Posted 23 May 2011 - 12:34 AM
few days ago (on May 19 around 12:30am) I was watching a movie online when suddenly a pop-up window opened asking me if I wanted to install Antimalware Doctor. I just clicked on the red "X" on the top right of this pop-up window to close it.
It closed down, however, after a short time I got some message telling me that the installation was successful and this program started running a (fake) scan. I immediately unplugged the power for my laptop (that had no battery) to shut it down. After the computer was off, I unplugged the cable connecting it to the internet and tried to turn it on.
It turned on fine. However on my desktop there was the yellow icon of a shortcut to this Antimalware Doctor. Apparently, no other issues....No pop-ups stating that my computer is under attack. No pop-ups claiming I have thousands of viruses on my laptop. Nothing. Just this new icon.
However, both my McAfee Antivirus and the Microsoft Security Essentials had the Realtime Protection feature turned off and it was impossible to turn it on.
I checked where was the location of this Antimalware Doctor file connected to the shortcut on my desktop and I erased it. I also ran a full scan with McAfee and Essentials, but they found nothing. I thought that maybe when I unplugged the powercord of my laptop (shutting it down) I might have interrupted some action that this malware was performing and for some reason, I thought that maybe I could resolve the issue with a System Restore. I found a restore point at 11:49pm on May 18 -- 45 minutes before this issue appeared first-- and I used it.
When it rebooted, it told me that there was some issue with some Windows files. I cannot remember the precise statement. There were two options: either try to repair the issue, or let it be. I tried several times to use the auto-repair option. Unfortunately, the computer was somehow not accepting this answer from me. So I had to click on the other option. After it turned on, a window appeared telling me that the system restore was successful.
Still, I could not turn on the Real-Time feature of McAfee and MS Essentials
Hence, I downloaded Antimalwarebytes Anti-Malware on a USB drive and installed on my computer after I rebooted it on Safe Mode.
This antimalware found
i) an infected registry file HKEY_CURRENT USER_ bla bla bla, that I quarantined and deleted;
ii) some other harmless file that I downloaded personally and is not connected to malware. However, just to be safe, I quarantined and deleted it as well.
I then rebooted by computer and made it start normally.
However, few minutes after logging in, a BSOD appeared and my computer rebooted again. The blue screen seems to complain about my ATAPORT.SYS file.
Now my situation is the following:
1) Every time I start my laptop normally, I get a BSOD restarting my computer, complaining about the ATAPORT.SYS file.
2) My McAfee and MS Essentials have the real time protection turned off and I cannot change it.
3) I can turn on and off Windows Defender Real-Time protection, however it does not help me with 2)
4) Antimalwarebytes Antimalware does not find any issue on my computer (I always run it in Safe Mode).
5) There is a MsMpEng.exe process that is always present in the process list of the Task Manager, even in Safe Mode (independently if Windows Defender is turned on/off).
When I try to kill this process, this process resurrects after few seconds. If I kill it a second time, it resurrects again after few seconds. After I kill the third time, it does not show up anymore. However, even after that I cannot turn on Real-Time Protection for my antiviruses.
6) I never got (and still do not get) any request of purchasing the Antimalware Doctor. No pop-ups of any kind from it either.
I did not try going on the web anymore.
I would really really appreciate any help that you might give me.