Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Antivirus-Live infection, has disabled my real antivirus, and most functions, and redirects internet address


  • This topic is locked This topic is locked
6 replies to this topic

#1 donwa

donwa

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 20 December 2009 - 08:42 PM

Can not access the internet; everything I type in gets rediredted to hxxp://os-guard2010.microsoft.com/block.php?r=59.6]http://os-guard2010.microsoft.com/block.php?r=59.6[/url]. The unwanted antirus program (Antivirus-Live) runs a scan and tries to get me to buy it. Fake windows program pop-up messages tell me I am infected with this or that virus and ask do I want to purchase. So far, all the fixes I have seen rely on my being able to download something from the internet, which I cannot do because the http address is redirected as described in first sentence above. I also can not install my newly purchased Kaspersky antirus CD because virus has deactivated anything I try to run,giving message that it is infected. But here is what I did try: I installed the current version of Kaspersky on another PC, then took out my infected hard drive and put it in a powered IDE enclosure and scanned it using Kaslersky via USB using the uninfected PC contained fresh version of Kaspersky. It found and deleted several trojans and other viruses. But when I put the drive back in my PV and boot up, I still have that darn antivirus-live problem, and still have no control of internet address and can't load or start programs. That thing must be well hidden from kaspersky I guess. Help! I spent $130 on the Kaspersky & the IDE enclosure and 6 hours of time & have nothing to show for it. Thank you.

Edited by syler, 20 December 2009 - 08:49 PM.
Deactivate link


BC AdBot (Login to Remove)

 


#2 syler

syler

  • Malware Response Team
  • 8,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Warrington, UK
  • Local time:08:26 AM

Posted 20 December 2009 - 08:47 PM

Hello donwa,

I am Syler and I will be helping you with your problems.
  • Please download GMER from one of the following locations, and save it to your desktop:
    • Main Mirror
      This version will download a randomly named file (Recommended)
    • Zip Mirror
      This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs, as this process may crash your computer.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with gmer's driver.
  • Double click on Gmer to run it.
  • Allow the gmer.sys driver to load if asked.
  • You may see a rootkit warning window, If you do, click No.
  • Untick the following boxes on the right side of the Gmer screen.
    Sections
    IAT/EAT
    Show All
  • Click on Posted Image and wait for the scan to finish.
  • If you see a rootkit warning window, click OK.
  • Push Posted Image and save the logfile to your desktop.
  • Copy and Paste the contents of that file in your next post.

unite.jpg


#3 donwa

donwa
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 20 December 2009 - 10:04 PM

Hello Syler.

Thank you for your quick reponse. Be aware that i am communiating with you on this issue using an uninfected computer in my home. I cannot control my infected computer. I don't know how I could click on the links you mention to get those 2 downloads onto my infected PC. My infected PC redirects my HTTP address as described in my original note. How can I attach to the bleepingcomputer website & read your notes? Also, I cannot open any of my security programs to deactivate real time protection...because when I click on the correspondong icons fro AVG and Super AntiSpyware it won't open, and gives message that file/program is infected. Thanks again for your quick response and willingness to donate yor help, I do appreciate.

#4 syler

syler

  • Malware Response Team
  • 8,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Warrington, UK
  • Local time:08:26 AM

Posted 20 December 2009 - 10:19 PM

I don't know how I could click on the links you mention to get those 2 downloads onto my infected PC.


Do you have a flash drive or blank cd's that you can copy the tools on to and transfer them to the infected machine?

unite.jpg


#5 donwa

donwa
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 20 December 2009 - 10:52 PM

I was unable to do an install of Kaspersky from the CD drive of infected PC - it gave the 'infected file' msg. But I have not tried the flash drive approach. I can try to plug a flash drive into USB port of this clean PC and download the GMER (But will i need to deactivate Kaspersky security on this clean PC to do that?) And then I can try to carry the flash drive over to infected PC and transfer over. However your instruction to deactive my other security on that infected PC I do not know how to do because the virus has diabled my ability to open the AVG and antiSuperSpyware installed on the infected PC. Should I try the transfer? please advise. thank You.

#6 syler

syler

  • Malware Response Team
  • 8,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Warrington, UK
  • Local time:08:26 AM

Posted 21 December 2009 - 10:05 AM

Yes please, try transferring it but try running it in safe mode first, don't worry about disabling your protection for now.

unite.jpg


#7 syler

syler

  • Malware Response Team
  • 8,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Warrington, UK
  • Local time:08:26 AM

Posted 26 December 2009 - 02:56 PM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending me a PM
with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

unite.jpg





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users