Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I believe that I am infected....Please help!


  • Please log in to reply
3 replies to this topic

#1 bigjimoo

bigjimoo

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:11:46 AM

Posted 30 July 2013 - 07:11 PM

The computer that i use for my home business is running incredibly slow, freezing, and will not run malwarebytes without freezing but when it freezes it shows threats. I need some help from someone that will be able to help me pinpoint the problem and eliminate it. Thanks in advance, hope someone can help.



BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,140 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:46 PM

Posted 30 July 2013 - 07:42 PM

Please download RKill by Grinler and save it to your desktop.
There will be a list of RKill download links using different file extensions and renamed versions. Read the comments which explains why they are offered. The iExplore.exe version is generally more effective but you may want to download more than one version before proceeding.
  • Temporarily disable your anti-virus before performing a scan so it will not interfere with running RKill or falsely detect is as a threat.
  • Double-click on the Rkill desktop icon to run the tool.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, and try another version.
  • If it still does not work, repeat the process and attempt to use one of the remaining version until the tool runs.
  • Note: You may have to make repeated attempts to use RKill several times before it will run as some malware variants try to block it.
  • A log file will be created and saved to the root directory, C:\RKill.log
  • Copy and paste the contents of RKill.log in your next reply.
-- Some security tools may flag RKill as malware, especially when renamed to iexplore.exe, explorer.exe, winlogon.exe, etc because they have definitions in place that flag certain file names used outside their normal path. If you encounter such an alert when running Rkill, you can safely ignore it and continue to allow the program to run.

Important: Do not reboot your computer until you complete the next step.

Now try performing a Quick Scan in normal mode with Malwarebytes' Anti-Malware and check all items found for removal. Don't forgot to check for database definition updates through the program's interface (preferable method) before scanning and to reboot afterwards. Failure to reboot normally will prevent Malwarebytes' from removing all the malware. When done, click the Logs tab and copy/paste the contents of the new report in your next reply.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 bigjimoo

bigjimoo
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:11:46 AM

Posted 31 July 2013 - 01:24 PM

Here is the rkill log:

 

Rkill 2.5.7 by Lawrence Abrams (Grinler)
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
 
Program started at: 07/31/2013 01:00:07 PM in x86 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
 
Checking for Windows services to stop:
 
 * CltMngSvc Stopped. [Win32/Conduit.SearchProtect.B]
 
1 service stopped!
 
Checking for processes to terminate:
 
 * C:\Users\Parent\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe (PID: 1728) [UP-HEUR]
 * C:\Windows\ModLEDKey.exe (PID: 3472) [WD-HEUR]
 * C:\Windows\CNYHKey.exe (PID: 2648) [WD-HEUR]
 * C:\Users\Parent\AppData\Roaming\SearchProtect\bin\cltmng.exe (PID: 5452) [Win32/Conduit.SearchProtect.B]
 
4 proccesses terminated!
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * Windows Defender Disabled
 
   [HKLM\SOFTWARE\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001
 
 * ALERT: ZEROACCESS rootkit symptoms found!
 
     * C:\Users\Parent\AppData\Local\{db78c3dc-72a9-514c-cd25-3b02b20ab8aa}\ [ZA Dir]
     * C:\Users\Parent\AppData\Local\{db78c3dc-72a9-514c-cd25-3b02b20ab8aa}\@ [ZA File]
     * C:\Users\Parent\AppData\Local\{db78c3dc-72a9-514c-cd25-3b02b20ab8aa}\L\ [ZA Dir]
     * C:\Users\Parent\AppData\Local\{db78c3dc-72a9-514c-cd25-3b02b20ab8aa}\U\ [ZA Dir]

 

Here is the malwarebytes log:

 

2013/07/31 13:03:50 -0400 IQ-K12-DESKTOP Parent MESSAGE Starting database refresh
2013/07/31 13:04:27 -0400 IQ-K12-DESKTOP Parent MESSAGE Database refreshed successfully


#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,140 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:46 PM

Posted 31 July 2013 - 01:51 PM

You have a serious malware infection - * ALERT: ZEROACCESS rootkit symptoms found!

Disinfection will probably require the use of more powerful tools than we recommend in this forum. Before that can be done you will need to create and post a DDS log for further investigation.

Please follow the instructions in the Malware Removal and Log Section Preparation Guide starting at Step 6.
  • If you cannot complete a step, then skip it and continue with the next.
  • In Step 6 there are instructions for downloading and running DDS which will create two logs.
When you have done that, post your logs in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team.

Start a new topic, give it a relevant title and post your log(s) along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. If you cannot produce any of the required logs, then still start the new topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happened when you tried to create them. A member of the Malware Removal Team will walk you through, step by step, on how to clean your computer.

After doing this, it would be helpful if you replied back in this thread with a link to the new topic so we can closed this one. Good luck and be patient.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users