Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Previously unseen anti-virus infection  (Read 10882 times)

0 Members and 1 Guest are viewing this topic.

Zen_Sorcere

    Topic Starter


    Rookie

    Previously unseen anti-virus infection
    « on: November 29, 2009, 03:44:50 AM »
    So I was checking my usual round of websites before going to bed, and when I went to the www.seattlepi.com website, a pop-up advertisement appeared in the middle of the page, but had no "close" or "skip ad" button. I accidentally clicked the ad, and it was apparently for tickets to something, as the page it took me to had a stadium diagram and some other info.  I grumbled, closed the tab, and went back to the seattlepi website, and continued my activities.  When I was finished, I closed out Firefox, and walked away from the computer.

    When I walked back in a few minutes later, I noticed that Firefox had been re-opened, and there was some "Anti virus Pro" doing a virus scan over the Firefox window.  There was also a new blue-and-white striped shield icon in the lower right corner.  I started to get other warning bubbles popping up in the lower right about my computer might be infected, etc.  After closing the virus scan window, I quickly found out that any executable I attempted to launch (combofix, hijack This/sniper, malwarebytes, etc) would be shut down with a gray pop-up box claiming the file was infected, and asking if I wanted to run a virus scan now.

    So, at present, I cannot even go through the steps in the "Before you do this..." thread.  I was able to get on Firefox and download the current version of Avast! and CCleamer Slim (though another firefox window would open up with 8 or so different tabs anytime I tried to click a link), but when I attempted to run them, that stupid gray window occurring again.

    At this point, I'm at a complete loss of what to do.  I've disconnected that computer from the internet, but haven't turned it off yet, as I'm afraid of what will happen when I try and restart. I'm using my roommate's computer at the moment.

    Help...?

    harry 48



      Egghead

    • lay back , relax and chill out
    • Thanked: 129
      • Yes
      • Yes
      • Yes
      • Dribbling Pensioner
    • Certifications: List
    • Experience: Familiar
    • OS: Windows 7
    Re: Previously unseen anti-virus infection
    « Reply #1 on: November 29, 2009, 01:24:17 PM »
    try to run the avast and ccleaner take out what ever they bring up


    go to a clean pc , go to " Before you do this " and download mbam , sas  and hijack to a memory stick or

    similar and run on your pc , copy and paste the 3 logs

    Zen_Sorcere

      Topic Starter


      Rookie

      Re: Previously unseen anti-virus infection
      « Reply #2 on: November 29, 2009, 01:49:01 PM »
      I can't get any .exe file to launch.  This includes installing programs.  I attempted launch Avast and CCleaner, but was prevented by the Antivrius virus.  Downloading programs isn't the difficulty, installing and launching them is.

      Zen_Sorcere

        Topic Starter


        Rookie

        Re: Previously unseen anti-virus infection
        « Reply #3 on: November 29, 2009, 06:29:29 PM »
        Alright.  Was able to get avast! up and running, as well as CCleaner, while in safe mode.  After avast! did it's reboot and scan, I noticed that the Blue shield with the white stripe was still among the icons in the lower right corner.

        I attempted to get Superantispyware going, but it cut off by the same dialog box as before.  So I went back into Safe Mode, and launched it there.  It's been doing a scan for the last couple of hours, and it's found some infected files.  I don't recall these complete scans taking nearly so long the last time I had a problem.  Maybe it's the safe mode. 

        Hopefully, I'll be able to move onto the Malwarebytes in normal mode once the SAS finally completes.

        harry 48



          Egghead

        • lay back , relax and chill out
        • Thanked: 129
          • Yes
          • Yes
          • Yes
          • Dribbling Pensioner
        • Certifications: List
        • Experience: Familiar
        • OS: Windows 7
        Re: Previously unseen anti-virus infection
        « Reply #4 on: November 30, 2009, 01:18:09 PM »
        rename mbam it may help to run it

        Zen_Sorcere

          Topic Starter


          Rookie

          Re: Previously unseen anti-virus infection
          « Reply #5 on: December 01, 2009, 11:22:14 PM »
          After running SAS in safemode, I was able to run MBAM, CCleaner, and Hijack This.  I was unable to get the Java to update however.   Nor could I get updates for SAS..something to do with my firewall (which I didn't think I had turned on).  My internet connection settings should be the same as when I loaded the previous Java Update.

          Here are the logs:


          [Saving space, attachment deleted by admin]

          harry 48



            Egghead

          • lay back , relax and chill out
          • Thanked: 129
            • Yes
            • Yes
            • Yes
            • Dribbling Pensioner
          • Certifications: List
          • Experience: Familiar
          • OS: Windows 7
          Re: Previously unseen anti-virus infection
          « Reply #6 on: December 02, 2009, 12:14:19 PM »
          ok , an expert will be along

          is that the full hjt log

          Zen_Sorcere

            Topic Starter


            Rookie

            Re: Previously unseen anti-virus infection
            « Reply #7 on: December 02, 2009, 12:19:32 PM »
            Computer appears to be running fine after the MBAM scan.

            And yes, that's the full HJT log.  Should be anyway.

            harry 48



              Egghead

            • lay back , relax and chill out
            • Thanked: 129
              • Yes
              • Yes
              • Yes
              • Dribbling Pensioner
            • Certifications: List
            • Experience: Familiar
            • OS: Windows 7
            Re: Previously unseen anti-virus infection
            « Reply #8 on: December 02, 2009, 01:55:18 PM »
            thats good , but let an expert read the logs please

            you are still running the old explorer 6 and also sp2 , but do not regrade until you are told it's clear to do so


            Zen_Sorcere

              Topic Starter


              Rookie

              Re: Previously unseen anti-virus infection
              « Reply #9 on: December 02, 2009, 01:58:02 PM »
              Calm down, I had every intention of letting an expert read the logs.  Was just making an observation.

              Explorer 6 is old because I never use explorer.

              SuperDave

              • Malware Removal Specialist
              • Moderator


              • Genius
              • Thanked: 1020
              • Certifications: List
              • Experience: Expert
              • OS: Windows 10
              Re: Previously unseen anti-virus infection
              « Reply #10 on: December 02, 2009, 04:56:06 PM »
              Hello Zen_Sorcere and welcome to Computer Hope Forum. My name is Superdave but you can just call me SD. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

              1.I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
              2.The fixes are specific to your problem and should only be used for this issue on this machine.
              3.If you don't know or understand something, please don't hesitate to ask.
              4.Please DO NOT run any other tools or scans whilst I am helping you.
              5.It is important that you reply to this thread. Do not start a new topic.
              6.Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
              7.Absence of symptoms does not mean that everything is clear.

              Download and save AVPFind.bat to your PC (save it anywhere you can find it. The Desktop is fine). Then double click on it to run it.

              AVPFind.bat

              It should take a couple minutes to run. You will see a black command prompt window while it is running and it should close when it is finished. Once it finishes, attach the c:\avplog.txt

              Windows 8 and Windows 10 dual boot with two SSD's

              Zen_Sorcere

                Topic Starter


                Rookie

                Re: Previously unseen anti-virus infection
                « Reply #11 on: December 02, 2009, 04:58:33 PM »
                Excellent, SD, and thanks.  I will tackle this as soon as I am home later tonight.

                Zen_Sorcere

                  Topic Starter


                  Rookie

                  Re: Previously unseen anti-virus infection
                  « Reply #12 on: December 04, 2009, 03:25:13 AM »
                  Here is the AVPFind log.

                  [Saving space, attachment deleted by admin]

                  SuperDave

                  • Malware Removal Specialist
                  • Moderator


                  • Genius
                  • Thanked: 1020
                  • Certifications: List
                  • Experience: Expert
                  • OS: Windows 10
                  Re: Previously unseen anti-virus infection
                  « Reply #13 on: December 04, 2009, 04:39:55 PM »
                  Thanks. Zen_Sorcere. Let's try this:

                  Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

                  link # 1
                  link # 2

                  Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

                  Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

                  Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts.
                  Double-click combofix.exe and follow the prompts.
                  When finished, ComboFix will produce a log for you.
                  Post the ComboFix log and a new HijackThis log in your next reply.

                  NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

                  Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.
                  Windows 8 and Windows 10 dual boot with two SSD's

                  Matt002



                    Starter

                    Re: Previously unseen anti-virus infection
                    « Reply #14 on: December 04, 2009, 08:33:03 PM »
                    Didn't see this topic earlier... This sounds like the exact same problem I have. A friend told me to get Hijackthis but that's all he said to get. Should I get those other programs you mentioned? Like combofix and etc...?