BleepingComputer.com: MY PC cought a nasty flu...

I have a VISTA Home Premium pc. Has a registered copy of NORTONS 2007 running as well as the freeloading [if any] microsoft downloaded virus defender [one once]

TODAY at around 4.30am picked up Vista Home Security 2011 nasty bug. IT also installed
JVI.EXE [the odd 3 letter character].exe program

On another web site i was reading their temporary killer notice to look in APPDATA etc and delete
the odd aharacter 3 letter.exe & the other files next to the program. [I DIDN't and just slightly renamed them instead... JVI.EXE to JVI.EXE--- so it couldn't run after i used task manager to kill the process.
I'm glad i didn't delete because after i TEMP killed the entire bug process i couldn't run any programs... [any of my browsers included]
THUS i had to go back to the directories & just let it keep running a little longer so i could run programs...

IT loves to mess up my IE Browser alot and can't connect to many virus. ANYTHING to do with a SEARCH ENGINE gets redirected to BLANK PAGE.
The only reason why i can still use a BROWSER is because i have several Browsers that some use portions of IE
installed browser components & some use some components of FIREFOX & OR CHROME...

Maxthon V2, Green Browser, Crazy Browser, QTWEB Browser, Flash Peak Slim Browser, Advant Browser, ACE Explorer
Browser, The World Browser, Slepnir Browser, Sundance Browser, and some little el-quickie types...
Fastweb browser, Akoware Web View Browser, Portable Browser...

THUS so far i can at least get out on some browser that isn't 100% microsoft.

YES i'm getting pop up virus warnings but i noticed that leaving at least one pop up STAY POPPED UP & OPEN keeps this thing from popping up alot more in a hurry & allows me to keep going somewhat.

Since i got the BUGGER i tried my NORTONS and it refuses to update [LuCallBackProxy.exe = Did a search and found that is Nortons updater file. BUT needing all 6 of them running is a little much.
AND one LuComServer_3_2.exe also another Nortons updater program.

TRIED to download and run [from the download dialog box] PC TOOLS Spyware Dr but that frooze up upon partial install and don't wanna do anything.

I Was able to download the operating files for F-SECURE and run that in a JAVA BOX to do a el-quick scan and all that found was browser cookie files... WHEN i tried to do a full scan it complained it didn't have enough rights [i'm the only one on the computer and have all the rights] BUT ANYWAYS it did run but found no virus bug or the JVI added virus installed.

SINCE I've had the bug i didn't tun off the computer. THUS anything waiting to use the boot-up ONE ONCE is gonna be waiting a little longer

Any help you can provide will be greatly appriciated.

Ohhh.... Since i have never used the SAFE MODE YET on in this computer you might need to take my hand and help me do that if it's needed.

THIS bug keeps telling me my FIREWALL IS TURNED OFF and every time i click to re-start it it wants me to register the program... [Which i don't do]

WHAT i might have to do is to go back in and just RENAME some files to keep the thing from operating for awhile... BUT Then i can't run any programs. NOT even the games [I'm not heavy gammer and thus have the simple games. LIKE SOL, DOS Emulators - DOSBOX to play some games vista hates] etc.or anything else.

YES i do have mp3 & movies i have downloaded on the system.
I also have MUSIC BROADCASTING software as well. [Internet Broadcaster]
Yes i have Activeworlds registry entries [3D Virtual OnLine Reality program much like SIMS But that isn't actually installed on the main hard drives. C & D are main drives & N is a external add on & that is a 1TB drive using a USB DOCK. The others are all 16gb flash drives or one 4gb that houses Active Worlds]

Please HELP...
I haven't tried any other virus cleaners or the one that need professional help to use yet.
AT least i haven't gotten any more pop up warning windos since i left this one up for the past several hours...
SEEMS not to like me tooo well...
The other ones keep popping up. SYSTEM ALERT [stays on top of everything] and scanner & register the program alert window.

This post has been edited by hamluis: 04 March 2011 - 04:29 PM
Reason for edit: Moved from Vista to Am I Infected.

Hello and to BleepingComputer.

Let's see what we're dealing with here.

Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

Link 1
Link 2
Link 3
Link 4

• Before we begin, you should disable any anti-malware software you have installed so it does not interfere with RKill running. This is because some anti-malware software mistakenly detects RKill as malicious. Please refer to this page if you are not sure how to disable your security software.
  
• Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  
• A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  
• If nothing happens or if the tool does not run, please let me know in your next reply

***************************************************

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

IMPORTANT!!! - when you save the file, rename it to something random, such as bubbles.exe This must be done before beginning the download!

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

~Blade


In your next reply, please include the following:
Malwarebytes Log