Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Vista Antivirus 2012


  • Please log in to reply
11 replies to this topic

#1 phoenix0401

phoenix0401

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:59 AM

Posted 05 December 2011 - 09:41 AM

Hi,

Last night (Actually early this morning), Kaspersky gave me red error messages about two programs. Immediately afterwards Vista Antivirus 2012 popped up and told me that I had all kinds of wicked, bad, evil viruses on my computer. When I realized it was blocking my internet access, I used my laptop to find your site and this article: http://www.bleepingcomputer.com/virus-removal/remove-win-7-antispyware-2012

I ran through the instructions and everything seemed to work. Rkill got rid of 2 files for me, but I didn't copy the log because I didn't think it was important. I can't find it now to post here -- if someone tells me where the log is I'll be more than happy to post it.

Anyway, I get to the MBAM section, and after running all night, it tells me that there are no problems. Does that mean that I got it before it spread, or is there more out there that needs to be done to get rid of this thing?

Thanks.

Edited by phoenix0401, 05 December 2011 - 09:42 AM.


BC AdBot (Login to Remove)

 


#2 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:12:59 PM

Posted 05 December 2011 - 11:32 AM

I work on virus infected computers

Even after mbam removing this trojan ,i could find it popping up

I found out that it was located in Appdata/local folder

You can find a exe file and a system file

example:dhf.exe and vsfsfggskg

You may need to check show hidden files and uncheck hide OS files

It should be visible now

Delete both of them and run exe registry fix

This is how i was able to remove it

Senior BC members may help you

Thanks

#3 phoenix0401

phoenix0401
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:59 AM

Posted 06 December 2011 - 06:41 PM

It's still very much around. Despite multiple programs telling me there were no issues (Kaspersky PURE 2011, Malwarebytes, Spybot S&D), it just re-installed itself. I really could use a hand with this.

Thanks

#4 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:05:59 PM

Posted 12 December 2011 - 12:00 PM

have you tried running Malwarebytes in safe mode?

#5 phoenix0401

phoenix0401
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:59 AM

Posted 12 December 2011 - 11:28 PM

Okay, so I happened to run it this morning -- before you replied -- because the problems were unbearable, and it actually caught 2 somethings. Then I ran it in Safe Mode when I got home and -- perhaps not surprisingly -- nothing. I've also attached the run from directly after the initial infection to show you that I'm not crazy.

I'm kind of concerned that there was nothing, then it re-installed itself, then something pops up. Anywhere else I should check to be sure it's really gone? (The computer is acting better -- but still having issues. Like locking up briefly when I try to type an address in Firefox.)

Thanks


Log after infection:


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8314

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19154

12/5/2011 6:29:53 AM
mbam-log-2011-12-05 (06-29-53).txt

Scan type: Full scan (C:\|D:\|F:\|)
Objects scanned: 382050
Time elapsed: 5 hour(s), 1 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Log this morning:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8357

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19154

12/12/2011 8:50:10 PM
mbam-log-2011-12-12 (20-50-10).txt

Scan type: Full scan (C:\|)
Objects scanned: 369978
Time elapsed: 2 hour(s), 4 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AH (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CLASSES_ROOT\ah\Content Type (Rogue.MultipleAV) -> Value: Content Type -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Log in safe mode:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8357

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.19154

12/12/2011 9:53:17 PM
mbam-log-2011-12-12 (21-53-17).txt

Scan type: Full scan (C:\|)
Objects scanned: 368717
Time elapsed: 56 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#6 phoenix0401

phoenix0401
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:59 AM

Posted 13 December 2011 - 10:24 PM

And it just reinstalled itself.

#7 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:05:59 PM

Posted 13 December 2011 - 10:30 PM

Download and run TDSSKiller and post the log. If it asks you to fix anything, then please DO NOT FIX ANYTHING.

#8 phoenix0401

phoenix0401
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:59 AM

Posted 13 December 2011 - 11:22 PM

In the process of wiping and rebuilding the hard disk, so ignore me.

#9 phoenix0401

phoenix0401
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:59 AM

Posted 13 December 2011 - 11:24 PM

Just saw that message. Thanks a lot for trying.

#10 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:05:59 PM

Posted 13 December 2011 - 11:25 PM

So what happened?

#11 phoenix0401

phoenix0401
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:11:59 AM

Posted 14 December 2011 - 12:09 AM

I need the computer working for work and decided that biting the bullet and reinstalling would get it up faster. Sorry for wasting your time.

#12 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:05:59 PM

Posted 14 December 2011 - 12:25 AM

Hey no biggie




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users