Unremovable virusses

Discussion in 'Malware Help (A Specialist Will Reply)' started by Mesne, Oct 14, 2012.

  1. Mesne

    Mesne Private E-2

    Hi, I have some virusses That I can't delete. I've run al kind of virus scanners but they keep coming back. Scanned with Hitman Pro. Hope you guys can help me.
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  3. Mesne

    Mesne Private E-2

    I did al the steps. But they are still there. I attached the logs. (Virus herkend Win64/Patched.A, C:\Windows\System32\services.exe". It says I have to clean it by hand. This is the virus that keeps bugging me. And I think it also keeps bringing back other virusses.
     

    Attached Files:

    Last edited: Oct 15, 2012
  4. Mesne

    Mesne Private E-2

    And I already tried to remove it in safe mode.
     
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Files/folders tab and locate these detections:

    • [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND
      [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND
      [Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND
    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Do not reboot your computer yet.

    Rescan with HitmanPro, when it finds services.exe - Virus, allow it to Replace by clicking the down arrow next to the detection and choosing Replace.
    Choose to Delete these files if they are detected:

    • C:\Windows\system32\services.exe
      C:\Windows\assembly\GAC_32\Desktop.ini (Trojan.ZeroAccess)
      C:\Windows\assembly\GAC_64\Desktop.ini (Trojan.ZeroAccess)
    Ignore all other detections.
    Afterwards, click the Next button.
    HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

    Now re-scan with both RogueKiller and Hitman and attach those new logs as well.
     
  6. Mesne

    Mesne Private E-2

    Hi,

    I did what you told me to do. I forgot to save the first Hitman log file. Is there a place where I can find it? When I rebooted the computer after both scans and re-rund them it didnt find the virusses. So are they gone? :)
     

    Attached Files:

  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Please also download MBRCheck to your desktop
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message.

    Now attach both the new C:\MGLogs.zip and the MBRCheck log.
     
  8. Mesne

    Mesne Private E-2

    It doesnt make any log files.zip
     

    Attached Files:

  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, it does. It should be located at C:\MGLogs.zip.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds