BleepingComputer.com: antivirus not working

Jump to content

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  • 11 Pages +
  • « First
  • 9
  • 10
  • 11
  • You cannot start a new topic
  • This topic is locked

antivirus not working antivirus

#151 User is offline   Elise 

  • Bleepin' Blonde
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Admin
  • Posts: 39,005
  • Joined: 05-October 07
  • Gender:Female
  • Location:Romania

Posted 23 October 2011 - 02:04 AM

Hi Josh, How are thing running now?

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
  • Download the latest version of Java Runtime Environment (JRE) Version 7.
  • Look for "JDK 7 (JDK or JRE).
  • Click the "Download JRE" button at the right.
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
    • Select "Windows x86 Offline" and click on jre-7-windows-i586.exe
  • Save it to your desktop
  • Close any programs you may have running - especially your web browser.
  • Uninstall all older versions of Java (any item with Java Runtime Environment, JRE or J2SE in the name).
  • Reboot your computer once all Java components are removed.
  • Install the newest version by double clicking (run as Administrator for Windows Vista/Seven) the downloaded file.



MALWAREBYTES ANTIMALWARE
-------------------------------------------
Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware

  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Full Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
regards, Elise

"The mind is its own place, and in itself can make a heaven of hell, a hell of heaven." ~ John Milton
Posted Image Follow BleepingComputer on: Facebook | Twitter | Google+

#152 User is offline   josh@bcn 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 105
  • Joined: 14-July 11

Posted 23 October 2011 - 07:53 AM

elise,


log for mbam :


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8004

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

23/10/2011 14:51:40
mbam-log-2011-10-23 (14-51-40).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|)
Objects scanned: 260220
Time elapsed: 55 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 35

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CONNECT (Trojan.PornDialer) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\HBLite@HBLite.com (Adware.HotBar) -> Value: HBLite@HBLite.com -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\Dewagede\my documents\downloads\flvplayersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\program files\resultbar\resultbar.exe.vir (Adware.Agent.ZGen) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP451\A0174934.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP451\A0175934.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP452\A0176934.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP452\A0177934.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP452\A0178934.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP453\A0179934.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP453\A0180934.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP457\A0181127.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP459\A0181150.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0181174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0182174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0183174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0184174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0185174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0186174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0187174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0188174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0190174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0189174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0191174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP462\A0192174.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP463\A0192186.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP463\A0193186.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP464\A0193200.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP464\A0193281.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP465\A0196523.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP465\A0196620.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP466\A0196630.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP466\A0196636.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP466\A0196660.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP467\A0196671.ini (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{021d2686-ebff-4030-bcbf-2bc93998321f}\RP479\A0209601.exe (Adware.Agent.ZGen) -> Quarantined and deleted successfully.
c:\WINDOWS\assembly\GAC_MSIL\desktop(2).ini (Backdoor.0Access) -> Quarantined and deleted successfully.

#153 User is offline   Elise 

  • Bleepin' Blonde
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Admin
  • Posts: 39,005
  • Joined: 05-October 07
  • Gender:Female
  • Location:Romania

Posted 23 October 2011 - 08:07 AM

Hi Josh, do you have any problem left?

ESET ONLINE SCANNER
----------------------------
I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image
      icon on your desktop.

  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology

  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.

regards, Elise

"The mind is its own place, and in itself can make a heaven of hell, a hell of heaven." ~ John Milton
Posted Image Follow BleepingComputer on: Facebook | Twitter | Google+

#154 User is offline   josh@bcn 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 105
  • Joined: 14-July 11

Posted 28 October 2011 - 03:10 PM

Hi Elise,

got a fault...last friday i did the ESET scan and yeah it took longer than i expected, i need to leave during that day and has to bring my laptop with me, so i stopped the scan and turned it off. This afternoon i run it again and now im sending u the report:

C:\System Volume Information\_restore{021D2686-EBFF-4030-BCBF-2BC93998321F}\RP499\A0213193.exe Win32/Patched.HN trojan cleaned - quarantined
C:\System Volume Information\_restore{021D2686-EBFF-4030-BCBF-2BC93998321F}\RP499\A0213194.EXE Win32/Patched.HN trojan cleaned - quarantined
C:\System Volume Information\_restore{021D2686-EBFF-4030-BCBF-2BC93998321F}\RP499\A0213195.scr Win32/Patched.HN trojan cleaned - quarantined



I just have a litlle concern, my browser (firefox) has this mania of freezing and saying : not responding. My computer freezes.. does it means is still has some virus?

