riddled with viruses please help

[kel913]

Hi

I would really appreciate someones help please, i have followed all the steps advised in the top thread and will post the logs.  It is my mum-in-laws pc that i am having problems with, i have some knowledge of pc's but more to do with software and hardware. The pc did not have any anti virus software on it and serveral members of the family had access to it, it became riddled with viruses and the background screen changed itself to a green screen with a warning sign that the computer had been infected, it also came up with serveral errors about spywear and trojans and one of the family members kept klicking on them! They were unable to access the internet and serveral applications, aswell task manager advised that admin had disabled it. After following your steps the background has been sorted and the errors have stopped, however i am still unable to get it back onto the internet. i have also since installed mcafee. would someone be able to help please and check if everything else seems ok from what i have done so far? your help will be greatly appreciated!!!   thanks Kel

[Saving space, attachment deleted by admin]

[evilfantasy]

Hello kel913.

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

• R3 - Default URLSearchHook is missing
• F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
• O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
• O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Client for Internet Explorer\YontooIEClient.dll
• O4 - HKLM\..\Run: [SGPUpdater] C:\Program Files\Search Guard PlusU\sgpUpdaters.exe
• O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Search Guard Plus\SearchGuardPlus.exe

.
Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

----------

Go to Add or Remove Programs and uninstall:

• Yontoo Layers Client for Internet Explorer
• Search Guard Plus

.
----------

A malicious .DLL file is disrupting the LSP chain on your computer. We need to get rid of it.

* Please download LSPFix
* Run the LSPFix.exe that you have just finished downloading.
* Check the I know what I'm doing box.
* In the Keep box you should see one or more instances of winhelper86.dll
* Select every instance of winhelper86.dll and move each one to the Remove box by clicking the >> button.
* If the winhelper86.dll file only appears on the right side then just click fix checked and close the program.
* When you are done click Finish>>

Is the connection back? If not continue to the next step.

----------

Download and run WinSockFix
This is a two step process that will Back up the Registry and Reset the Winsock Stack.

• Double click on WinsockXPFix.exe to open.
  
• On the Winsock and TCP Repair Utility  screen, click "ReG-Backup"
  
• On the ERDNT Welcome screen, click "OK".
  
• On the Backup to: screen, click "OK".
  
• On the Folder does not exist question screen click "Yes".
  
• You will see a status screen as your registry is being backed up.
• On the Registry backup is complete! screen, click "OK" and you will go back to the main window.
  
• On the Winsock and TCP Repair Utility screen, click "Fix".
  
• On the Apply the VB_Winsock fix? screen click "Yes".
  
• The screen will display a status message "repair completed please reboot."
  
• On the Repair Completed screen click "OK" to reboot your computer.
  
• If your computer was not using DHCP, you will need to reconfigure TCP/IP.
• Hopefully you should have connectivity restored.

.
Note: Resetting  the Winsock in SP2 might remove third-party LSPs and restores Winsock to factory default setting. Existing programs that uses their own LSPs may need to be reinstalled. Example: Google Desktop Search.

Is the connection back? If not continue to the next step.

----------

Go Start > Run and type in:cmd then click OK

In the Command Prompt window type in following commands, and press Enter after each one:

Code: [Select]

ipconfig /flushdns

Code: [Select]

ipconfig /registerdns

Code: [Select]

ipconfig /release

Code: [Select]

ipconfig /renew
Note the space before the forward slash /

Restart the computer.

Is the connection back?

Continue to the next step if it is or isn't and let me know in the next post.

----------

If you already have ComboFix be sure to delete it and download a new copy.

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
Vista users Right-Click on ComboFix.exe and select Run as administrator (you will receive a UAC prompt, please allow it)
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

[kel913]

Thank you so much for your help. I followed all the instructions and regained access to the internet after the first fix so i did not try the other two and moved straight to the combofix, after the combofix had finished and i had save the log the following error popped up in task bar:

Windows delayed write failed windows was unable to save all the data fot the file \...\DP(1)0-0+5. The data has been lost. this error may have been caused by a failure of the computer hardware or network connection. please try to save this file elsewhere.

I havent touched the laptop since, i will just wait for your reply.  i have attached the combofix logs as requested! thank you so much again for your help. Kel

[Saving space, attachment deleted by admin]

[evilfantasy]

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]

KillAll::

Driver::
dhexq


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

----------

Please go to Start > Run and copy/paste the following blue text, then press Enter:

C:\QooBox\Add-Remove Programs.txt

A text file should open. Please post the contents of that file in your next reply.

----------

[kel913]

All done  there didnt seem to be any problems this time,  have posted logs as requested! thanks so much again for your help! Kel

[Saving space, attachment deleted by admin]

[evilfantasy]

Go to Add or Remove Programs and uninstall:

• Viewpoint Media Player

----------

* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
* Now type Combofix /Uninstall in the runbox
* Make sure there's a space between Combofix and /Uninstall
* Then hit Enter

* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.

----------

Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. 
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

----------

ESET Online Scan

Scan your computer with the ESET FREE Online Virus Scan

* Click the ESET Online Scanner button.

* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.

* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the <<Back button then click Finish.

In your next reply please include the ESET Online Scan Log

[kel913]

Hi, thanks for that, i have completed all the above steps however when the eset antivirus was scanning it threw up serveral boxes of details of the trojans it had deleted (about 10 Id say), but it only gave me an option to delete the messages or close them, i closed them thinking that it would give me a full report at the end but at the end it said no viruses detected and only gave me a finish option?! So i dont kno if i had done something wrong? so i dont have the logs for you sorry, do you want me to run it again? thanks v much

[the_mad_joker]

Hello, your comment has been removed. Please do not post malware advice, or post here in the malware forum, unless you need help. ~ DragonMaster Jay

[the_mad_joker]

Hello, your comment has been removed. Please do not post malware advice, or post here in the malware forum, unless you need help. ~ DragonMaster Jay

[kel913]

Thanks for you help but I'm trying to fix the laptop for a family member so am hoping to use free software, it's not my place to buy any software for the laptop so if as a last resort evilfantasy says the only way to fix it is to buy some software then I will leave it up to them to deal with that. Thanks

[evilfantasy]

Hi.

Please disregard any advice given except from me.

Did you download ESET or run the online scanner?

Try this.

Scan your computer with Panda ActiveScan

* Once you are on the Panda site click the Scan your PC now button.
* A new window will open...click the Scan Now button.
* If it wants to install an ActiveX component allow it.
* It will start downloading the files it requires for the scan. (Note: It may take a couple of minutes)
* You may get a warning from Internet Explorer that Panda is ready to install, please allow it.
* The scan will begin. Please be patient as it can take an hour or more to complete.
* When the scan completes, if anything malicious is detected, click the Export to: button (looks like a little Notepad).
* Save the ActiveScan.txt to a convenient location like your desktop.
* Note: You do not need to select any of the Disinfect options. We will remove any threats manually.

* Post the contents of the ActiveScan report in your next reply.

[kel913]

Thanks I ran the ESET online scanner 

I have ran the Panda scanner now and attached logs! Thanks V much   

[Saving space, attachment deleted by admin]

[evilfantasy]

Looks good. How is the computer running now?

Disable/Enable the System Restore Utility to flush old infected restore points

1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Put a check mark next to Turn off System Restore on All Drives
4) Click the OK button.
5) You will be prompted to restart the computer. Click the Yes button.

Now re-enable System Restore

To re-enable the System Restore Utility, follow steps one to five and on step three remove the check mark next to 'Turn off System Restore on All Drives'.

1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Remove the check mark next to Turn off System Restore on All Drives
4) Click the OK button.

----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no realtime protection so will not interfere with each other. They do not use any significant amount of resources (except a little disk space) until you run a scan.

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

[kel913]

Hey, i have completed all of the above! the laptop is running great now, seems to be no more problems! i cant thank you enough for your help! it is really appreciated!

[evilfantasy]

Your welcome.

Safe surfing...