BleepingComputer.com: Don't know the name of the virus [Moved]

I used Firefox for several years, no problem. I downloaded an update from Mozilla and Firefox stopped working so I went back to I.E. BAD IDEA!!! I should have wrapped my PC in C4 and blown it sky high. On 3rd day of I.E. usage, I started my XP PC and I was greeted by a message on my screen with a warning instead of my normal screen. I could still see my desktop folders but the huge fonts said, WARNING: YOUR COMPUTER IS INFECTED: Windows has detected spyware infection. Click this message to install the last update of Windows Security Software. I am then shown a window where I can order the “anti-virus” program for $29.95 that would get rid of the virus. Sweet scam.

Another message that this gives me is: Security Monitor Warning Attention! System detected a potential hazard (Trojan SPM/LX) on you computer.

If I try to open ANY program, I receive this message: Application cannot be executed. The file Rundll32.exe is infected. Please activate your antivirus software. (Which I can NOT do.)

I.E. Tries to open itself every 5 or 10 minutes. It tries to go to this url: http:// do in?ID=503760@trackid=general@storeid=500018 It can't get there. The word “FORBIDDEN” is on that page.

Since I can't run ANY file, I can't even find out the name of the virus.

It looks like I'm screwed. This is the virus itself, right?
What can I do to get rid of it? I read that I can download a virus removal program onto a flash drive using a different PC. I don't think I can do that unless I know which virus I have.
If the “flash drive” doesn't work, can I take the infected hard drive and put it in another PC (that uses Vista) and by putting it in as a slave harddrive, can I run an anti-virus from the “Master” Vista harddrive to get rid of the virus?

Thanks reading my post, hope somebody can help me.

JJ Jay

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.

Hi and welcome to BleepingComputer

The process of cleaning your computer may require temporarily disabliling some security programs. If you are using SpyBot Search and Destroy, please refer to Note 2 at the bottom of this page.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself.
  
• Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note:
-- If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Note 2:
-- MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes (like Spybot's Teatimer), they may interfere with the fix or alert you after scanning with MBAM. Please disable such programs until disinfection is complete or permit them to allow the changes. To disable these programs, please view this topic: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Orange,

Thank you for putting my post in the proper forum. I'm sorry that I didn't put it there myself. I read almost every faq about this great site but I didn't see that one.

Thanks again,
JJ

Quick story.... Back in 1965, a buddy and I drove down to Sebring, Fl in my Sunbeam Tiger to watch the 12 hour race. Around 2 am, top down, we drove (if you consider doing 120 mph driving) into an area where the highway was surrounded by orange groves. The incredible overwhelming aroma of orange blossoms sent chills through my body. To this day, it's one of my favorite aromatic memories. Luckily, I now live down here in Tarpon Springs, FL. Thanks for bringing it back with your screen name.

Rigel,

Thanks for the reply.

Lots of great info but..... you told me to "Please download Malwarebytes Anti-Malware and save it to your desktop."

Therein lies the problem. I can't download anything. I can't even get online (at least where I want to). I can't even open the PC's clock. The virus is not letting me do anything but order the "anti-virus" program for $29.95. (Nice scam - we give you a virus and then you have to pay us to take it back)

I read somewhere that I can download a program with a clean PC and put it onto a flash drive and then use that on the infected PC.

Is that correct? And how do I start the bad PC so I can use the virus removal program?

Thank you

Hello there,

Yes, you can certainly download the program to a flash drive.

Back to you Rigel,

~ OB

Yes... please dow2nload to a flashdrive and move to the infected computer.

Lets do this... Please download the following tools.

Please download Dr.Web CureIt
Please download ATF Cleaner
Please download and install SUPERAntiSpyware Free
Click here - Official Rootrepeal Site, and download RootRepeal.zip.
How to use SDFix Download SDFIx from the link in that topic.

That will be our starting toolkit. I will give you instructions as we go.

Edit: Fixed link

Rigel,

Thanks for helping me out. I got the downloads and put them on a flash drive.

Dr.Web CureIt
ATF Cleaner
SUPERAntiSpyware Free
RootRepeal.zip.
SDFix

To get online, I'm using a COMPAQ Presario with Vista and it's the slowest PC ever sold. To open a simple Notepad doc, it takes 10 to 15 minutes. There is no way I'm even going to try to hook up my printer to it. What I'm going to do is to use this PC to stay online and put the infected PC on the desk next to it so I can read your instructions on this one. I'll have it setup by tomorrow, (Tuesday evening).

