BleepingComputer.com: can't run rkill or tdsskiller...malware problem

Been looking all over for how to solve my problem. Have 3 pcs on a home network. Laptop is the worst with Internet Security 2012 warnings all over it. 1 desktop is S L O W (the one I'm using to post this), and the other one just runs slow normally

Laptop won't let me access internet. Downloaded rkill and tdsskiller and sdsetup_revwire to desktop and transferred via flash to laptop. But laptop won't open any of them. Even tried renaming them -- no luck. Then downloaded your "eXplorer" rename, and that appears to "try" to open (small, "dos-like" screen -- don't know what to call it -- tries to flash open several times, sometimes with some text in it, but I can't read it), but I can't tell if it has run or not, and nothing else changes.

pls help!

Edit: Moved topic from Vista to the more appropriate forum. ~ Animal

Hello...

Please follow our Removal Guide here Remove Win 7 Antispyware 2012 and Vista Antivirus 2012 name changing rogue .
After reading how the malware is misleading you ...
You will move to the Automated Removal Instructions

After you completed that, post your scan log here,let me know how things are.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

Also the other tool log.. A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
Copy and paste the contents of that file in your next reply.

sorry...just getting back to this. I downloaded fixNCR.reg to a flash, and tried to open it on the laptop, and nothing happens. Should there be some way to tell if the registry changes were made?

thanks

i've tried "merging" it multiple times, and all I get is a quiet windows "ding"...

That was probably all. It is just a registry adjustment. It worked if the tools run.

...but they don't...unfortunately. still can't get either the rkill or the tdsskiller or the eXplorer to open up...

suggestions?

and I still can't run firefox or IE...

This post has been edited by maggieg: 03 February 2012 - 02:54 PM

Try agin from safe mode, How to start Windows in Safe Mode

well, I was in safe mode with networking... but I rebooted in just "safe mode" and things went swimmingly from there on.

Looks like I'm back in business. thanks for your help, and btw, nice 2T4:3 ref



Here's the log from MBAM after it finished:

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.03.10

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Maggie Garay :: MLGARAY-LAPTOP [administrator]

2/3/2012 3:46:08 PM
mbam-log-2012-02-03 (15-46-08).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 312711
Time elapsed: 1 hour(s), 23 minute(s), 13 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 3
C:\Users\Maggie Garay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QLBRDXFZ\load_13[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Maggie Garay\AppData\Local\Temp\B7F8.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Maggie Garay\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

(end)

You're welcome. Yeah,it was that pesky Fakealert.
It's my favorite text.

Before we mop up .....

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check and check Remove found threats
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push

NOTE: In some instances if no malware is found there will be no log produced.