BleepingComputer.com: Issues with a Virus

I'm having issues with my computer where it's alerting me to suspected viruses and directing me to buy antivirus protection. I cannot access certain pages; when I try I get a statement that the page is possibly permanently deleted or unavailable. I'm mostly seeing this when I try to click on downloads for virus protection.

When I finally was able to click on Norton to download it I received "Internal Error:Failed to Expand Shell Folder Constant "userappdata"

The warnings I'm being shown on my desktop (of which include "stealth intrusion" "privacy breach"), when clicked, do an automatic scan that reveal to me that I'm infected with Trojans and Worms.

I'm not exactly sure what to do at this point as I can't seem to download any virus protection and when I do scans it tells me there are no viruses on the computer.

Welcome aboard

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  
  • Internet Services
    
  • Windows Firewall
    
  • System Restore
    
  • Security Center
    
  • Windows Update
  
  
• Press "Scan".
  
• It will create a log (FSS.txt) in the same directory the tool is run.
  
• Please copy and paste the log to your reply.

====================================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:

• Report IE Proxy Settings
  
• Report FF Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List Winsock Entries
  
• List last 10 Event Viewer log
  
• List Installed Programs
  
• List Users, Partitions and Memory size

Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

This is what I received in the notepad for the first step of your instructions

Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Norton Internet Security
McAfee Security Scan Plus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java™ 6 Update 26
Out of date Java installed!
Adobe Flash Player ( 10.2.159.1) Flash Player Out of Date!
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
AVG avgwdsvc.exe
AVG avgtray.exe
``````````End of Log````````````






However the notepads for the next steps came up blank after it asked me "Cannot Find the FSS.txtfile. Do you want to create a new file?"
When I attempted to download the Malwarebytes' Anti-Malware the download button simply wouldn't work. Now scanning with the last step and will post in next reply.

Quote

Look for FSS.txt file in a same location where FSS.exe is located.

This is the result of the scan of the last step.

aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-16 10:42:08
-----------------------------
10:42:08.782 OS Version: Windows x64 6.1.7601 Service Pack 1
10:42:08.783 Number of processors: 1 586 0x1601
10:42:08.784 ComputerName: FAMILYPC UserName:
10:42:12.403 Initialize success
10:43:09.649 AVAST engine defs: 12011600
10:45:09.972 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
10:45:09.976 Disk 0 Vendor: WDC_WD5000AAKS-22V1A0 05.01D05 Size: 476940MB BusType: 3
10:45:09.990 Disk 0 MBR read successfully
10:45:09.996 Disk 0 MBR scan
10:45:10.003 Disk 0 Windows 7 default MBR code
10:45:10.011 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 16384 MB offset 2048
10:45:10.027 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 33556480
10:45:10.042 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 460454 MB offset 33761280
10:45:10.051 Service scanning
10:45:11.511 Service Tablet2k C:\Windows\"%SystemRoot%\System32\Drivers\Tablet2k.sys" **LOCKED** 123
10:45:12.183 Modules scanning
10:45:12.194 Disk 0 trace - called modules:
10:45:12.215 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys
10:45:12.587 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8002726120]
10:45:12.596 3 CLASSPNP.SYS[fffff8800196043f] -> nt!IofCallDriver -> [0xfffffa8002638520]
10:45:12.616 5 ACPI.sys[fffff88000d577a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8002634680]
10:45:14.108 AVAST engine scan C:\Windows
10:45:17.336 AVAST engine scan C:\Windows\system32
10:48:39.542 AVAST engine scan C:\Windows\system32\drivers
10:48:53.967 AVAST engine scan C:\Users\Christpher Zerillo
10:53:41.471 AVAST engine scan C:\ProgramData
11:02:06.331 Scan finished successfully
11:02:43.426 Disk 0 MBR has been saved successfully to "C:\Users\Jen\Desktop\MBR.dat"
11:02:43.439 The log file has been saved successfully to "C:\Users\Jen\Desktop\aswMBR.txt"















I apologize but I dont understand what you mean by "Look for FSS.txt file in a same location where FSS.exe is located. "

Wherever you downloaded Farbar Service Scanner file to see if there is FSS.txt log there.

What about MiniToolbox?

I downloaded it to my desktop but I dont see a file there along with it after I ran the scan. Same with the mini tool box.

Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

• Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  
• An icon will be created on your desktop. Double-click that icon to launch the program.
  
• Super should automatically the program definitions. If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
  
• Close SUPERAntiSpyware.

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen

• Open SUPERAntiSpyware.
  
• Click on "Preferences" button.
  
• Click the "Scanning Control" tab.
  
• Under Scanner Options make sure the following are checked (leave all others unchecked):
  
  • Close browsers before scanning.
  
  
• Click the "Home" button to leave the control center screen.
  
• Back on the main screen checkmark "Complete scan" and click "Scan your computer".
  
• Click "Next" to start the scan. Please be patient while it scans your computer.
  
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  
• Make sure everything has a checkmark next to it and click "Next".
  
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  
• If asked if you want to reboot, click "Yes".
  
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  
  • Click Preferences, then click the Statistics/Logs tab.
    
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    
  • Copy and paste the Scan Log results in your next reply.
  
  
• Click Close to exit the program.

Post SUPERAntiSpyware log.

I ran in safe mode and attempted to open the program. I was presented with a warning that it could be unsafe (like most programs I try to open) I asked it to allow me to open the file however it simply didn't open.

Im having that issue with almost all my programs when I ask it to allow an open.

Please follow the instructions in ==>This Guide<== starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

Thank you for all the help

You're very welcome