug 8, 2011

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds