Antivirus soft infection

Hello.
I dealt with this same infection on my laptop awhile back and now have it on my PC. I'm running widows xp with avg free and firefox. I have my firewall active. I followed your guide in the malware removal section for virussoft and ran rkill first. The only result in the list was, c:\\windows\system32\ntvdm.exe. However if I run rkill again directly after it's already just run, that process still shows up, so I don't think it's actually stopping it each time. I downloaded the deleted file from your link for Malwarebytes and then updated and ran that program. It found several threats (virussoft being one of them, several trojans, and a root kit) and sometimes before I could try and remove the infections, it would shut down Malwarebytes... other times it would seem to complete, but the infections are still there. That happened with avg free too. I've tried everything suggested more than once in safe mode and regular mode and even tried a system restore, but every restore fails and neither Malwarebytes nor avg free, nor super anti-spy will get rid of my problem.

I ran defogger successfully I think, and then tried to download and run dds but I got an error msg saying that windows would not let me access the file and that I may not have permission. I tried re-downloading it 3 times with same result. I didn't know if I should continue with trying the gmer file so thought I'd wait for instructions.

Thanks in advance for your help.
Angi C

Edited by angicx, 23 June 2010 - 11:24 AM.

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE



Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

Hello and thanks for the reply.

I had posted here to the malware removal forum originally, thinking to save time because I knew I was infected and had had help here before, but then today, I posted to the "am I infected" forum thinking maybe I should have started there, so please excuse the double post.

First of all, I can not run DDS. I've tried many, many times. It doesn't give me an option of where to save, so after it downloads, I have to open my download folder in my documents, but every time I click on it, it says that "windows would not let me access the file because I may not have permission". I followed the instructions in the link provided and disabled my virus protection (avg free 9.0) as far as I can tell, but the only things it gives me an option to disable are resident shield and the link scanner. I tried downloading the first dds link you provided in your reply but the second one you listed only sent me to a page filled with coded text as far as I could tell. I also tried the links for dds provided in the tools section on this site. Any idea what I'm doing wrong? Sorry, I can't figure it out.

I'm not sure what the infection is anymore. It started with virussoft and google redirects and pop ups, but I'm not having that problem anymore, just random multiple detections by my virus software, and my computer running very slow and freezing up. Sometimes it takes up to a minute or more to perform any action that I'm asking it to do, whether moving in between web addresses, clicking on links, clicking on anything on my desktop or in my start menu, or or even right clicking to open a sub window. I've tried many things suggested in your malware removal guides, and ran most of the tools except for combo fix. I did try rkill, atf cleaner, gmer, tdsskiller, smitfraudfix, SDfix, all out of desperation. I have scanned with avg free 9.0, malwarebytes, and super anti spy. It will seem as if it has worked and my comp will run ok for a few hours, then it will start detecting viruses again, often when the computer is sitting idle, not going to any web pages.

Here is some of what has been detected. There has been more at times, but this is the latest that I wrote down.

Trojan horse Pakes. GAJ
Trojan horse Dropper generic 2. VQN

GMer also detected a hidden process at one time and it mentioned (boot) hmbee, if that helps.
I'm including the new gmer log below, but it looks as if all it's reading now is something associated with avg, and that frustrates me, because I thought I had it disabled. I can post any of the previous logs if you'd like, I saved them all.

I researched the above infected files a bit on Google and saw where disabling system restore and then trying to do a system clean again with my virus/malware protection was suggested, and I did that today. So far I haven't had any problems detected again when scanning, however, my system is still freezing up and running very slow.

What to do about DDS?

Thanks in advance for your help.
Angi C



GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-06-28 22:32:13
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Admin\LOCALS~1\Temp\uxtdqpob.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----

Edited by angicx, 29 June 2010 - 09:47 AM.

Hello, angicx
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 4-5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:

• Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
• If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
• Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
• Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
• Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
• Please set your system to show all files.
  Click Start, open My Computer, select the Tools menu and click Folder Options.
  Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
  Uncheck: Hide file extensions for known file types
  Uncheck the Hide protected operating system files (recommended) option.
  Click Yes to confirm.

Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2



--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.

When finished, it will produce a report for you.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Due to the lack of feedback, this topic is now closed.
If you need this topic reopened, please PM a staff member and we will reopen it for you (include the address of this thread in your request). This applies to the original topic starter only. Everyone else with similar problems, please start a new topic.