BleepingComputer.com: Windows Automatic Updates Turned Off By Infection Solution

I have recently been infected with XP Total Security 2011.

I have tried to remove it by following the Remove XP Anti-Spyware 2011, Vista Security 2011, and Win 7 Internet Security 2011 (Uninstall Guide) Posted by Grinler

I have run RKill and Malwarebytes Anti-Malware, which found and successfully removed Trojan.BHO & Trojan.FakeAlert.

I have also run SUPERAntiSpyware, this found and removed Trojan.Agent/Gen-IEFake, Trojan.Agent/Gen-IExplorer[Fake] & Trojan.Agent/Gen-PEC.

When I have rescanned the computer after removing the above infections, Malwarebytes Anti-Malware finds no infections but SUPERAntiSpyware keeps finding and removing the same Trojans.

Automatic updates have been disabled and I am unable to turn it back on.

Help removing this infection, would be greatly appreciated.

Thanks

Tim

Try this:

http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller

Thanks Budapest, I've run TDSSKiller but it found no infections.

Hello,you probably need to kill a Process first.

Please download and install a Microsoft's Process Explorer ,save it to your desktop.
Right click on the icon and select Rename. rename the icon fixer.
Now double click and run it. Agree to the next few prompts. The Process Explorer window should now be up.

In the left pane,{probably under explorer.exe) scroll till you see a small shield icon {Light blue with a diagonal white stripe}]with either tfc.exe after it or a series of random numbers (something like 45621952.exe). This is what we have to stop.
Left click that file to highlight it.
Now kill that process. Click on the "X" at the top (under the word Find or Users to the left of the binoculars)
In the confirmation box that appears click the Yes button to kill the process.

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

Please ask any needed questions,post logs and Let us know how the PC is running now.

This post has been edited by boopme: 31 March 2011 - 09:16 AM

boopme, I have downloaded, renamed and run Process Explorer. I had to rename it fixer.exe to get it to work. There is no shield as you have described under explorer.exe or anywhere else in the list.

I am running MBAM again now.

Earlier I ran MBAM after updating the database and it found an infected registry item, see log below.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6225

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

31/03/2011 14:08:17
mbam-log-2011-03-31 (14-08-17).txt

Scan type: Quick scan
Objects scanned: 203104
Time elapsed: 7 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Beth\Local Settings\Application Data\roq.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

This post has been edited by tc1986: 31 March 2011 - 09:57 AM

Hello, it was a shot that I have seen work,but obviously yours is not that. I did not mean to take ths from Budapest as it was a suggestion. But since I am here did you reset your Hosts file to it's default?

Reset HOSTS file
As this infection also changes your Windows HOSTS file, we want to replace this file with the default version for your operating system.
Some types of malware will alter the HOSTS file as part of its infection. Please follow the instructions provided in How to reset the hosts file back to the default.

To reset the hosts file automatically, click the button.
Click Run in the file download dialog box or save MicrosoftFixit50267.msi to your Desktop and double-click on it to run. Then just follow the promots in the Fix it wizard.

Thanks boopme. No I haven't reset the HOSTS file.

I will do that now.

Thanks

I have run the Microsoft Fix it.

I have received a message to say "This Microsoft Fix it has been processed." and I need to "restart your system for the configuration changes made to Microsoft Fix it 50267 to take effect."

What should I do next after restarting?

This post has been edited by tc1986: 31 March 2011 - 12:59 PM

Can you update,are you getting any popups?
I guess rerun MBAM and see if it still finds it.

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal/regular mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

I'm still getting windows security alerts and I cannot turn on automatic updates.

MBAM nothing found.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6233

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

01/04/2011 09:44:48
mbam-log-2011-04-01 (09-44-48).txt

Scan type: Quick scan
Objects scanned: 203805
Time elapsed: 11 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


SUPERAntiSpyware has found and removed 2 Trojans. They are in a temp folder that seems to be linked to RKill as the temp folder includes
rkill.bat and rkill.reg


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/31/2011 at 11:26 PM

Application Version : 4.48.1000

Core Rules Database Version : 6723
Trace Rules Database Version: 4535

Scan type : Quick Scan
Total Scan Time : 03:18:11

Memory items scanned : 489
Memory threats detected : 0
Registry items scanned : 1617
Registry threats detected : 0
File items scanned : 171119
File threats detected : 4

Adware.Tracking Cookie
C:\Documents and Settings\Tim\Cookies\tim@doubleclick[1].txt
C:\Documents and Settings\Tim\Cookies\tim@collective-media[1].txt

Trojan.Agent/Gen-IExplorer[Fake]
C:\DOCUMENTS AND SETTINGS\TIM\LOCAL SETTINGS\TEMP\RARSFX2\NIRD\IEXPLORE.EXE

Trojan.Agent/Gen-PEC
C:\DOCUMENTS AND SETTINGS\TIM\LOCAL SETTINGS\TEMP\RARSFX2\PROCS\EXPLORER.EXE


Otherwise the computer appears to be running as normal.

Thanks

Hello,you mean th e"rogue" alerts ,as from these..Remove XP Anti-Spyware 2011, Vista Security 2011

Sorry I don't understand what you mean?

What are the security alerts saying? Are they from your antivirus ,Windows or you cannot tell?

Are they the same as your first post?

This post has been edited by boopme: 01 April 2011 - 10:47 AM

boopme, on 01 April 2011 - 10:47 AM, said:

Your computer might be at risk. Automatic Updates is turned off. Click this balloon to fix this problem. Windows security alerts

boopme, on 01 April 2011 - 10:47 AM, said:

Yes. Automatic updates are turned off and I cannot enable them. I get a message saying "We're sorry. The Security Center could not change your Automatic Updates settings. To try changing these settings yourself, go to System in Control Panel. On the Automatic Updates tab, select Automatic (recommended), and then click OK."

Automatic updates are on Automatic (recommended) in System in Control Panel.

I have run SUPERAntiSpyware again and no problems found.

This post has been edited by tc1986: 01 April 2011 - 12:37 PM

We need a deeper look. Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

EDIT: Reopened topic..

This post has been edited by boopme: 05 April 2011 - 08:52 AM