Previously unseen anti-virus infection

[Zen_Sorcere]

So I was checking my usual round of websites before going to bed, and when I went to the www.seattlepi.com website, a pop-up advertisement appeared in the middle of the page, but had no "close" or "skip ad" button. I accidentally clicked the ad, and it was apparently for tickets to something, as the page it took me to had a stadium diagram and some other info.  I grumbled, closed the tab, and went back to the seattlepi website, and continued my activities.  When I was finished, I closed out Firefox, and walked away from the computer.

When I walked back in a few minutes later, I noticed that Firefox had been re-opened, and there was some "Anti virus Pro" doing a virus scan over the Firefox window.  There was also a new blue-and-white striped shield icon in the lower right corner.  I started to get other warning bubbles popping up in the lower right about my computer might be infected, etc.  After closing the virus scan window, I quickly found out that any executable I attempted to launch (combofix, hijack This/sniper, malwarebytes, etc) would be shut down with a gray pop-up box claiming the file was infected, and asking if I wanted to run a virus scan now.

So, at present, I cannot even go through the steps in the "Before you do this..." thread.  I was able to get on Firefox and download the current version of Avast! and CCleamer Slim (though another firefox window would open up with 8 or so different tabs anytime I tried to click a link), but when I attempted to run them, that stupid gray window occurring again.

At this point, I'm at a complete loss of what to do.  I've disconnected that computer from the internet, but haven't turned it off yet, as I'm afraid of what will happen when I try and restart. I'm using my roommate's computer at the moment.

Help...?

[harry 48]

try to run the avast and ccleaner take out what ever they bring up


go to a clean pc , go to " Before you do this " and download mbam , sas  and hijack to a memory stick or

similar and run on your pc , copy and paste the 3 logs

[Zen_Sorcere]

I can't get any .exe file to launch.  This includes installing programs.  I attempted launch Avast and CCleaner, but was prevented by the Antivrius virus.  Downloading programs isn't the difficulty, installing and launching them is.

[Zen_Sorcere]

Alright.  Was able to get avast! up and running, as well as CCleaner, while in safe mode.  After avast! did it's reboot and scan, I noticed that the Blue shield with the white stripe was still among the icons in the lower right corner.

I attempted to get Superantispyware going, but it cut off by the same dialog box as before.  So I went back into Safe Mode, and launched it there.  It's been doing a scan for the last couple of hours, and it's found some infected files.  I don't recall these complete scans taking nearly so long the last time I had a problem.  Maybe it's the safe mode. 

Hopefully, I'll be able to move onto the Malwarebytes in normal mode once the SAS finally completes.

[harry 48]

rename mbam it may help to run it

[Zen_Sorcere]

After running SAS in safemode, I was able to run MBAM, CCleaner, and Hijack This.  I was unable to get the Java to update however.   Nor could I get updates for SAS..something to do with my firewall (which I didn't think I had turned on).  My internet connection settings should be the same as when I loaded the previous Java Update.

Here are the logs:


[Saving space, attachment deleted by admin]

[harry 48]

ok , an expert will be along

is that the full hjt log

[Zen_Sorcere]

Computer appears to be running fine after the MBAM scan.

And yes, that's the full HJT log.  Should be anyway.

[harry 48]

thats good , but let an expert read the logs please

you are still running the old explorer 6 and also sp2 , but do not regrade until you are told it's clear to do so

[Zen_Sorcere]

Calm down, I had every intention of letting an expert read the logs.  Was just making an observation.

Explorer 6 is old because I never use explorer.

[SuperDave]

Hello Zen_Sorcere and welcome to Computer Hope Forum. My name is Superdave but you can just call me SD. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1.I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2.The fixes are specific to your problem and should only be used for this issue on this machine.
3.If you don't know or understand something, please don't hesitate to ask.
4.Please DO NOT run any other tools or scans whilst I am helping you.
5.It is important that you reply to this thread. Do not start a new topic.
6.Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7.Absence of symptoms does not mean that everything is clear.

Download and save AVPFind.bat to your PC (save it anywhere you can find it. The Desktop is fine). Then double click on it to run it.

AVPFind.bat

It should take a couple minutes to run. You will see a black command prompt window while it is running and it should close when it is finished. Once it finishes, attach the c:\avplog.txt

[Zen_Sorcere]

Excellent, SD, and thanks.  I will tackle this as soon as I am home later tonight.

[Zen_Sorcere]

Here is the AVPFind log.

[Saving space, attachment deleted by admin]

[SuperDave]

Thanks. Zen_Sorcere. Let's try this:

Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

link # 1
link # 2

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts.
Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

[Matt002]

Didn't see this topic earlier... This sounds like the exact same problem I have. A friend told me to get Hijackthis but that's all he said to get. Should I get those other programs you mentioned? Like combofix and etc...?

[SuperDave]

Didn't see this topic earlier... This sounds like the exact same problem I have. A friend told me to get Hijackthis but that's all he said to get. Should I get those other programs you mentioned? Like combofix and etc...?

No Matt. You should start a thread of your own and you will get help for your particular computer.

[harry 48]

MATT002 go to below and complete post the 3 logs and start your own topic please


http://www.computerhope.com/forum/index.php/topic,46313.0.html

[Zen_Sorcere]

I'd go to this post first, as the experts here suggest:

http://www.computerhope.com/forum/index.php/topic,46313.0.html

After following the instructions and program processes there, post a new topic for your problem, and they can help you out, based on what the different program logs say about your computer.

[Zen_Sorcere]

Hey SuperDave, finally was able to find time to do the Combofix run.  As requested, here are the Combofix and new Hijack This logs:

[Saving space, attachment deleted by admin]

[SuperDave]

It's looking good. How's your computer running now? I would like you to do this:

Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.

ESET Online Scan

Scan your computer with the ESET FREE Online Virus Scan

* Click the ESET Online Scanner button.

* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.

* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the <<Back button then click Finish.

In your next reply please include the ESET Online Scan Log

[Zen_Sorcere]

Here is the ESET log:

[Saving space, attachment deleted by admin]

[SuperDave]

Hello Zen_Sorcere. Your log looks good and if there are no other issues, we'll do some clean-up.

Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

You can uninstall HJT. SAS & MBAM can be kept and update and run them about once a week to keep your computer clean.
AVP can also be deleted if it's still on your desktop

* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
* Now type Combofix /uninstall in the runbox
* Then hit Enter

To turn off Windows XP System Restore:

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.

1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6.  When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK.

Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Safe Surfing

[Zen_Sorcere]

Excellent, and Thanks again for the assistance.  I'll probably get a chance to go through these clean up steps in the next few days, and I'll let you know if I run into any problems with it.