Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ave.exe virus, google redirect, now svchost failing and other system issues


  • This topic is locked This topic is locked
10 replies to this topic

#1 cman72

cman72

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 06 May 2010 - 04:12 PM

Hi, I'm hoping someone can help me with this virus problem.

It started with the ave.exe virus, which I've successfully removed with Malware-bytes and SUPERAntiSpyware Free Edition. I'm no longer getting the fake anti-virus popups, but I am still getting re-directed on all my Google searches and I get the occasional popup ad (using Firefox). My system now runs very slow and reboots on its own. It's a laptop so when I put it to sleep, the next time I bring it back it said it recovered from a serious Windows Failure.

Here is what I have done so far. I followed the Preparation instructions before posting this topic. DDS launched to the cmd window for about 3 seconds, then disappeared, but no log files ever appeared (I waited for over an hour). I then ran GMER, the 1st time I ran it I got a blue screen within the first 10 minutes (rebooted), the 2nd time I ran it my system came to a screeching halt. The Task Mgr showed CPU usage at 100%, my computer was unusable and I had to do a hard boot. So I threw in the towel and now I'm posting this.

Before I saw this forum and the associated instructions, I had tried some other solutions that I saw mentioned on other forums. I ran MalwareBytes, which found and removed the ave.virus. I ran SUPERAntiSpyware, which also found issues. I also ran SpyBot Search & Destroy, it didn't anything. But I am still having Google re-directs, random popup ads, blue screens, and automatic reboots.

I need help. Thank you!

Edited by Orange Blossom, 06 May 2010 - 07:04 PM.
Move to AII as no logs posted. ~ OB


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:41 AM

Posted 06 May 2010 - 11:07 PM

Hello, first run TFC by OT
Please download TFC by Old Timer and save it to your desktop.
alternate download link
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Run RKill....

Please download Rkill by Grinler and save it to your desktop.Link 2
Link 3
Link 4
  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista, right-click on it and Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • If the tool does not run from any of the links provided, please let me know.
Do not reboot your computer after running rkill as the malware programs will start again.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Next DrWeb.
Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet.
alternate download link
Note: The file will be randomly named (i.e. 5mkuvc4z.exe).

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:
  • Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
  • Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  • The Express scan will automatically begin.
    (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  • If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  • If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)
  • After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
  • In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
  • Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  • Please be patient as this scan could take a long time to complete.
  • When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
  • Click Select All, then choose Cure > Move incurable.
  • In the top menu, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

Plaese post back MBAM and DrWeb logs
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 cman72

cman72
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 07 May 2010 - 02:36 PM

Thank you for helping. I'm actually posting from a different machine as we speak. I've done everything as instructed up to running Dr. Web, this is where I've run into a problem. Dr. Web has found 2 Objects infected, the first one says "Process in memory: C:\Windows\system32\svchost.exe:836", the status says "BackDoor.Tdss.565", Action says "Eradicated.". The 2nd object is msahci.sys, located at C:\Windows\system32\drivers, Status says "BackDoor.Tdss.2459", Action says "Will be cured after restart." When the scan completed I said "Yes to All", it removed the first object but then got stuck in a constant loop with the 2nd, every time it removed it it would come back and remove it again, this went on until the 120th time. I decided to reboot, I'm running the scan again and it found the exact same 2 objects.

It's still scanning as we speak. Any suggestions on how to bypass the loop with Dr. Web?

#4 cman72

cman72
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 07 May 2010 - 02:59 PM

FYI, here's the MBAM log.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4075

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18813

5/7/2010 12:30:18 PM
mbam-log-2010-05-07 (12-30-18).txt

Scan type: Quick scan
Objects scanned: 139730
Time elapsed: 9 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AKM Antivirus 2010 Pro (Rogue.AKMAntivirus) -> Quarantined and deleted successfully.

Files Infected:
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AKM Antivirus 2010 Pro\AKM Antivirus 2010 Pro.lnk (Rogue.AKMAntivirus) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\Desktop\AKM Antivirus 2010 Pro.lnk (Rogue.AKMAntivirus) -> Quarantined and deleted successfully.
C:\Windows\System32\config\Systemprofile\Application Data\alggui.exe (Trojan.Agent) -> Quarantined and deleted successfully.

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:41 AM

Posted 07 May 2010 - 03:54 PM

Ok let's run TDDS Killer from here
How to remove the TDSS,

Then DrWeb again
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 cman72

cman72
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 10 May 2010 - 02:11 PM

After several tries, I was able to get past the Dr Web loop issue and was able to get through a Complete scan, however, when I went to go save the report my computer blue screened. I had to reboot several times using "Last Known Good Configuation", several blue screens later I was able to get back to normal Windows Vista mode. I did a Google search to see if the redirect problem had been fix, sadly, it's still doing it. Seems like we're back to square 1 (I actually got a pop up ad as I was trying to type this). I have lost weeks of productivity now, I'm about to reformat this machine!!!

Here's the end of the CureIt.log file from Dr.Web.

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Scanned: 224017
Infected: 2
Modifications: 0
Suspicious: 0
Adware: 0
Dialers: 0
Jokes: 0
Riskware: 0
Hacktools: 0
Cured: 1
Deleted: 1
Renamed: 0
Moved: 0
Ignored: 0
Scan speed: 198 Kb/s
Scan time: 01:57:50
-----------------------------------------------------------------------------

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:41 AM

Posted 10 May 2010 - 02:25 PM

Seems like we need a deeper look. Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 cman72

cman72
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 10 May 2010 - 03:09 PM

Yeah, that's part of my problem, the DDS DOS window flashes for about a second or two then closes down and never spits out the txt files. Can't get GMER to run either!

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:41 AM

Posted 10 May 2010 - 03:15 PM

Maybe this.... Skip Gmer
If you cannot get DDS to work, please try this instead.

Please download OTL by OldTimer and save it to your Desktop.
  • Close all other applications and windows so that you have nothing open and are at your Desktop.
  • Double click on the OTL Posted Image icon on your desktop.
  • Select 30 days from the File Age: drop down menu.
  • Click the "Scan All Users" checkbox.
  • Click the Posted Image button to start.
  • Do not use the computer while the scan is in progress.
  • When the scan is complete, two log files will open in Notepad:
    • OTL.txt <- (will be maximized)
    • Extras.txt <- (will be minimized in the Task Bar).
  • Both logs are automatically saved to the Desktop.
  • Please copy the contents of OTL.txt to the clipboard by highlighting everthing and pressing Ctrl+C or after highlighting, right-click and choose Copy and then paste it into a new topic in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here.
  • Also copy and paste the contents of Extras.Txt in your next reply as well. If the Extras.Txt log is too long, you may need to add a second reply to your thread.
  • Click the red X in the upper right corner to exit OTL.
Important: Be sure to mention that you tried to follow the Prep Guide but were unable to get DDS and GMER to run. If OTL did not work, then reply back here.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 cman72

cman72
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 11 May 2010 - 10:02 AM

Thank you for your help. I was able to successfully run OTL. My new post is located here.

#11 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,566 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:41 AM

Posted 11 May 2010 - 02:10 PM

Ok looks good. I combined your posts into one post.

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users