virus/malware that won't allow me to run any programs! help! :(

c4ndice87 · Dec 4, 2010

I got a virus yesterday on my computer, and it doesn't allow me to go on the internet, instead gives me the screen "this website my harm your computer" and gives links to install an antivirus program. So I'm using another computer. I read through the steps to take to get rid of this/clean my computer, and used a flash drive to download the programs to to be able to put them on my computer. Any time I try to run or install any of the suggested programs, it gives me a pop up message "Application cannot be executed. The file sas.exe is infected. Do you want to activate your antivirus software now?" The program will pop up but then will immediately close and this screen will come up. How do I make is so I can get around this to run these programs? Please help!

TimW · Dec 4, 2010

Download and Run exeHelper

Please download exeHelper to your desktop.

Double-click on exeHelper.com to run the fix.

A black window should pop up, press any key to close once the fix is completed.

Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Also please try running the below online scan:

http://www.superantispyware.com/onlinescan.html

Reboot immediately after scanning if it finds and removes anything. Let me know if anything was found. It does not save a log.

Then try running these instructions: Using MGtools

Attach the below logs when finished with all of the above:

log.txt - from exeHelper

C:\MGlogs.zip - from MGtools

c4ndice87 · Dec 4, 2010

The same thing happened when trying to run exeHelper and superantispyware. My computer won't allow me to open either or them and will come up with the same message saying that they are infected and that the application cannot be executed. I saw on another post where someone had the same problem, and they were told to use the Kaspersky Rescue Disk. So I put that on a USB and tried running that before booting windows. I let it run the scan and it came up with threats. It said it was unable to disinfect, but gave me the option to delete them, but when booting Windows again, nothing had changed and it didn't do anything.

TimW · Dec 4, 2010

What happened when you tried to run MGTools? Did you try renaming it to 123.com? Did you try running it in safe mode?

Is this a laptop or desktop computer?

c4ndice87 · Dec 4, 2010

I forgot to try running everything in Safe Mode. So I just ran the exehelper and the superantispyware. The superantispyware found 2 threats. One was a trojan and the other was a bearshare file. I then ran the MGTools. I've attached the logs for both.

c4ndice87 · Dec 4, 2010

Oh, and it's a laptop computer.

chaslang · Dec 4, 2010

Attempt to do the below in normal boot mode. If you cannot, then run in safe boot mode.

Uninstall the below software:
Ask Toolbar
BearShare
MediaBar

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:43902
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
O4 - HKCU\..\Run: [anqeyljc] C:\Users\Candice\AppData\Local\Temp\rqxbjwmey\dfoxyhoaffm.exe
O20 - AppInit_DLLs: C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.
After clicking Fix, exit HJT.

Now download The Avenger by Swandog46, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.

Do not change any check box options!!

Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\Users\Candice\AppData\Local\Temp\rqxbjwmey\dfoxyhoaffm.exe
C:\Users\Candice\AppData\Local\Ezesoyexamec.bin
C:\Users\Candice\AppData\Local\Sgojojoqoziyijev.dat
C:\Users\Candice\AppData\Local\syssvc.exe
C:\Users\Candice\Desktop\BearShareV9.exe
C:\ProgramData\~0
C:\Windows\Temp\TMP000001FA656689FB3D2D0A10
C:\USERS\CANDICE\LOCALS~1\TEMP\039450~1.EXE
C:\USERS\CANDICE\LOCALS~1\TEMP\3602.TMP
C:\USERS\CANDICE\LOCALS~1\TEMP\369839~1.TMP
C:\USERS\CANDICE\LOCALS~1\TEMP\369839~2.TMP
C:\USERS\CANDICE\LOCALS~1\TEMP\4379.TMP
C:\USERS\CANDICE\LOCALS~1\TEMP\7EFC.TMP
C:\USERS\CANDICE\LOCALS~1\TEMP\BEARSH~1.INI
C:\USERS\CANDICE\LOCALS~1\TEMP\HSPNS3~1.EXE
C:\USERS\CANDICE\LOCALS~1\TEMP\UTTC15~1.BAT

Folders to delete:
C:\Users\Candice\AppData\Local\Temp\rqxbjwmey
C:\Users\Candice\AppData\Local\BearShare
C:\Program Files\BearShare Applications

Registry keys to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Registry values to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run | DATAMNGR

Registry values to replace with dummy:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs
Click to expand...

Now click the Execute button.

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\TEMP
C:\USERS\CANDICE\Local Settings\TEMP

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

C:\avenger.txt

C:\MGlogs.zip

Make sure you tell me how things are working now!

c4ndice87 · Dec 5, 2010

Ok, so I was able to do everything, except my computer isn't letting me uninstall BearShare. I click Uninstall and everytime nothing will pop up.

I have been needing to use another computer because when I got the virus it made it so I couldn't get on the internet on my laptop. It's still not letting, saying the remote device or resource won't accept the connection. I'm not getting pop ups anymore though and it seems to be running normally.

c4ndice87 · Dec 5, 2010

Nevermind, fixed the internet problem. YAY! So if there's anything else I need to do I can do it from there finally.

chaslang · Dec 5, 2010

c4ndice87 said: ↑

Nevermind, fixed the internet problem.
Click to expand...

Yes you had a fake proxy server setting which was the cause of this. Since you already fixed it, I don't have to give you another fix for it. But let's get rid of the last pieces of Bearshare.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F624839-947D-46EA-BD63-FD847C1AC6F1}]

Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

virus/malware that won't allow me to run any programs! help! :(

c4ndice87 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

c4ndice87 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

c4ndice87 Private E-2

Attached Files:

MGlogs.zip

exehelperlog.txt

c4ndice87 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

c4ndice87 Private E-2

Attached Files:

MGlogs.zip

avenger.txt

c4ndice87 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member