My sister's laptop infected with Vista AntiMalware 2010

Hello again,
My sister's laptop got infected when she was on youtube on Friday. By accident she click on the VAM2010 pop up to click out which had make it worse with more pop ups. She couldn't use Malwarebytes cuz it wouldn't let her open it. Today I put her laptop on safemode to see if it'll let us go onto Malwarebytes but it still doesn't work and the popups still appears. I need BC assistance removing the virus/malware/spyware. Thank you for the help.

Before using MBAM download rkill from here

Once it is downloaded, double-click on the rkill.com in order to automatically attempt to stop any processes associated with Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself

Now try to run MBAM

rkill worked, got to open malwarebytes, scanned, pop ups are removed after restart, the only thing is malwarebytes will not let me update cuz I get an error message which means the laptop is still infected.


The MBAM LOG

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3989

Windows 6.0.6001 Service Pack 1 (Safe Mode)
Internet Explorer 8.0.6001.18904

4/20/2010 4:39:20 PM
mbam-log-2010-04-20 (16-39-20).txt

Scan type: Quick scan
Objects scanned: 104230
Time elapsed: 5 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 3
Folders Infected: 1
Files Infected: 18

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45014115 (Rogue.Multiple.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\nani\AppData\Local\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\nani\AppData\Local\ave.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\nani\AppData\Local\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

Folders Infected:
C:\ProgramData\45014115 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

Files Infected:
C:\ProgramData\45014115\45014115.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\b2rbwu.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\bqif.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\bthxjqy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\fzpl89j0fh7p.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\iexplore.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\jgzyxfjq.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\notepad.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\user.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\win.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\winamp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\Temp\clk69.nls (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Users\nani\Desktop\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Windows\Temp\_ex-68.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\nani\Local Settings\Application Data\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Your log shows you ran the scan in safe mode,you cannot update MBAM there

Try to update and rescan in normal mode

I did try to update with normal mode but I still got an error message.

Ok first run a scan in normal mode,see if it removes anything else.
Then try to update,if you get an error message please tell me what the message is.

I actually did a full scan on normal mode right after the steps I did above, so I'll post that log up along with the error message I get everytime I click on update, when that happens, I know something is blocking it from updating as well as blocking the internet, I know this because this has had happened to my computer before. It'll continue to do the same, it'll remove some of them but not all since there are some stubborn ones in there. When I get internet connection back and is able to update the MBAM, that's when I know the laptop is fine again.

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3989

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18904

4/20/2010 7:02:15 PM
mbam-log-2010-04-20 (19-02-15).txt

Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 221587
Time elapsed: 1 hour(s), 17 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\nani\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\95X9RGNB\hypwhc[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\95X9RGNB\fwelcx[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\95X9RGNB\kkemu[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XYZUQCXE\imwaic[1].htm (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XYZUQCXE\rvqxfn[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\nani\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XYZUQCXE\oriqbjdp[1].htm (Trojan.Agent) -> Quarantined and deleted successfully.

Edited by yoori, 21 April 2010 - 08:02 AM.

Is it only mbam that wont update or do you have no internet connection.You obviously got rkill downloaded so maybe you are transfering them via flash drive so next.

Clean out your temp files.
Download Attribune's ATF Cleaner and save to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


DR. WEB CUREIT
----------------------
Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet.
alternate download link
Note: The file will be randomly named (i.e. 5mkuvc4z.exe).

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in Safe Mode.

Scan with Dr.Web CureIt as follows:

• Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
• Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
• If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click No to All. [/i])
• After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
• In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
• Please be patient as this scan could take a long time to complete.
• When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
• Click Select All, then choose Cure > Move incurable.
• In the top menu, click file and choose save report list.
• Save the DrWeb.csv report to your desktop.
• Exit Dr.Web Cureit when done.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

Wow seems my sis got some viruses from Limewire too, not surprised.
Yeah, I'm transferring back and forth, from her laptop to my computer.
Her internet doesn't work, which should.

