Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Killing Hazard Virus


  • Please log in to reply
3 replies to this topic

#1 eastwest97

eastwest97

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:01:52 PM

Posted 30 September 2010 - 08:25 AM

Hello Everyone:

Can you assist? I am a computer novice more or less. I know some things but I don't now how I received this virus. It's just so frustrating.

I have tried following all of the instructions listed on this site by:

1. downloading the Malwarebytes; renamed it with a different extention,
2. starting in Safe Mode or Safe Mode Networking
3. renaming .exe applications
4. Trying to access SuperAntiSpyware but the virus blocks the website,
5. Running rkill about 40 times.
6. I've even tried downloading Malwarebytes from a "clean" computer to a USB stick to no avail.

My computer will allow me to get on the Internet but most websites with the the links suggested to download, are blocked. I have a company laptop, HP Elitebook 6930p. My company has Trend Micro ScanOffice loaded and I also loaded Norton 360 Premier Edition but the company Trend Micro scan seems to override everything by saying all of the websites suggested for downloads as being a virus.

I'm at a lost of what to do. Thank you so much.

PS: I'm really upset that I had both Antivirus applications on my computer and neither caught this KillerHazard virus.

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:52 PM

Posted 30 September 2010 - 11:19 AM

Hello, is this XP??

Try logging in under a new or different user account and see if you can run FULL scans with MBAM(Malwarebytes;) and SAS (SuperAntiSpyware)
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 rvan1

rvan1

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 01 October 2010 - 03:39 PM

I and others are getting this due to not changing the default password on their router, so some process logs in and and changes the DNS to route through this server out in Russia (213.109.69.44).

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:52 PM

Posted 01 October 2010 - 03:47 PM

The problem is actually based in your router and that in turn is infecting all the other computers on your network if there are more than one..
Here is the entire fix(from the beginning) that you will need to run on each PC.

Please download Malwarebytes' Anti-Malware from Here or Here

Next disconnect your system from the internet, and your router, then…

Double Click mbam-setup.exe to install the application.
  • Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.



Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds). If you don’t know the router's default password, you can look it up HERE

However, if there are other Zlob-infected machines using the same router, they will need to be cleared with the above steps before resetting the router. Otherwise, the malware will simply go back and change the router's DNS settings. You also need to reconfigure any security settings you had in place prior to the reset. Check out this site here for video tutorials on how to properly configure your router's encryption and security settings. You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

Once you have ran Malwarebytes' Anti-Malware on the infected system, and reset the router to its default configuration you can reconnect to the internet, and router. Then return to this site to post your logs.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users