Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Antivirus Pro


  • Please log in to reply
3 replies to this topic

#1 KnGJr24

KnGJr24

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:53 AM

Posted 25 August 2009 - 06:45 AM

Dear PC gurus,

I have come across a system I am trying to repair that is giving me problems. Here is what I have found.


As I started up the machine the Windows Antivirus Pro started scanning, I found the forum here on how to remove the 2 processes running in task manager and did so. This stopped it from scanning and allowed me to open Malware Bytes. As I was opening Malware Bytes and starting the quick scan, it closed and I got a Total Security screen. I searched for this on the forum and found the removal guide for it, but as it stated I did not see the "tsc.exe" file in the task list to kill.

I restarted the computer hoping it would pop up again and I could get the name of it fully, but when I restarted all I seen was the Windows Antivirus Pro again and no icons or start button what so ever on the desktop. It was like it never really started up. I got the task manager to open using CNTRL+ALT_DEL and killed the 2 processes for windows anitvirus pro again. Below is a list of all the processes that were running on the machine.

How do I go about getting this system to start up fully and remove whatever it is holding this out?


avgnsx.exe
avgrsx.exe
avgwdsvc.exe
csrss.exe
lsass.exe
MDM.exe
MemeoBackgroundService.exe
MsPMSPSv.exe
scardsvr.exe
services.exe
smss.exe
spoolsv.exe
svchast.exe (Windows Anitvirus Pro found from forum)
svhost.exe
svhost.exe
svhost.exe
svhost.exe
svhost.exe
svhost.exe
SYSTEM
System Idle Process
taskmgr.exe
Windows Antivirus Pro (kill from WAP Forum to remove)
winlogon.exe
wuauclt.exe



This is the list with Windows Antivirus still active.

Thanks in advance to everyone for your help in this.

BC AdBot (Login to Remove)

 


#2 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:10:53 AM

Posted 25 August 2009 - 08:14 AM

One or more of the identified infections is a rootkit/backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.



This infection will require tools not available here in the AII forum

If you do want to procede, please follow these directions posted for our HJT forum

http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

and post your logs in this forum, not here

http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/

Edited by DaChew, 25 August 2009 - 08:15 AM.

Chewy

No. Try not. Do... or do not. There is no try.

#3 KnGJr24

KnGJr24
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:53 AM

Posted 25 August 2009 - 09:06 AM

Thank you, It has been disconected from the internet. There was nothing really on the PC other then some programs that were download (probably were it came from) I am working on this for a friend of mine.

I am just going to reinstall the OS and start fresh since it was fairly clean of software and data anyways.


Thanks for your time DaChew....and everyone else who may have looked into it.

This is a great forum to learn things.....thanks to all the contributors!!

#4 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:10:53 AM

Posted 25 August 2009 - 09:20 AM

I think you have made the right decision, some of these rootkits can take a long time to fully remove and our HJT forum stays backed up. Too many infections for too few trained helpers.
Chewy

No. Try not. Do... or do not. There is no try.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users