Here's the log for

wzdcjrp[1].htm;C:\Documents and Settings\nani\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\B44NKJ5C;Trojan.DownLoad.41551;Deleted.;
wzdcjrp[1].htm;C:\Documents and Settings\nani\AppData\Local\Application Data\Temporary Internet Files\Content.IE5\B44NKJ5C;Trojan.DownLoad.41551;Invalid path to file ;
wzdcjrp[1].htm;C:\Documents and Settings\nani\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B44NKJ5C;Trojan.DownLoad.41551;Invalid path to file ;
Preview-T-3263249-George Micheal-fast love.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
Preview-T-3438009-show was over miracles.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
Preview-T-3545425-show was over miracles.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
Preview-T-3545427-fast love pt 2.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
Preview-T-5571804-nothing to loose 2 pac.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
Preview-T-5974753-johny was good man bob marley (new album).mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
T-3263249-George Micheal-fast love.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
T-3438009-show was over miracles.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
T-4153328-[RMX] 2pm- again and again(from iTunes).mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
T-5571804-nothing to loose 2 pac.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
T-5872441-show is over - bonus track.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
T-5974753-johny was good man bob marley (new album).mp3;C:\Documents and Settings\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;Cured.;
2pm- again and again hot new track.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
all day tupac son of sam remix - greatest hits.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
Apple_Pie_Virgo_So_Def_Bass.wma;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
big bang.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
fast love pt 2.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
got to survive tupac featuring - greatest hits.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
show is over.wma;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
thin line between love hat.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
tupac featuring spice 1 remix.mp3;C:\Documents and Settings\nani\Documents\LimeWire\Saved;Trojan.WMALoader;Cured.;
Preview-T-3263249-George Micheal-fast love.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-3438009-show was over miracles.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-3545425-show was over miracles.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-3545427-fast love pt 2.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-5571804-nothing to loose 2 pac.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-5974753-johny was good man bob marley (new album).mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-3263249-George Micheal-fast love.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-3438009-show was over miracles.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-4153328-[RMX] 2pm- again and again(from iTunes).mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-5571804-nothing to loose 2 pac.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-5872441-show is over - bonus track.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-5974753-johny was good man bob marley (new album).mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Incomplete;Trojan.WMALoader;;
2pm- again and again hot new track.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
all day tupac son of sam remix - greatest hits.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
Apple_Pie_Virgo_So_Def_Bass.wma;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
big bang.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
fast love pt 2.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
got to survive tupac featuring - greatest hits.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
show is over.wma;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
thin line between love hat.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
tupac featuring spice 1 remix.mp3;C:\Documents and Settings\nani\My Documents\LimeWire\Saved;Trojan.WMALoader;;
wzdcjrp[1].htm;C:\Users\nani\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B44NKJ5C;Trojan.DownLoad.41551;Invalid path to file ;
Preview-T-3263249-George Micheal-fast love.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-3438009-show was over miracles.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-3545425-show was over miracles.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-3545427-fast love pt 2.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-5571804-nothing to loose 2 pac.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
Preview-T-5974753-johny was good man bob marley (new album).mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-3263249-George Micheal-fast love.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-3438009-show was over miracles.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-4153328-[RMX] 2pm- again and again(from iTunes).mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-5571804-nothing to loose 2 pac.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-5872441-show is over - bonus track.mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
T-5974753-johny was good man bob marley (new album).mp3;C:\Users\nani\Documents\LimeWire\Incomplete;Trojan.WMALoader;;
2pm- again and again hot new track.mp3;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;
all day tupac son of sam remix - greatest hits.mp3;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;
Apple_Pie_Virgo_So_Def_Bass.wma;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;
big bang.mp3;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;
fast love pt 2.mp3;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;
got to survive tupac featuring - greatest hits.mp3;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;
show is over.wma;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;
thin line between love hat.mp3;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;
tupac featuring spice 1 remix.mp3;C:\Users\nani\Documents\LimeWire\Saved;Trojan.WMALoader;;

Wow thats quite a mess,you will need stronger tools than are available in this forum to clean this machine
Complete steps 6-9 here and post your logs in that forum.

Hi,
I'm keep getting stuck with step 8. When I'm in the middle of scanning another screen shows up and says it detected some kind of problem and then restarts the whole computer, either that or it'll freeze during or after scanning. What should I do?

Just post the DDS logs and tell them you could'nt get GMER to run

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/313206/infected-with-trojan-viruses-possibly-rootkits/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom