Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Major Virus Problem  (Read 17092 times)

0 Members and 1 Guest are viewing this topic.

bluecountry

    Topic Starter


    Apprentice

    Thanked: 1
    Re: Major Virus Problem
    « Reply #15 on: April 25, 2011, 11:59:52 AM »
    So it is ok for me to go to the quarantine log and delete all those files?
    I thought deleting would put them back in circulation and risk PC damage.

    bluecountry

      Topic Starter


      Apprentice

      Thanked: 1
      Re: Major Virus Problem
      « Reply #16 on: April 25, 2011, 12:54:56 PM »
      OK here are my logs.

      I could not disable symantec.  It said if I didn't, I ran the risk of permanent PC damage.
      Am I ok?

      [recovering disk space - old attachment deleted by admin]

      SuperDave

      • Malware Removal Specialist


      • Genius
      • Thanked: 1020
      • Certifications: List
      • Experience: Expert
      • OS: Windows 10
      Re: Major Virus Problem
      « Reply #17 on: April 25, 2011, 01:45:06 PM »
      I strongly recommend that you remove Ask from your computer because it;

      •Promotes its toolbars on sites targeted to kids.

      •Promotes its toolbars through ads that appear to be part of other companies' sites.

      •Promotes its toolbars through other companies' spyware.

      •Installs without any disclosure whatsoever and without any consent whatsoever.

      •Solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.

      •Makes confusing changes to users' browsers -- increasing Ask's revenues while taking users to pages they didn't intend to visit.

      See Here for more info.

      If you choose to follow my recommendation then please go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

      AskBarDis or anything related to Ask

      Then please find and delete this folder in bold (if present):
      C:\Program Files\AskBarDis. or anything related to Ask.
      ****************************************************
      You have Viewpoint installed.

      Viewpoint Media Player/Manager/Toolbar is considered as Foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad".

      More information:

      * ViewMgr.exe - Useless
      * Viewpoint to Plunge Into Adware

      It is suggested to remove the program now. Go to Start > Control Panel > Add/Remove Programs - (Vista & Win7 is Programs and Features) and remove the following programs if present.

      * Viewpoint
      * Viewpoint Manager
      * Viewpoint Media Player
      * Viewpoint Toolbar
      * Viewpoint Experience Technology

      *****************************************
      SysProt Antirootkit

      Download
      SysProt Antirootkit from the link below (you will find it at the bottom
      of the page under attachments, or you can get it from one of the
      mirrors).

      http://sites.google.com/site/sysprotantirootkit/

      Unzip it into a folder on your desktop.
      • Double click Sysprot.exe to start the program.
      • Click on the Log tab.
      • In the Write to log box select the following items.
        • Process << Selected
        • Kernel Modules << Selected
        • SSDT << Selected
        • Kernel Hooks << Selected
        • IRP Hooks << NOT Selected
        • Ports << NOT Selected
        • Hidden Files << Selected
      • At the bottom of the page
        • Hidden Objects Only << Selected
      • Click on the Create Log button on the bottom right.
      • After a few seconds a new window should appear.
      • Select Scan Root Drive. Click on the Start button.
      • When it is complete a new window will appear to indicate that the scan is finished.
      • The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.
      Windows 8 and Windows 10 dual boot with two SSD's

      bluecountry

        Topic Starter


        Apprentice

        Thanked: 1
        Re: Major Virus Problem
        « Reply #18 on: April 25, 2011, 04:35:22 PM »
        1)  Did not have any ask programs under add/remove programs BUT
        -did have ask folder under program files, deleted.

        2) Had viewpoint media player under add/remove programs and uninstalled

        3) Downloaded SysProt...followed instructions.
        Was told: Failed to start service.  SysProt AntiRootkit needs to be run with admin privilages.
        Had ok button to click.

        Before clicking it, saw on my desktop a log file was created.

        Hit ok...then was able to scan...this is the only log I found.


        4) Should I delete hijack this/combofix/sysprot now?


        [recovering disk space - old attachment deleted by admin]

        bluecountry

          Topic Starter


          Apprentice

          Thanked: 1
          Re: Major Virus Problem
          « Reply #19 on: April 25, 2011, 04:36:36 PM »
          It's jammed, the sysprot page is staying open, can't close it!
          Why?
          Had to restart PC.

          SuperDave

          • Malware Removal Specialist


          • Genius
          • Thanked: 1020
          • Certifications: List
          • Experience: Expert
          • OS: Windows 10
          Re: Major Virus Problem
          « Reply #20 on: April 25, 2011, 05:38:43 PM »
          Quote
          Should I delete hijack this/combofix/sysprot now?
          You can uninstall HJT. We'll clean up the rest afterwards.

          Please download Rooter and Save it to your desktop.
          • Double click it to start the tool.Vista and Windows7 run as administrator.
          • Click Scan.
          • Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.
          Windows 8 and Windows 10 dual boot with two SSD's

          bluecountry

            Topic Starter


            Apprentice

            Thanked: 1
            Re: Major Virus Problem
            « Reply #21 on: April 26, 2011, 12:31:35 PM »
            Thank you.

            OK so..

            1) Downloaded, ran, and posted rooter log

            2) Deleted hijack this

            3) Question:
            -Aside from hijack this, should I delete rooter/combofix/spsprot (and if so for sysprot...how as I do not see it listed under "programs.")

            4) Question 2:
            -For the files in quarantine in symantec, should I just delete them/purge (this will not cause issues) or leave them as is?
            Thanks.

            [recovering disk space - old attachment deleted by admin]

            SuperDave

            • Malware Removal Specialist


            • Genius
            • Thanked: 1020
            • Certifications: List
            • Experience: Expert
            • OS: Windows 10
            Re: Major Virus Problem
            « Reply #22 on: April 26, 2011, 01:03:31 PM »
            Quote
            Aside from hijack this, should I delete rooter/combofix/spsprot (and if so for sysprot...how as I do not see it listed under "programs.")

            4) Question 2:
            -For the files in quarantine in symantec, should I just delete them/purge (this will not cause issues) or leave them as is?
            You should never delete programs; you should uninstall them. We will deal with the other tools later when I'm satisfied your computer is clean. As for the files in symantec, you can purge them, if you wish. They're harmless in quarantine.

            I'd like to scan your machine with ESET OnlineScan

            •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
            ESET OnlineScan
            •Click the button.
            •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
            • Click on to download the ESET Smart Installer. Save it to your desktop.
            • Double click on the icon on your desktop.
            •Check
            •Click the button.
            •Accept any security warnings from your browser.
            •Check
            •Push the Start button.
            •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
            •When the scan completes, push
            •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
            •Push the button.
            •Push
            A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
            Windows 8 and Windows 10 dual boot with two SSD's

            bluecountry

              Topic Starter


              Apprentice

              Thanked: 1
              Re: Major Virus Problem
              « Reply #23 on: April 27, 2011, 12:00:16 PM »
              I have no purge option...I have a delete option.  I can delete all the files from quarantine with no harm?  If so, I will.

              bluecountry

                Topic Starter


                Apprentice

                Thanked: 1
                Re: Major Virus Problem
                « Reply #24 on: April 27, 2011, 01:53:31 PM »
                Scan was run, log posted...should I delete and remove ESET?

                [recovering disk space - old attachment deleted by admin]

                SuperDave

                • Malware Removal Specialist


                • Genius
                • Thanked: 1020
                • Certifications: List
                • Experience: Expert
                • OS: Windows 10
                Re: Major Virus Problem
                « Reply #25 on: April 27, 2011, 05:21:14 PM »
                Quote
                I can delete all the files from quarantine with no harm?  If so, I will
                Yes.
                Quote
                should I delete and remove ESET?
                As you can see from the ESET scan the one file infected was from a P2P site. I hope that you uninstalled Limewire.
                If there are no other issues, let's do some cleanup.

                To uninstall ComboFix

                • Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
                • In the field, type in ComboFix /uninstall


                (Note: Make sure there's a space between the word ComboFix and the forward-slash.)

                • Then, press Enter, or click OK.
                • This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
                *********************************************
                Clean out your temporary internet files and temp files.

                Download TFC by OldTimer to your desktop.

                Double-click TFC.exe to run it.

                Note: If you are running on Vista, right-click on the file and choose Run As Administrator

                TFC will close all programs when run, so make sure you have saved all your work before you begin.

                * Click the Start button to begin the cleaning process.
                * Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
                * Please let TFC run uninterrupted until it is finished.

                Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
                ***********************************************
                Looking over your log it seems you don't have any evidence of a third party firewall.

                Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

                Remember only install ONE firewall

                1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
                2) Online Armor
                3) Agnitum Outpost
                4) PC Tools Firewall Plus

                If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
                ******************************************
                Use the Secunia Software Inspector to check for out of date software.

                •Click Start Now

                •Check the box next to Enable thorough system inspection.

                •Click Start

                •Allow the scan to finish and scroll down to see if any updates are needed.
                •Update anything listed.
                .
                ----------

                Go to Microsoft Windows Update and get all critical updates.

                ----------

                I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

                SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
                * Using SpywareBlaster to protect your computer from Spyware and Malware
                * If you don't know what ActiveX controls are, see here

                Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

                Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

                Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
                Safe Surfing!
                Windows 8 and Windows 10 dual boot with two SSD's

                bluecountry

                  Topic Starter


                  Apprentice

                  Thanked: 1
                  Re: Major Virus Problem
                  « Reply #26 on: April 29, 2011, 03:44:44 PM »
                  Thanks!


                  1)  So my PC should be all clean and safe now?
                  2)  Confused about the firewall.
                  -I downloaded COMODO (and I excluded geek buddy....and checked off for optimum proactive defense and secure DNS servers)
                  -BUT...I soon got an alert that my windows firewall was turned off.  I turned it on...then uninstalled comodo...so I guess windows firewall is all I need?

                  Also...for some reason...since I turned on windows firewall, PC has run slower...why?  Cause-effect?

                  3) Should I delete/uninstall eset, rooter, and tfc (which I ran and completed)?
                  4) Spywareblaster and spybot search and destroy....I do not use windows explorer (mostly firefox)...plus I have Superanti-spyware AND Malwarebytes Anti-Malware.  Do I really need these two in this case?  Was thinking this would be too many programs and would slow down PC.

                  SuperDave

                  • Malware Removal Specialist


                  • Genius
                  • Thanked: 1020
                  • Certifications: List
                  • Experience: Expert
                  • OS: Windows 10
                  Re: Major Virus Problem
                  « Reply #27 on: April 30, 2011, 05:10:11 PM »
                  Quote
                  So my PC should be all clean and safe now?
                  Yes.
                  Quote
                  BUT...I soon got an alert that my windows firewall was turned off.  I turned it on...then uninstalled comodo...so I guess windows firewall is all I need?
                  Yes, that's normal because Windows doesn't recognize third-party firewalls. The Windows firewall is not much good because it doesn't block out-going traffic which is the most dangerous.
                  Quote
                  Also...for some reason...since I turned on windows firewall, PC has run slower...why?  Cause-effect?
                  Unknown but you should go back to Comodo for the extra safety.
                  Quote
                  Should I delete/uninstall eset, rooter, and tfc (which I ran and completed)?
                  Yes. Any tools that were not removed can be removed by yourself.
                  Quote
                  Spywareblaster and spybot search and destroy....I do not use windows explorer (mostly firefox)...plus I have Superanti-spyware AND Malwarebytes Anti-Malware.  Do I really need these two in this case?  Was thinking this would be too many programs and would slow down PC.
                  It's up to you. If you don't want them, don't install them. Either way then shouldn't slow down your computer. I run all of them with no problem on XP. They will take up hardrive space so if that's a problem for you, don't install them. SAS and MBAM are not full-time scanners unless you have the paid-for versions. You have to run the scans yourself about every week or so.
                  Windows 8 and Windows 10 dual boot with two SSD's

                  bluecountry

                    Topic Starter


                    Apprentice

                    Thanked: 1
                    Re: Major Virus Problem
                    « Reply #28 on: May 01, 2011, 11:22:52 PM »
                    Thanks Dave!

                    1)  So I guess I should install Comodo...should I then also disable the windows firewall?

                    2)  Ran secunia and installed everything.
                    One problem.

                    They told me I had an outdated product:
                    Quote
                    Macromedia Flash Player 7.x   Macromedia Flash Player 7.x   7.0.19.0 (ActiveX)   Macromedia Flash Player 7.x
                       
                    This installation of Macromedia Flash Player 7.x is insecure and potentially exposes your system to security threats!

                    The detected version installed on your system is 7.0.19.0 (ActiveX), however, the latest patched version released by the vendor, fixing one or more vulnerabilities, is 10.x (ActiveX).

                    I have downloaded the new one from their link a few times, and yet when I re-run it they continue to flag me as having the old installed.
                    Why?


                    I also am told:

                    Quote
                    Installed on Your System in:
                    C:\Program Files\Google\Chrome\Application\10.0.648.205\nacl64.dll
                       Google Chrome 10.x   Google Chrome 10.x   10.0.648.205   Google Chrome 10.x
                       
                    This installation of Google Chrome 10.x is insecure and potentially exposes your system to security threats!

                    The detected version installed on your system is 10.0.648.205, however, the latest patched version released by the vendor, fixing one or more vulnerabilities, is 11.x.

                    Update Instructions:
                    Download

                    and
                    Quote
                    Mozilla Firefox 3.6.x   Mozilla Firefox 3.6.x   3.6.16   Mozilla Firefox 3.6.x
                       
                    This installation of Mozilla Firefox 3.6.x is insecure and potentially exposes your system to security threats!

                    The detected version installed on your system is 3.6.16, however, the latest patched version released by the vendor, fixing one or more vulnerabilities, is 3.6.17.

                    Update Instructions:
                    Download


                    Installed on Your System in:
                    C:\Windows\ERDNT\cache\firefox.exe

                    Again, in both cases I already installed what they said.
                    Why is it doing saying I still need a re-do?

                    SuperDave

                    • Malware Removal Specialist


                    • Genius
                    • Thanked: 1020
                    • Certifications: List
                    • Experience: Expert
                    • OS: Windows 10
                    Re: Major Virus Problem
                    « Reply #29 on: May 02, 2011, 01:10:20 PM »
                    Quote
                    So I guess I should install Comodo...should I then also disable the windows firewall?
                    Yes to both questions.
                    Quote
                    I have downloaded the new one from their link a few times, and yet when I re-run it they continue to flag me as having the old installed.
                    Why?
                    Secunia is probably not kept up-to-date. The most important thing here is to make sure your programs are kept up-to-date.
                    Windows 8 and Windows 10 dual boot with two SSD's