Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Probable Virus Problem


  • This topic is locked This topic is locked
22 replies to this topic

#1 EMP714

EMP714

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 29 April 2011 - 11:56 PM

I'll try and be a descriptive as I can, so forgive me if I ramble.

About 5-6 days ago my Acer laptop begain acting a bit weird before I realized I had one of those dreaded fake antispyware programs. It was called Antimalware Doctor, and it really drove me nuts. I couldn't open/run ANYTHING without being in safe mode, and even then I got the blue screen of death countless times. I finally managed to get my com to work long enough to run my programs, AVG, Malwarebytes and Spyware Doctor. It seemed to do the trick, at first, but I continued to have crashes, webpage redirects(Especially through google), Blue Screens, and now Google Chrome doesn't load any pages whatsoever, it just opens and sits there.
I finally through my hands up and popped in my factory restoration cd. Unfortunately it didn't work. I tried reading up on the fake program, even followed the instructions to manually uninstall, but I couldn't find a single file mentioned in the instructions. Yesterday someone through Yahoo! Answers told me to try ComboFix, linking me to this site, and said it was something called a rootkit(I'm a tad bit computer-retarded). I also read that this ComboFix would usually delete the rootkits on the first run even without me doing anything, so I happily uninstalled AVG 2011, and disabled any other programs that would interfere, and ran it. I'm still getting some odd things however, Chrome still won't work, windows error messages pop up saying things have stopped working and has crashed, Spyware Doctor says it's smart updates won't work(may be unrelated?) and I get the occasional redirect.

So anyway, I hope someone can help. I also hope I described my problem enough, and posted in the correct place(I'm new). If needed I can post the ComboFix.txt.

Thanks in advance guys ^^

Edited by hamluis, 30 April 2011 - 11:33 AM.
Moved from Vista to Am I Infected.


BC AdBot (Login to Remove)

 


#2 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 01 May 2011 - 02:54 AM

Update: It's gotten worse. Now my computer goes to the blue screen and crashes constantly. I've been trying to fix it for an hour but as soon as the system restarts and the desktop loads BOOM blue screen. Honestly it comes up after 30-45 seconds even in safe mode. It's done it, I counted, 17 times in like 15 minutes.

#3 Computerproblem101

Computerproblem101

  • Members
  • 140 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 01 May 2011 - 10:42 AM

Combofix is a very dangerous tool that should only be run when you're being advised by professionals.

Go to Http://www.superantispyware.com - download it, update it, run the FULL scan. Remove every single infection detected and then reboot your PC & post the log here. - if it won't work, try doing this in Safe Mode With Networking

#4 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 01 May 2011 - 09:50 PM

Thanks Computerproblem101, I did what you said. I got the professional version of SAS, updated and ran it. Had to follow a guide to get installations to work in safe mode(with networking) since I get the BSOD as soon as the computer starts in normal mode.

Here's the Log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/01/2011 at 09:43 PM

Application Version : 4.33.1000

Core Rules Database Version : 6968
Trace Rules Database Version: 4780

Scan type : Complete Scan
Total Scan Time : 00:20:25

Memory items scanned : 369
Memory threats detected : 0
Registry items scanned : 6141
Registry threats detected : 0
File items scanned : 22152
File threats detected : 9

Adware.Tracking Cookie
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@bizzclick[2].txt
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[1].txt
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@ads.blogtalkradio[1].txt
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[2].txt
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@bs.serving-sys[1].txt
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@findology[1].txt
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@tribalfusion[2].txt
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@serving-sys[1].txt
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@cdn.jemamedia[2].txt



The laptop is still acting up however, constant BSOD, firefox redirects, and various windows error messages.

#5 Computerproblem101

Computerproblem101

  • Members
  • 140 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 01 May 2011 - 11:38 PM

Try another Quick Scan of Malwarebytes in normal mode.

#6 Computerproblem101

Computerproblem101

  • Members
  • 140 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 01 May 2011 - 11:39 PM

Try another Quick Scan of Malwarebytes in normal mode.

