Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Am I infected


  • Please log in to reply
21 replies to this topic

#1 kile32

kile32

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:08:25 AM

Posted 04 June 2011 - 07:39 PM

I am new to this site and this is my 1st post. I have just been infected by this virus. Is this a new virus? I am constantly getting pop ups Of Hard Drive failure. All of my files are gone, my desktop icons are gone, and my quick links as well. I read about the malwarebytes and downloaded that to run a complete scan. So far I have 47 objects infected. I desperately need help. I have no experience or education in the computer world so please bare with me.

BC AdBot (Login to Remove)

 


#2 katemart

katemart

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 04 June 2011 - 07:45 PM

Hi Kile32

I am first-time poster, too, but just wanted to say that you are describing exactly what has been happening to me! I posted my problems a few minutes before you. I'm sure that it is a virus and not a hard drive problem at all, so I am hopeful that someone will be able to help us.

Take care

Kate

#3 kile32

kile32
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:08:25 AM

Posted 04 June 2011 - 07:48 PM

Thanks Kate. I hope that you can resolve your problem as well. This is very frustrating, sad, and scary all in one emotion. I feel so helpless.

#4 kile32

kile32
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:08:25 AM

Posted 04 June 2011 - 08:59 PM

Here was my transcript log from Malwarebytes:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6773

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19048

6/4/2011 8:57:59 PM
mbam-log-2011-06-04 (20-57-59).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 299170
Time elapsed: 1 hour(s), 55 minute(s), 46 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 44
Registry Values Infected: 10
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
c:\programdata\sqoxnmcuxyw.exe (Trojan.FakeMS) -> 1392 -> Unloaded process successfully.
c:\programdata\31317752.exe (Trojan.FakeMS) -> 2456 -> Failed to unload process.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ScreenSaverControl.ScreenSaverInstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ScreenSaverControl.ScreenSaverInstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyWebSearchService (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sqoXnmCuXYw (Trojan.FakeMS) -> Value: sqoXnmCuXYw -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Value: {07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Value: {07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Value: {00A6FAF6-072E-44CF-8957-5838F569A31D} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Value: {07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> Value: {00A6FAF6-072E-44cf-8957-5838F569A31D} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Value: {07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Value: (default) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Value: f3PopularScreensavers -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Value: FunWebProducts -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\sqoxnmcuxyw.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\programdata\31317752.exe (Trojan.FakeMS) -> Delete on reboot.
c:\program files\windows live\messenger\msimg32.dll (PUP.FunWebProducts) -> Not selected for removal.
c:\program files\windows live\messenger\riched20.dll (PUP.FunWebProducts) -> Not selected for removal.
c:\program files\mozilla firefox\plugins\NPMyWebS.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Windows\System32\f3PSSavr.scr (PUP.FunWebProducts) -> Not selected for removal.

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:10:25 AM

Posted 04 June 2011 - 09:31 PM

Hello, I moved this from Vista to the Am I Infcted forum..

Reboot into Safe Mode with Networking
How to enter safe mode(XP/Vista)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode with Networking using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.


>>>> Download this file and doubleclick on it to run it. Allow the information to be merged with the registry.

RKill....

Download and Run RKill
  • Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

    Link 1
    Link 2
    Link 3
    Link 4

  • Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  • Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • If nothing happens or if the tool does not run, please let me know in your next reply

Do not reboot your computer after running rkill as the malware programs will start again. Or if rebooting is required run it again.


If you continue having problems running rkill.com, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.



Next run Superantisypware (SAS):

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

Please ask any needed questions,post logs and Let us know how the PC is running now.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 kile32

kile32
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:08:25 AM

Posted 05 June 2011 - 12:15 AM

I still don't have anything come up in the Start menu, my wallpaper is still missing, my quicklink shortcuts are missing, and there is a desktop shortcut for the Windows Vista Recover virus.


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/04/2011 at 11:39 PM

Application Version : 4.53.1000

Core Rules Database Version : 7202
Trace Rules Database Version: 5014

Scan type : Complete Scan
Total Scan Time : 01:33:13

Memory items scanned : 324
Memory threats detected : 0
Registry items scanned : 9433
Registry threats detected : 42
File items scanned : 141022
File threats detected : 37

Adware.MyWebSearch
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}

Adware.Tracking Cookie
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\kile@doubleclick[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\kile@collective-media[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\kile@ads.bleepingcomputer[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@2o7[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@ad.wsod[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@ad.yieldmanager[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@adinterax[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@ads.bleepingcomputer[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@ads.pgatour[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@ads.pointroll[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@adserver.adtechus[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@advertising[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@adxpose[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@atdmt[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@bs.serving-sys[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@collective-media[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@content.yieldmanager[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@content.yieldmanager[3].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@dc.tremormedia[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@doubleclick[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@imrworldwide[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@insightexpressai[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@invitemedia[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@kontera[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@lucidmedia[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@media6degrees[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@pointroll[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@questionmarket[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@segment-pixel.invitemedia[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@serving-sys[1].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@solvemedia[2].txt
C:\Users\Kile\AppData\Roaming\Microsoft\Windows\Cookies\Low\kile@yieldmanager[1].txt

Adware.MyWebSearch/FunWebProducts
HKU\S-1-5-21-772701544-923323414-669561224-1000\SOFTWARE\FunWebProducts
HKU\.DEFAULT\SOFTWARE\MyWebSearch
HKU\S-1-5-18\SOFTWARE\MyWebSearch
HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}
HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\ProxyStubClsid
HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\ProxyStubClsid32
HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\TypeLib
HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\TypeLib#Version
HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\ProxyStubClsid
HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\ProxyStubClsid32
HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\TypeLib
HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\TypeLib#Version
HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}
HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\ProxyStubClsid
HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\ProxyStubClsid32
HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\TypeLib
HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\TypeLib#Version
HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\ProxyStubClsid
HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\ProxyStubClsid32
HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\TypeLib
HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\TypeLib#Version
HKCR\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}
HKCR\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}\ProxyStubClsid
HKCR\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}\ProxyStubClsid32
HKCR\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}\TypeLib
HKCR\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}\TypeLib#Version
C:\Windows\SYSTEM32\F3PSSAVR.SCR
C:\PROGRAM FILES\WINDOWS LIVE\MESSENGER\MSIMG32.DLL
C:\PROGRAM FILES\WINDOWS LIVE\MESSENGER\RICHED20.DLL

Trojan.Agent/Gen-IExplorer[Fake]
C:\USERS\KILE\APPDATA\LOCAL\TEMP\RARSFX0\NIRD\IEXPLORE.EXE

Trojan.Agent/Gen-PEC
C:\USERS\KILE\APPDATA\LOCAL\TEMP\RARSFX0\PROCS\EXPLORER.EXE

#7 kile32

kile32
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:08:25 AM

Posted 05 June 2011 - 01:59 AM

results of Malwarebyte (2nd time):

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6773

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19048

6/5/2011 12:25:56 AM
mbam-log-2011-06-05 (00-25-56).txt

Scan type: Quick scan
Objects scanned: 155312
Time elapsed: 7 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

#8 kile32

kile32
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:08:25 AM

Posted 05 June 2011 - 02:19 AM

well, after doing everything you asked, these are the results:

According to malwarebyte and antispyware, my PC is completed clean.

However, I still do not show any icons when I click on the start menu, my screen saver is still not back and I still show a desktop icon for the original Vista Recovery virus that affected my computer.

What do you suggest?

#9 Tall_King_Rubbish

Tall_King_Rubbish

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 June 2011 - 05:18 AM

Windows Xp SP3 Pro: On start up - black desktop background, only My Computer & Recycle bin on desktop

No Programs listed in Start - Program Files etc...

On exploring my computer's hard drive 160gb split as 2 x 80gb C & D drives - C drive properties shows correct amount of used/free space but on double clicking C drive nothing appears as if it's empty ????
D drive displays all correct info & files on there btw

Various waring mesages appear saying my hard drive is failing - delayed write failure and "win xp protection" running scans etc........
(A miracle xp started if the HD was dying, give away is the "private data at risk" note plus CTRL ALT DEL has been diasbled by administrator - registry edited)

Reboot into safe mode - still no display of programs or c drive contents - luckily AVG is running in background and run a scan - funny it scans all files on c drive that is supposed to be empty - still amazing how Windows boots up on an empty failing HD

pop up windows everywhere about the xp recovery scanner, IDE/SATA HD failing private data at risk etc...

Think what is behind all this is you to pay for this scan recovery program to get your pc back up n running whilst they now have your credit card details and go on a lovely spending spree - or at very least forced to buy some 2nd rate virus program to remove their own infection

AVG doesn't find anything at all - however to get my pc back I rebooted into safe mode F8 and ran RESTORE to restore my pc back to say 4 days ago 1st June 2011

dunno if this program kicks in at certain time or date but it was early hours of 4th / 5th June when PC went pear shape

Windows Restore is a kind of work around for now but no doubt this new threat will return and become very widespread very very soon

#10 NeilUK

NeilUK

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 June 2011 - 05:59 AM

Hey guys,

I was hit by this about an hour ago. I was literally on NFL.com and i started getting messages saying my hard drive had failed etc. and then the whole thing shut down, restarted and everything was missing.

I downloaded malware bytes, and it's performing a quick scan at the moment. I will try to follow the procedure up top and hopefully it will work :( not good! Got exam next week and I need the laptop to work off!

#11 Tall_King_Rubbish

Tall_King_Rubbish

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 June 2011 - 06:40 AM

Using AVG Free 9.0 but failed to find anything wrong with pc - bit odd normally it says about some tracking cookies etc......

after the restore point I said check for updates even though it said database was 4th June '11

came up with unknown error when trying to check for updates ????

Open AVG - Tools - Advanced AVG Settings

Under Update - Manage

Update Management - click on "Delete temporary update files"

then it should update to newer database - 5th June '11



Running a full scan atm - everything checked even archives etc....

finding lots of stuff - mostly tracking cookies but 12 infections healed / deleted

still not sure if this a proper fix, other pc/laptop seems to be ok atm and the AVG update went ok with no error


hmmmm..... we shall see how things go but gonna go careful on other pc for moment
(no online transactions / paypal / credit card or banking etc....)

sod pc's - if it still plays up I got a Ghost image of how it was about 9 months ago but that is last resort and may still get this problem anyway until it is fixed properly

poxy computers

#12 Tall_King_Rubbish

Tall_King_Rubbish

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 June 2011 - 07:09 AM

Just seen this and is the same stuff we seem to be suffering from:

http://www.bleepingcomputer.com/virus-removal/remove-windows-7-recovery

gonna have a read on this later

#13 NeilUK

NeilUK

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:02:25 PM

Posted 05 June 2011 - 07:55 AM

I have managed to get quite a few of my desktop icons back, and get rid of the annoying pop ups that Windows vista recovery was giving me. I still have no quickstart icons or any icons when you press the start button in the bottom left. Any ideas guys? Alot of my documents have been corrupted too

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:10:25 AM

Posted 05 June 2011 - 10:26 AM

his infection family will also hide all the files on your computer from being seen. To make your files visible again, please download the following program to your desktop:

Unhide.exe


Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 kile32

kile32
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:08:25 AM

Posted 05 June 2011 - 10:39 AM

Boopme- can you get back to my issue? I did everything you mentioned and I am not 100% back to normal. Do you have any suggestions. And guys, start your own thread. That is what I was told to do. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users