"Your Protection" Malware

Discussion in 'Malware Help (A Specialist Will Reply)' started by Messengerrobo, Apr 8, 2010.

  1. Messengerrobo

    Messengerrobo Private E-2

    Hello.

    My Windows XP has been infected with this malware called "Your Protection".

    I think I have managed to remove some of it using the Malwarebytes' Anti-Malware scan, as my computer no longer gets irritating fake warnings every few seconds, the icon for the malware has disappeared from the bottom right corner of my screen, and its folder has disappeared from my program files. However, the problem is still very much there:

    • My computer is now very slow.
    • My access to legitimate websites such as Microsoft and AVG has been blocked(I get "Internet Explorer cannot display the webpage").
    • Whenever I try to download new anti-virus software the download bar gets stuck and won't finish.
    • Occasionally, three icons for porn websites are dumped on my desktop.
    • I have run the Malwarebytes' anti-malware scan several times, and every time it finds infected objects(the number of infected objects varies depending on how much time passed since the previous scan; when several hours had passed since the previous scan I found that the numer of infected objects had shot right back up again).

    Now I am trying to run different scans to see if they will solve the problem. I want to try running ComboFix, but I was warned that I should disable my AVG 9 first. The problem is, when I try to open AVG I get an error saying "AVG does not recognize your license number". I think this may have been caused by the repair install I did a couple of days ago.

    When the "Your Protection" malware first appeared a couple of days ago, my computer immediately became very slow, and a few minutes later got stuck completely, so I turned it off. When I turned it back on, it started to boot up, but then the blue screen of death flashed for a split second and my computer rebooted(it did this over and over again every time it tried to boot up). I managed to get past this by doing a repair install, but the malware was still there. Just thought I'd mention about the blue screen of death and the repair install in case it could be significant.

    Also, when I try to uninstall AVG I get an error as well.

    Anyway, any information on how to fix any of the problems I mentioned would be greatly appriciated. Also, if there is a surefire method that is guaranteed to completely get rid of every trace of the "Your Protection" malware, please tell me.

    Here are the logs for the Malwarebytes' Anti-Malware scans that I have done over the last couple of days.
     

    Attached Files:

  2. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Welcome to Major Geeks, Messengerrobo!

    Since your anti-virus program AVG isn't working and you need to run ComboFix, please try using this uninstaller to remove it.(We'll re-install an anti-virus later)

    AVG Remover(32bit) and (64bit) ---> "Please run the below, re-boot, then run it again."
    AVG Remover

    If that doesn't work - try using one of these:

    Your Uninstaller! 2008

    Revo Uninstaller 1.85

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click and choose Run as Administrator


    You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
    1. Rkill.exe
    2. Rkill.com
    3. Rkill.scr
    4. Rkill.pif
    Once you've gotten one of them to run then try to immediately run the following.

    Now download and Run exeHelper from Raktor
    • Please download exeHelper to your desktop.
    • Double-click on exeHelper.com to run the fix.
    • A black window should pop up, press any key to close once the fix is completed.
    • A log file named log.txt will be created in the directory where you ran exeHelper.com
    • Attach the log.txt file to your next message.
    Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

    Now run this: SUPERAntiSpyware - running & getting a log

    Now run this: Using Malwarebytes Anti-Malware

    Now run this: A guide and tutorial on using ComboFix

    Now run this: Using MGtools

    Now you need to attach (See: HOW TO: Attach Items To Your Post ) the below logs created while running the above scans
    • exeHelper log
    • SUPERAntiSpywarelog.txt
    • Malwarebytes Anti-Malware log
    • MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.

    * Make sure you tell me if you had any problems running this procedure; and answer this - "What malware problems are you still experiencing?"

    dr.m
     
  3. Messengerrobo

    Messengerrobo Private E-2

    I have managed to uninstall AVG using "Your Uninstaller!" but when I tried to run ComboFix I got this error:

    32788R22FW\iexplorer.exe
    Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item.

    I did manage to run SUPERAnti Spyware, Malwarebytes Anti-Malware, and MGtools. However, I still can't go to certain websites(such as Microsoft and AVG) and I still can't download anti-malware software(I'm not sure if its only anti-malware software I can't download, as I haven't tried to download anything else since I got this malware).

    Also, since I got this malware, I always get several error messages after my computer starts up. When my computer has just finished starting up and has gotten to my desktop, the following error messages appear:

    C:\WINDOWS\fonts\services.exe
    Windows cannot find 'C:\WINDOWS\fonts\services.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the start button, and then click search.

    Desktop
    Could not load or run 'C:\WINDOWS\fonts\services.exe' specified in the registry. Make sure the file exists on your computer or remove the reference to it in the registry.

    Then I get the first error message again, and after that the second one again. Then I get another error message:

    RUNDLL
    Error loading C:\WINDOWS\system32\mssapsmr.dll
    The specified module could not be found.

    Here are the logs for the scans and exeHelper
     

    Attached Files:

  4. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Messengerrobo

    I'm sorry to give you the bad news but you will have to do a total clean reinstall.

     
  5. Messengerrobo

    Messengerrobo Private E-2

    Thank you for trying.

    But how do I do a total clean reinstall? Do I just have to do a normal install from the windows XP installation disk? If so, do I have to do anything to remove this current windows, which is now hopeless?

    Also, when you say not to back up any executable files, can you give me some examples, and are these the only type of files I need to worry about being infected? Is there a way I can find out what files are not infected?(such as by running scans on only particular folders?)