#155 User is offline   Elise 

  • Bleepin' Blonde
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Admin
  • Posts: 39,005
  • Joined: 05-October 07
  • Gender:Female
  • Location:Romania

Posted 28 October 2011 - 03:38 PM

At this point I do not think the freezes are caused by infections; you mentioned earlier it turns also off randomly. When this happens, does the computer feel hot to the touch?
regards, Elise

"The mind is its own place, and in itself can make a heaven of hell, a hell of heaven." ~ John Milton
Posted Image Follow BleepingComputer on: Facebook | Twitter | Google+

#156 User is offline   josh@bcn 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 105
  • Joined: 14-July 11

Posted 28 October 2011 - 04:53 PM

yeah ... its hot sometimes..plus this computer fan that sounds like a vacuum cleaner... :(
is my comp still infected?

#157 User is offline   Elise 

  • Bleepin' Blonde
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Admin
  • Posts: 39,005
  • Joined: 05-October 07
  • Gender:Female
  • Location:Romania

Posted 29 October 2011 - 12:12 PM

No, as explained most likely your computer is overheating, possibly due to dirty fans/inside of the laptop. You can attempt to clean that yourself (blow the fans through with compressed air) or ask a repairshop/technical savvy friend/family member to help you with that.
If the computer feels hot to the touch, be sure not to continue too long with it, as it might cause permanent hardware damage!

As far as malware is concerned, your computer is clean.

ALL CLEAN
--------------
Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :)

Please do the following to remove the remaining programs from your PC:
  • Delete the tools used during the disinfection:
    • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.

Please read these advices, in order to prevent reinfecting your PC:
  • Install and update the following programs regularly:
    • an outbound firewall. If you are connected to the internet through a router, you are already behind a hardware firewall and as such you do not need an extra software firewall.
      A comprehensive tutorial and a list of possible firewalls can be found here.
    • an AntiVirus Software
      It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    • an Anti-Spyware program
      Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
      SUPERAntiSpyware is another good scanner with high detection and removal rates.
      Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    • Spyware Blaster
      A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.

  • Keep Windows (and your other Microsoft software) up to date!
    I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.
    Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!
  • Keep your other software up to date as well
    Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.
  • Stay up to date!
    The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.
Some more links you might find of interest:

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.
regards, Elise

"The mind is its own place, and in itself can make a heaven of hell, a hell of heaven." ~ John Milton
Posted Image Follow BleepingComputer on: Facebook | Twitter | Google+

#158 User is offline   josh@bcn 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 105
  • Joined: 14-July 11

Posted 29 October 2011 - 12:31 PM

Elise, thank you very much for you help and patience and kindness.
I am very, very grateful to you and to the rest of the bleeping community.
I hope that I wouldn't have any problems in the future. If in case, I would surely run to you again.
I just wanna clarify, this computer of mine cannot be trusted anymore in regards bto money or bank info right?
And another questionl, do we know who is the hacker, from country and when did it happen?
How about the case of my computer freezing, what would be the cause of that?

Thanks again and more powers!

#159 User is offline   Elise 

  • Bleepin' Blonde
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Admin
  • Posts: 39,005
  • Joined: 05-October 07
  • Gender:Female
  • Location:Romania

Posted 29 October 2011 - 04:47 PM

You are most welcome Josh. :)

Quote

How about the case of my computer freezing, what would be the cause of that?
See the first comment in my last reply, this is most likely a hardware/overheating issue.

As for the hacking; this is not a person who hacked your computer because of a personal interest. It is a group only interested in using your computer to be a part of a large botnet (as a so-called zombie) which can be used for online attacks against different targets (for example DDoS attacks for a specific site). Although theoretically the group responsible for the rootkit that infected you, could trace you back, it is not very likely this will happen. Still, the possibility remains there.
regards, Elise

"The mind is its own place, and in itself can make a heaven of hell, a hell of heaven." ~ John Milton
Posted Image Follow BleepingComputer on: Facebook | Twitter | Google+

#160 User is offline   josh@bcn 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 105
  • Joined: 14-July 11

Posted 30 October 2011 - 03:26 AM

Okay Elise... by the way another question. Just now, my computer restarted all by itself....a bluse screen appeared saying : problem detected computer needs to be shut down, etc., etc.

so it restarted, it already happened before... :(

#161 User is offline   Elise 

  • Bleepin' Blonde
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Admin
  • Posts: 39,005
  • Joined: 05-October 07
  • Gender:Female
  • Location:Romania

Posted 30 October 2011 - 08:04 AM

Once again, because you accuse the noise, I really recommend to take the laptop to a repair shop and have the components cleaned and checked out. If you don't do this, you risk permanently damaging your computer!

I will close this topic, if you need it reopened, please send me a PM.
regards, Elise

"The mind is its own place, and in itself can make a heaven of hell, a hell of heaven." ~ John Milton
Posted Image Follow BleepingComputer on: Facebook | Twitter | Google+

Share this topic:


  • 11 Pages +
  • « First
  • 9
  • 10
  • 11
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users