#7 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 02 May 2011 - 12:11 AM

I ran MBAM with a quick scan, but I had to do so in Safe Mode(with networking). Every time I start in normal mode I instantly get the BSOD. I've noticed too that when I try restarting/shutting down the computer it either freezes at the "Logging Off" screen, or shows it just before the BSOD. All the scans I run(AVG, MBAM, SAS, Spyware Doctor) Usually come up empty, or in the case of SAS it just finds "Adware.Tracking Cookie".

#8 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 02 May 2011 - 09:45 AM

I downloaded Spybot SAD as well, and it found a couple things but even after cleaning it didn't help.

#9 Mooseby

Mooseby

  • Members
  • 276 posts
  • OFFLINE
  •  
  • Local time:10:54 PM

Posted 02 May 2011 - 01:56 PM

Hi,
I am making this response as a member, not as a malware trainee,you say that you have your factory CD? Does that mean you have an OS installation disk? Do you have a Windows system?

Secondly retsart your machine and tap the F8 key, you should then get to a black and white screen that is the Advanced Startup Options, select the 'Disable auromatic restart on system failure' by using the arrow keys to move the highlight up and down, then press Enter and restart. This may be very important to getting your machine running again.

Now when you have the BSOD you will be able to write down the system error message.

A trained member of the MRT should be along soon to help you. Please use the notification thread at the top of the forum if it is more than three days.

#10 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 02 May 2011 - 08:55 PM

Thank you for your response Mooseby.

When I woke up today my computer had restarted itself, and luckily stayed in Normal mode long enough fr my scanners to auto scan. I was able to run AVG, SAS, MBAM and Spyware Doctor and each removed a number of infections. So far I have only had the BSOD one time, and the computer seems to be running well except for the occasional redirect. I did what you instructed, disabling the auto-restart, and on the next BSOD I'll take a photo and upload in case it will help.

#11 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 12 May 2011 - 01:17 PM

haven't had the BSOD since my last post, but my laptop is far from fixed. I'm getting redirects, pages not opening, random websites popping up in a new tab on FF, MBAM pops up every thirty seconds blocking malicious IP addresses, and now for some reason when I close my laptop and open it back up it's just a black screen forcing me to restart the computer.

#12 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 16 May 2011 - 05:00 PM

Got the blue screen for the first time in a while today. Managed to grab a pic of it with my ipod, so the quality might not be the best.

Posted Image

All the other problems still persist, if anyone could please help me out with this I'd be grateful.

#13 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:04:54 AM

Posted 21 May 2011 - 05:24 AM

Can you post the logs of the infections your scans in normal mode revealed?

#14 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 22 May 2011 - 02:09 AM

I didn't save them, I don't think, but the past few scans with everything found nothing.

I've been looking around, both here and other sites, and found a ton of people describing things similar to what I'm experiencing(redirects, odd tabs opening, bsod, ect.), but so far no one has a solution anywhere.

I've did a factory restore twice now and still I'm infected.

#15 EMP714

EMP714
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:54 PM

Posted 02 June 2011 - 09:04 AM

Over a month now and STILL infected. I'm now getting the blue screen regularly, I've had it 4 times in the past two hours since I woke up.

Here's an updated list of everything going wrong:

BSOD frequently, 10+ times a day
Can't close the laptop, when I reopen it it's just a black screen and I have to restart
Pressing CTRL+ALT+DEl, which usually opens the security options or whatever on vista, now either causes a blank screen or a BSOD
Cannot click Switch Users in the start bar for the same reasons as control alt delete
Redirects on every link clicked in a Google search
Computer has become MUCH slower and freezes frequently
Scans on MBAM, AVG 2011 and Super Anti Spyware find nothing but Spyware Doctor always finds at least one high level infection
AVG, while not finding anything in scans, usually pops up about various threats with the resident shield
May not be related, but over the past 4 days my WiFi goes in and out every few minutes




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users