Windows Antivirus Pro

lupusrex · Aug 14, 2009

I run Windows XP Pro on a Dell Dimension 8300. The computer worked flawlessly until a few days ago. I got the classic symptoms of Windows Antivirus Pro (fake alerts, programs saying they are infected when I try to open them, porn sites opening in internet explorer). Internet posts told me to run Malwarebytes, which I did. It was fine for about a day. Then it blue-screened and would blue-screen whenever I started it up, clicked my name on the user list, and put in my password. I got it to start up by picking "use last good configuration" (safe mode would always blue-screen). After startup, a bunch of black windows would come up saying desot.exe. Whenever I would try to run a program, it would say "program too big to fit in memory" in a black box. I finally managed to run programs by right clicking on them, picking "Run as..." and picking my username and putting in my password. Malwarebytes again made it fine for about a day. Now it will start up okay, run for a couple minutes to an hour or so, and either blue screen or freeze. Usually the blue screen is 0x0000007E but others have appeared. SUPERAntiSpyware will not complete a scan before the computer crashes, even after disabling those options like the instructions say to. All the other logs are attached. In addition to the programs you require me to use before I post, I have tried Norton, Avira AntiVir, McAfee VirusScan, AdAware, and VIPRE. None of these last ones turned up anything.

TimW · Aug 17, 2009

Looks like the scans took care of most of the infection. Let me ask you what this is:
c:\program files\aebbgd?

Please use add/remove programs to uninstall:
Viewpoint Media Player <-- should have been uninstalled in step 1 of the READ ME
J2SE Runtime Environment 5.0 Update 6

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
Code:
KILLALL::

Driver::
ifdc8d0
2a4906f5
XDva143

File::
C:\WINDOWS\system32\drivers\ifdc8d0.sys
C:\WINDOWS\system32\drivers\2a4906f5.sys
C:\WINDOWS\system32\drivers\XDva143.sys 
c:\windows\system32\REN40.tmp
c:\windows\system32\REN3F.tmp
c:\windows\system32\REN3E.tmp
* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

Windows Antivirus Pro

lupusrex Private E-2

Attached Files:

mbam-log-2009-08-14 (14-23-57).txt

ComboFix.txt

RRlog.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member