Cannot remove virus

By Mazrim
Apr 6, 2009
  1. Hey all, I have a serious issue with one of my desktop computers. We think it may be conficker, as we're having some issues consistent with that worm. Issues are as follows:

    1) Can connect to the internet just fine, however, any attempts to access security websites such as symantec, avira, etc, are immediately diverted to a random website. Clicking back in most cases brings you back to the site you intended to connect to, but in some cases the sites are completely blocked.

    2) The infected computer has Avira, Malwarebytes, Spybot S&D, HijackThis, etc., yet when attempting to update these, none of the programs can connect to their respective websites in order TO update.

    3) Speaking of connecting, going to any website now takes forever - you could click on a site, go make a sandwich, come back, and the page would STILL be downloading. And we're on cable internet.

    4) At random now, the windows Zero Configuration Tool that allows the Linksys wireless adapter to work without using software SHUTS OFF.

    This is essentially my moms computer, and she only browses shopping sites such as MSNshop, HSN, QVC,, etc. If we have to, I'll just nuke her HD and start from scratch, but I need to know still how to deal with this: We've got 7 systems on my network.

    Any help is greatly appreciated, and thank you in advance for any offered. :)
  2. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,436   +37

    Sorry to hear about the problems.
    Try starting here... especially with note TWO at the start (By Julio)
    It sets out an 8 step process.
    As you work your way through the process,
    results will be generated that will allow those here to better help you.
    Good Luck
  3. mflynn

    mflynn TS Rookie Posts: 2,655

    Boot to Safe Mode Networking

    Then try this! if any parts do not work continue thu the steps. Then after running all that will run reboot again to Safe Mode Networking (do not allow Normal Mode to boot yet) and do the Fixit.cmd again.

    Then proceed thu the steps even repeating the ones that worked before but hopefully now all will work.


    Go here and download to Desktop:

    Double click Fixer.exe to run it. This will extract a Fixer folder to the desktop.

    Then Dbl Clk to enter the Fixer Folder .

    To run it 1st double click Daft, then click scan and check any found items and click fix and then exit.

    Next dbl click Fixit.cmd to run it.

    When it completes try again to install MBAM and SAS and HJT and post logs.

    Then without rebooting try the below

    Do the TechSpot 8 steps:

    Skip no steps (do not install another virus scanner if you already have one, ask me before installing a Firewall).

    Most importantly update MalwareBytes (MBAM) and SuperAntiSpyware (SAS)!

    Before you scan with either MalwareBytes or SuperAntiSpyWare do the Extra Configs below these have become most important lately

    SuperAntispyware extra config

    After installed double-click the icon on your desktop to run it.

    Update the program definitions.

    Click the Preferences button.

    Then Scanning Control.

    In Scanner Options make sure all boxes are checked except #3 Ignore System Restore.. are checked:

    MalwareBytes extra config

    After update but before running
    Click settings and confirm all are Checked.

    I repeat Update these 2 programs.

    Run them and attach their logs.

  4. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113


    Ran Daft, no data on the screen, the app only says "all associations okay". Then ran Fixit.cmd, and the only thing that happened was that the desktop refreshed. So then I tried to update MBAM, HJT, etc. EVERY app now CRASHES whenever I attempt to update it.
  5. mflynn

    mflynn TS Rookie Posts: 2,655

  6. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113

    Renamed HJT, ran it and Malwarebytes in safe mode, nothing came up at all. Can NOT run any other anti-malware app in safe mode because they require updating before they're ran, and even in safe mode with networking, they refuse to update and crash upon attempting.

    What I see is that whatever's in her computer not only is locking out access by anti malware programs to their respective sites, but also is doing something that also causes them to crash immediately, and is stealthed to known anti-malwares that can be run regardless of status.

    I'm beyond frustrated here. =/
  7. mflynn

    mflynn TS Rookie Posts: 2,655

    See post #5 above!

    Sorry I forgot the links. Try these!

  8. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113

    Ok just got done with both scans: MBAM picked up Trojan.Daonol, Rogue.Trace, and Adware.MyWebSearch

    Here's the logs for those plus HJT *EDIT* (I have to run SAS again because for some reason the log never saved)
  9. mflynn

    mflynn TS Rookie Posts: 2,655

    Ok Run MBAM again you did not remove the found items you must click to delete.

    Did you get SAS to install? If so run and post its log also.

  10. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113

    For some odd reason I can't seem to find the log from the scan on SAS, and whenever I scan the system now it wont let me save a logfile
  11. mflynn

    mflynn TS Rookie Posts: 2,655

    OK then, but run MBAM again and remove the found items this time and post the log again as requested in post #9.

    SAS Logs, open SAS click Preferances-Statistics/logs. Post any all logs it has.

    Then and only then do the below!

    Download ComboFix

    Get it here:
    Or here:

    Double click combofix.exe follow the prompts.

    Install Recovery Console if connected to the Internet!

    When finished, it will open a log.
    Attach the log and a new HJT log in your next reply.

    Note: Do not click combofix's window while its running. That may cause it to stall.

    Download SDFix to Desktop.

    On Desktop run SDdFix It will run (install) then close.

    Then reboot into Safe Mode

    As the computer starts up, tap the F8 key several times.

    On the Boot menu Choose Safe Mode.

    Click thu all the prompts to get to desktop.

    At Desktop
    My Computer C: drive. Double-click to open.

    Look for a folder called SD Fix. Double-click to enter SD Fix.

    Double-click to RunThis.bat. Type Y to begin.

    SD Fix does its job.

    When prompted hit the enter key to restart the computer

    Your computer will reboot.

    On normal restart the Fixtool will run again and complete the removal process then say Finished,
    Hit the Enter key to end the script and load your desktop icons.

    Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
    Attach the Report.txt file to your next post.

  12. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113

    Here's the new MBAM log:

    I will follow the steps outlined and post all logs from new scans once complete.

    Attached Files:

  13. mflynn

    mflynn TS Rookie Posts: 2,655

    Do the rest of the last post!

    ComboFix and SDFix

  14. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

  15. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113

    Here's HJT, ComboFix, and SDFix logs:
  16. mflynn

    mflynn TS Rookie Posts: 2,655

    OK good job!

    Almost finished.

    Run ComboFix again post log then do below!

    Get and run DrWeb

    Go here Download DrWeb


    Boot to Safe Mode only! Not with Networking and run...

    DrWeb will fisrt do an Express Scan on its own when it completes then you should do a full scan.

    The first Virus it finds select Cure and it will use this as the default automatically for all the rest. What it can't fix will be Quarantined!

    This will take a while based on CPU and HD speed and size, but is worth it!

  17. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    A heads up for you: If at some time you feel the startup, shutdown and surf time is slow and you know you're clean, consider the following:

    All of these programs and processes are starting on boot and running in the background, using the system resources- NONE of them need to start on boot and they can be started manually as needed:

    Media Players and programs:

    Dell Support:

    Dell Photo AIO Printer
    and MemoryCardManager

    I've found a lot of people don't realize they are starting on boot or that they can be stopped. And many don't use the Dell Support- just donate their resources to them!
  18. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113

    Have an issue regarding DRWeb: It sees combofix, sdfix, avira, and a few other anti-malwares AS malware. It quarantined all these programs, and now they will either no longer run or if they DO run, there are errors and crashes. There's no DrWeb file folder in program files nor in documents/settings nor temp to recover these programs, so im unsure how to restore them all besides deleting them ALL and starting from scratch.

    I also cannot find any logs saved for the scans done in safe mode.
  19. mflynn

    mflynn TS Rookie Posts: 2,655

    Well it may be simpler to just reinstall Avira.

    We are going to remove SDFix and ComboFix anyway as we are finished with them.

    So what else is effected?

    Besides these false positives what other did it find these I need to see..

    Post the DrWeb log. It will show me all including Quarantine..

  20. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113

    The scan file is a .csv file, and is therefore considered invalid to upload.

    What to do?
  21. mflynn

    mflynn TS Rookie Posts: 2,655

    Just rename it .txt or zip it.

  22. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

  23. Mazrim

    Mazrim TS Enthusiast Topic Starter Posts: 113

    To be honest, I'm not sure; I did rename the log file as .txt though so maybe you can make sense of this:
  24. mflynn

    mflynn TS Rookie Posts: 2,655

    OK looking GOOD!

    Do the below an we are finished. How is system running?

    Thread Closing-------------------------------------------------------------------

    Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

    Remove ComboFix
    combofix /u
    Hit enter or click OK.

    Please download OTCleanIt

    Save to desktop.

    This will remove all the tools we used to clean your computer.

    Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

    Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

    If prompted to Reboot click, Yes.
    OTCleanit will delete itself when finished, If not delete it by yourself.

    Run CCleaner (get SLIM at bottom no Yahoo toolbar)
    Run twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean. You may have this from the 8 Steps.

    Run ATF-Cleaner Temp and Registry, repeatedly until no more found.

    Fantastic cleaner. (When installing uncheck Relevant Knowledge do not install)
    The issues can and are likely found is in System Restore so do the below

    Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

    Then Start-Programs-Accessories-System Tools-Disk Cleanup
    Click OK to accept C:
    Select all Boxes
    Then click More Options
    Here click System Restore and OK to "Are you sure" and the OK to Run.

    As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

    It clears what is known as Shadow copies which are used by specialized back up programs.

    This is if you have the Volume Shadow Copy running which is the default.
    Add a redundent Reg backup, get and install ERUNT let it add itself to startup and do a backup on install check all boxes.

    Yes! Even if you use system restore and other backups Registry and Images.

    Every two weeks or so, run MBAM and SAS until clean.

    They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

    If they find something they can not clean, then get back to us.

    Additionally run CCleaner. ATF-Cleaner and KCleaner.
    I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

    It was designed to be used with and to co-exist with other Virus scanners.

    Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

    It's like looking at it with 2 sets of eyes and from a different angle.

    It works like some Firewalls do to learn what is good/bad.

    After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

    As it queries you about the prompt to help you determine to approve or not you can google it with one click.
    Look at

    Run SpyBot ocassionally and use the Immunize function.

    I highly reccomend Hostman: Hostman

    Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

    A Disk Scan (chkdsk) and Defrag are in order.

  25. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Be SURE you do this as you do have malware in the restore points. They are protected files and are not removed in the cleaning programs. If you used them, you would reinfect the system.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...