Cannot remove virus

[Mazrim]

Hey all, I have a serious issue with one of my desktop computers. We think it may be conficker, as we're having some issues consistent with that worm. Issues are as follows:

1) Can connect to the internet just fine, however, any attempts to access security websites such as symantec, avira, etc, are immediately diverted to a random website. Clicking back in most cases brings you back to the site you intended to connect to, but in some cases the sites are completely blocked.

2) The infected computer has Avira, Malwarebytes, Spybot S&D, HijackThis, etc., yet when attempting to update these, none of the programs can connect to their respective websites in order TO update.

3) Speaking of connecting, going to any website now takes forever - you could click on a site, go make a sandwich, come back, and the page would STILL be downloading. And we're on cable internet.

4) At random now, the windows Zero Configuration Tool that allows the Linksys wireless adapter to work without using software SHUTS OFF.

This is essentially my moms computer, and she only browses shopping sites such as MSNshop, HSN, QVC, BUY.com, etc. If we have to, I'll just nuke her HD and start from scratch, but I need to know still how to deal with this: We've got 7 systems on my network.

Any help is greatly appreciated, and thank you in advance for any offered.

 

[B00kWyrm]

Sorry to hear about the problems.
Try starting here... especially with note TWO at the start (By Julio)
https://www.techspot.com/vb/menu28.html
It sets out an 8 step process.
As you work your way through the process,
results will be generated that will allow those here to better help you.
Good Luck

 

[mflynn]

Boot to Safe Mode Networking

Then try this! if any parts do not work continue thu the steps. Then after running all that will run reboot again to Safe Mode Networking (do not allow Normal Mode to boot yet) and do the Fixit.cmd again.

Then proceed thu the steps even repeating the ones that worked before but hopefully now all will work.

So...

Go here and download to Desktop: http://www.adrive.com/public/97c4357781f45c7e443061094b8cfaff3836f57446eb242ab2ee0b6cd68a0107.html

Double click Fixer.exe to run it. This will extract a Fixer folder to the desktop.

Then Dbl Clk to enter the Fixer Folder .

To run it 1st double click Daft, then click scan and check any found items and click fix and then exit.

Next dbl click Fixit.cmd to run it.

When it completes try again to install MBAM and SAS and HJT and post logs.

Then without rebooting try the below

Do the TechSpot 8 steps: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

Skip no steps (do not install another virus scanner if you already have one, ask me before installing a Firewall).
avg

Most importantly update MalwareBytes (MBAM) and SuperAntiSpyware (SAS)!

Before you scan with either MalwareBytes or SuperAntiSpyWare do the Extra Configs below these have become most important lately

SuperAntispyware extra config

After installed double-click the icon on your desktop to run it.

Update the program definitions.

Click the Preferences button.

Then Scanning Control.

In Scanner Options make sure all boxes are checked except #3 Ignore System Restore.. are checked:

MalwareBytes extra config

After update but before running
Click settings and confirm all are Checked.

I repeat Update these 2 programs.

Run them and attach their logs.

Mike

 

[Mazrim]

Problem:

Ran Daft, no data on the screen, the app only says "all associations okay". Then ran Fixit.cmd, and the only thing that happened was that the desktop refreshed. So then I tried to update MBAM, HJT, etc. EVERY app now CRASHES whenever I attempt to update it.

 

[mflynn]

You were in Safe mode?

Whatever you have recognizes SAS and MBAM so try these alternate installers that use a different name.

http://malwarebytes.gt500.org/mbam-rules.exe
http://www.malwarebytes.org/mbam/database/mbam-rules.exe

http://www.superantispyware.com/downloads/RUNSAS.EXE
http://downloads.superantispyware.com/downloads/SAS_FREE.EXE

Rename HJT to 12hjt34 and try running it with that name,

Mike

 

[Mazrim]

Renamed HJT, ran it and Malwarebytes in safe mode, nothing came up at all. Can NOT run any other anti-malware app in safe mode because they require updating before they're ran, and even in safe mode with networking, they refuse to update and crash upon attempting.