Thanks again.

JJ

Rigel,

I'm sorry I didn't get back to you earlier after your offer to help me. My handicapped daughter's sling tore all to heck and it took a couple days to get a new one made.

I'll be able to work on the infected PC anytime after 5 pm tonight (Friday). if your offer is still good.

Thank you
JJ

Sorry to hear about the sling. The offer is always good. Take your time... family comes first.

Thank you for the kind words and patience.
Heather is "Papa's Angel. She's 34 and severally handicapped but she brings to me more joy than I deserve.
Might you have time Saturday, anytime after 5pm EST? Or Sunday? You name the time.
I appreciate the help that you've offered. I just hope I can find time to take advantage of it.

JJ

I will go ahead and post the procedures for the products listed above,

You have the malwarebytes procedure...

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet.
alternate download link
Note: The file will be randomly named (i.e. 5mkuvc4z.exe).

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:

• Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
  
• Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  
• If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)

• After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
  
• In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
  
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  
• Please be patient as this scan could take a long time to complete.
  
• When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
  
• Click Select All, then choose Cure > Move incurable.
  
• In the top menu, click file and choose save report list.
  
• Save the DrWeb.csv report to your desktop.
  
• Exit Dr.Web Cureit when done.
  
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

also

Please download ATF Cleaner by Atribune & save it to your desktop.
alternate download link DO NOT use yet.

Please download and install SUPERAntiSpyware Free

• Double-click SUPERAntiSypware.exe and use the default settings for installation.
  
• An icon will be created on your desktop. Double-click that icon to launch the program.
  
• If asked to update the program definitions, click "Yes". If not, update the
  definitions before scanning by selecting "Check for Updates". (If you encounter
  any problems while downloading the updates, manually download them from
  here and
  unzip into the program's folder.)
  
• Under the "Configuration and Preferences", click the Preferences... button.
  
• Click the "General and Startup" tab, and under
  Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  
• Click the "Scanning Control" tab, and under Scanner
  Options, make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
    
  • Scan for tracking cookies.
    
  • Terminate memory threats before quarantining.
  
  
• Click the "Close" button to leave the control center screen and exit the program.
  
• Do not run a scan just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Double-click ATF-Cleaner.exe to run the program.

• Under Main "Select Files to Delete" choose:
  Select All.
  
• Click the Empty Selected button.
  
• If you use Firefox browser click Firefox at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
  
• If you use Opera browser click Opera at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
  
• Click Exit on the Main menu to close the program.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp"

ATF-Cleaner must be "Run as an Administrator".
Scan with SUPERAntiSpyware as follows:

• Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  
• On the left, make sure you check C:\Fixed Drive.
  
• On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  
• Make sure everything has a checkmark next to it and click "Next".
  
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  
• If asked if you want to reboot, click "Yes" and reboot normally.
  
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
    
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    
  • Please copy and paste the Scan Log results in your next reply.
  
  
• Click Close to exit the program.

rigel,

thanks for all the info. I do have some questions before I can even start.

The instructions said to download these programs to my desktop. Big problem. I can't do ANYTHING with my PC with the virus. I can start it and if I try to open any files or program, I'm told that I can't do that because something having to do with that file is corrupted. I do have the following downloaded programs on a flashdrive:

ATF-Cleaner ATF Cleaner
mbam-setup Malware Anti-Malware
RootRepeal RootRepeal
SDFix SDFix
SUPERAntiSpyware SUPERAntiSpyware
u9fler97 Dr.Web CureIt

Instead of printing out the instructions, I have them on a working PC (with internet) that is sitting on my desk next to the bad PC. While I'm working on the bad one, I'm reading off of the good one.

How do I go about using these anti-virus programs from a flashdrive?

Thanks again.

JJ

I got your message JJ. Sorry I missed your thread. Let me ask about running from a flash drive. I know you can do it with ATF, but not sure about the rest.

I downloaded the newest Cureit, it saved as a random named file but kept the cureit icon. Then I renamed it
iexplore.exe and transfered to a usb drive. Booted into safe mode and ran the program from there and the usb stick.