    I have so many programs, like photoshop, macromedia flash, audacity, iTunes etc. Is there a way for me to tell if programs like these are safe to back up?
    Are there any file types in particular that I should be wary of when backing up? And are there any file types that I can rest assured are completely safe?
     
  6. Messengerrobo

    Messengerrobo Private E-2

  7. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    :( Your posted links for removing the "Your Protection" rogue anti-spyware program does NOT also deal with the very damaging Virut infection, of which (as stated) "there is no known reliable fix for this".
    Any programs that you DID NOT install from a "Non-writable" CD/DVD should be considered a re-infection risk!

    Please review the following links thoroughly before attempting a Clean Installation of Windows XP. I would suggest that you also review some of these threads in our Software Forum, to grasp the fundamentals:

    Perform a Windows XP clean re-install search results

    * Some suggested web tutorials to review:

    http://support.microsoft.com/kb/978788

    http://pcsupport.about.com/od/operatingsystems/ss/instxpclean1_2.htm

    http://www.tweakhound.com/xp/installxp/installXP1.htm

    There are plenty of knowledgeable members in our Software Forum who would gladly walk you through the entire process in a new thread there, as this would be beyond the scope of our "mission" in this forum.

    * NOTE: DO advise them that your machine was infected by
    Virut!

    Best Of Luck,
    dr.m
     
  8. Messengerrobo

    Messengerrobo Private E-2

    Sorry just a few more questions.
    I have managed to put all of the files and folders that I want to back up into one folder. I right clicked the folder and chose to scan it with Malwarebytes' Anti-Malware, and the scan found 0 infected objects. Does this mean that the folder and all of its contents are completely safe?

    Just to be absolutely sure, is it possible that the scan could have missed any viruses? Because they were undetectable or something? Also, is it worth scanning the folder with any other anti-virus scans just to make sure, or is Malwarebytes' reliable enough?
     
  9. Messengerrobo

    Messengerrobo Private E-2

    One more thing.
    I have read on some websites that the virus infects ALL exe files.

    Is this true?

    Because I have run the Malwarebytes' scan on several exe files in particular and it did not find any infections. Does that mean some of my exe files are safe?
     
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No!!! Malwarebytes is not an antivirus program and will not detect Virut. And many antivirus programs do not properly detect the newer forms of Virut either and even when the do, they do not reliable fix it which is why a reinstall is necessary.

    As stated above, Malwarebytes is of no use in this regards and your antvirus program may or may not detect the infection. And even worse, your antivirus is already likely infected itself which makes it even less reliable and if you run a full scan with it, every single executable file that the antivirus opens to scan will become infected if not already infected. Virut spreads on contact or even just by opening a folder.
     
    Last edited: Apr 11, 2010
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You were already basically told this in message # 4, but if that was not clear, the answer is yes and it is not just files with an EXE extension. It is every file considered to be an executable ( like: .avi, .com, .bin, .dat., .exe, .pdf, .mov, .mpg....etc. Anything that can cause something to execute. Even image files have sometimes carried the infection.)
     
  12. Messengerrobo

    Messengerrobo Private E-2

    Thanks, but now I'm feeling pretty lost. This means that loads of the things that I intended to back up are probably already infected. I don't exactly know where to begin backing up now, so do you have any advice for that? I mean, are there any file types that I can be sure are completely safe?(are word documents and MP3s safe?)

    Also, I know it probably doesn't make any difference, but do virus scans such as SUPERAnti Spyware and Malwarebytes' actually count as Antivirus Programs? Because my regular antivirus program, AVG 9, stopped working since I got this virus, and I haven't been able to run it since. You said that running my antivirus program would likely spread the infection to every file it opens, but I haven't run it since I got the virus.

    Can you tell me, would running scans like SUPERAnti Spyware and Malwarebytes' also spread the infections to all files they open?

    Sorry, it's probably hopeless already, but any advice about where to begin would help, I'm feeling totally lost now.
     
    Last edited: Apr 11, 2010
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes! That is a common feeling for people gettng a Virut infection.

    There is no guarantee that Word Docs and MP3 will be safe. They may be and they may not be. Pure text type files are safe. Settings files for programs are typically safe.

    You can backup all of the Data you wish to back up onto CD/DVDs and then after reinstalling your PC from scratch and getting your protection software reinstalled, scan them before reinstalling anything from them. DO NOT run anything on these CD/DVDs until at least you have run full scans on them. If you properly re-install your PC and install protection (new clean downloads), your PC should be clean. If your infection returns after you start using anything from CD/DVDs then you know you have infected backups.

    Note: You could also try using some of the Online Scanners mentioned in the below link to scan your backups and get secondary opinions. But do remember what I said about scanners not always detecting these newer forms of Virut. There is an inherent bug in the new forms of Virut which help to make it difficult to impossible to reliably detect and remove with a scanning program. We ( the Malware Fighters here at MGs) manually can determine your infection due to the symptoms and file sizes seen in your logs. Scanners do not have the human factor or reasoning built-in. ;)

    As I stated in one of may last messages, Malwarebytes is not an antivirus program. Neither is SUPERAntiSpyware. They are antispyware programs and they provide no protection unless purchased. The free programs are only after the fact scanners.

    Yes because it is likley infected as I stated.

    Yes and they will not find nor remove Virut infections since they are not an antivirus program and as stated before, there are no known reliable removal procedures for Virut and other similar PE file infections.

    When a Virut infection is active on a PC, just simply opening a folder where there are executable type files can cause them to become infected.
     
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Note: There is a lesson to be learned here. And that is, always backup personal data early and frequently before getting infected.;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds