Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Acquired new virus, can't open antivirus software


  • This topic is locked This topic is locked
21 replies to this topic

#1 Matt_B

Matt_B

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 28 June 2009 - 07:07 PM

I dont know how I got this new virus but it very similar to one Ive had in the past. My antivirus software started giving me all sorts of warnings and then when I restarted my desktop screen was changed to "WARNING YOUR COMPUTER IS INFECTED WITH SPYWARE...." I Usually use smitfraudfix but I cannot open any antivirus software. I went to my old posting to try that method but it did not work. I currently have:
-smitfraudfix
-avenger
-bitlord
-combofix
-erunt
-gmer
-Hijackthis
-Oldtimer tools
-malware bytes
-NTREGOPT
-SDfix
all on my computer downloaded but they do nothing when clicked. Last time I had to rename the OTM software to iexplore.exe to be able to run it and move a blocker.dll file. This forum has never let me down on getting rid of this vicious software and I am hoping someone can help me out once more. Also i'm running windows xp.

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,039 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:47 PM

Posted 28 June 2009 - 08:28 PM

Hello i am moving this to the Am I infected forum for now...
You have an open HJT Topic .. here http://www.bleepingcomputer.com/forums/ind...p;#entry1286272
The site owner has asked you to create a log .. You can't get any better help than you are getting.. I will close this topic shortlty.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 Matt_B

Matt_B
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 28 June 2009 - 08:36 PM

This is a completely new infection. My last virus was fixed thanks to Grinler. I will need further assistance with this virus so please do not close this posting.

#4 rohit.r.i

rohit.r.i

  • Banned
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:17 PM

Posted 28 June 2009 - 08:41 PM

Just seems like a spyware...Don't panic....Post the logs and these guys will fix it

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,039 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:47 PM

Posted 28 June 2009 - 08:45 PM

OK then it belongs here anyway as that forum is for HJT logs only.. Do Not run ComBoFix..

Next run MBAM (MalwareBytes):

NOTE: Before saving MBAM please rename it to zztoy.exe....now save it to your desktop.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 Matt_B

Matt_B
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 28 June 2009 - 09:23 PM

I am unable to open MBAM.

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,039 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:47 PM

Posted 28 June 2009 - 09:31 PM

OK let's try ROOTREPEAL

Next Please install RootRepeal first.

Go HERE, and download RootRepeal.zip to your Desktop.
Tutorial with images ,if needed >> L@@K.
Unzip that,(7-zip tool if needed) and then click RootRepeal.exe to open the scanner.
Next click on the Report tab, now click on Scan. A Window will open asking what to include in the scan. Check all of the below and then click OK.

Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services


Now you'll be asked which drive to scan. Check C: and click OK again and the scan will start. Please be patient as the scan runs. When the scan has finished, click on Save Report.
Name the log RootRepeal.txt and save it to your Documents folder (it should automatically save it there).
Please copy and paste that into your next reply.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 Matt_B

Matt_B
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 28 June 2009 - 10:40 PM

I was able to download the program but unable to extract any files or open the executable file.

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,039 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:47 PM

Posted 29 June 2009 - 10:56 AM

You will need to run HJT/DDS.
Please follow this guide. go and do steps 6 and 7 ,, Preparation Guide For Use Before Using Hijackthis. Then go here HijackThis Logs and Virus/Trojan/Spyware/Malware Removal ,click New Topic,give it a relevant Title and post that complete log.

Let me know if it went OK.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 Matt_B

Matt_B
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 29 June 2009 - 06:24 PM

well I got home from work to try running dds/HJT but neither were able to execute. I get a fake malware error message saying that that program is infected with a virus and cannot be opened. Then it sends me to their antivirus software page asking me to upgrade and buy their software. Last time I was atleast able to run HJT, now nothing. The only program I am able to semi-run is internet explorer, Firefox won't even work. HJT just flashes very quickly then disappears. Please help.

#11 Matt_B

Matt_B
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 29 June 2009 - 09:05 PM

The name of the virus is the System Security Virus.

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,039 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:47 PM

Posted 29 June 2009 - 09:36 PM

If you cannot get DDS to work, please try this instead.

Please download RSIT by random/random and save it to your Desktop.
Note: You will need to run this tool while connected to the Internet so it can download HijackThis if it is not located on your system. If you get a warning from your firewall or other security programs regarding Rist attempting to contact the Internet, please allow the connection.
  • Close all applications and windows so that you have nothing open and are at your Desktop.
  • Double-click on RSIT.exe to start the program.
  • If using Windows Vista, be sure to Run As Administrator.
  • Click Continue after reading the disclaimer screen.
  • Leave the drop down box set to default: "List/folders created or modified in the last 1 month (30 days).
  • When the scan is complete, a text file named log.txt will automatically open in Notepad.
  • Save the log file to your desktop and copy/paste the contents into a new topic in the HijackThis Logs and Malware Removal forum, NOT here.
Important: Be sure to mention that you tried to follow the Prep Guide but were unable to get DDS to run.
If RSIT did not work, then reply back here.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 Matt_B

Matt_B
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 30 June 2009 - 07:26 PM

Once again the program opens quickly and then disappears. I am sorry for the delay but am away at work for most of the day and cannot respond. I am trying to be patient but I miss using my computer.

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,039 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:47 PM

Posted 30 June 2009 - 07:32 PM

If you cannot get DDS to work, please try this instead.

Please download runscanner.zip and save to your desktop.
  • Create a new folder on your hard drive called Runscanner (C:\Runscanner) and extract (unzip) the file there.
    (click here if you're not sure how to do this.)
  • Double-click Runscanner.exe to launch.
  • Select Beginner mode and click Ok.
  • Select Do a full scan and save a log file (default is Full Scan) to start.
  • Please be patient and do not use your computer during the scan.
  • When the scan is complete, a window will open asking you to save runscanner.run. Click Cancel.
  • Another window will open asking you to save runscanner.log.
  • Save it to your desktop and "Save as type: Runscanner log file [*.log].
  • The log file will automatically open in Notepad.
  • Go to the top menu, click on "Format" and uncheck "Word Wrap" if checked.
  • Copy and paste the contents of the log file into a new topic in the HijackThis Logs and Malware Removal forum, NOT here.
  • Exit Runscanner when done.
Important: Be sure to mention that you tried to follow the Prep Guide but were unable to get DDS to run. If Runscanner did not work, then reply back here.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 Matt_B

Matt_B
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 30 June 2009 - 07:59 PM

I am unable to launch the program




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users