What I see is that whatever's in her computer not only is locking out access by anti malware programs to their respective sites, but also is doing something that also causes them to crash immediately, and is stealthed to known anti-malwares that can be run regardless of status.

I'm beyond frustrated here. =/

 

[mflynn]

See post #5 above!

Sorry I forgot the links. Try these!

Mike

 

[Mazrim]

Ok just got done with both scans: MBAM picked up Trojan.Daonol, Rogue.Trace, and Adware.MyWebSearch

Here's the logs for those plus HJT *EDIT* (I have to run SAS again because for some reason the log never saved)

 

[mflynn]

Ok Run MBAM again you did not remove the found items you must click to delete.

Did you get SAS to install? If so run and post its log also.

Mike

 

[Mazrim]

For some odd reason I can't seem to find the log from the scan on SAS, and whenever I scan the system now it wont let me save a logfile

 

[mflynn]

OK then, but run MBAM again and remove the found items this time and post the log again as requested in post #9.

SAS Logs, open SAS click Preferances-Statistics/logs. Post any all logs it has.

Then and only then do the below!

Download ComboFix

Get it here: https://www.techspot.com/downloads/5587-combofix.html
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

Install Recovery Console if connected to the Internet!

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.
=========================================

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.

Mike

 

[Mazrim]

Here's the new MBAM log:

I will follow the steps outlined and post all logs from new scans once complete.

 

[mflynn]

Do the rest of the last post!

ComboFix and SDFix

Mike

 

[Bobbye]

Give this a try- I just learned about it today. It is NOT foolproof but it is a good screening tool:

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

 

[Mazrim]

Here's HJT, ComboFix, and SDFix logs:

 

[mflynn]

OK good job!

Almost finished.

Run ComboFix again post log then do below!

Get and run DrWeb

Go here Download DrWeb https://www.techspot.com/vb/post724044-3.html

Then....

Boot to Safe Mode only! Not with Networking and run...

DrWeb will fisrt do an Express Scan on its own when it completes then you should do a full scan.

The first Virus it finds select Cure and it will use this as the default automatically for all the rest. What it can't fix will be Quarantined!

This will take a while based on CPU and HD speed and size, but is worth it!

Mike

 

[Bobbye]

A heads up for you: If at some time you feel the startup, shutdown and surf time is slow and you know you're clean, consider the following:

All of these programs and processes are starting on boot and running in the background, using the system resources- NONE of them need to start on boot and they can be started manually as needed:

Media Players and programs:
RealPlayer
Musicmatch
PowerDVD
iTunes
QuickTime
IPIX

Dell Support:
sprtcmd.exe
DSAgnt.exe
brkrsvc.exe

Dell Photo AIO Printer
and MemoryCardManager

I've found a lot of people don't realize they are starting on boot or that they can be stopped. And many don't use the Dell Support- just donate their resources to them!

 

[Mazrim]

Have an issue regarding DRWeb: It sees combofix, sdfix, avira, and a few other anti-malwares AS malware. It quarantined all these programs, and now they will either no longer run or if they DO run, there are errors and crashes. There's no DrWeb file folder in program files nor in documents/settings nor temp to recover these programs, so im unsure how to restore them all besides deleting them ALL and starting from scratch.

I also cannot find any logs saved for the scans done in safe mode.

 

[mflynn]

Well it may be simpler to just reinstall Avira.

We are going to remove SDFix and ComboFix anyway as we are finished with them.

So what else is effected?

Besides these false positives what other did it find these I need to see..

Post the DrWeb log. It will show me all including Quarantine..

Mike

 

[Mazrim]

The scan file is a .csv file, and is therefore considered invalid to upload.

What to do?

 

[mflynn]

Just rename it .txt or zip it.

Mike

 

[Bobbye]

Check this:

Screenshot 7 of Dr.WEB CureIt!
http://www.softpedia.com/progScreenshots/Dr-WEB-CureIt-Screenshot-50008.html

How was yours checked?

 

[Mazrim]

To be honest, I'm not sure; I did rename the log file as .txt though so maybe you can make sense of this:

 

[mflynn]

OK looking GOOD!

Do the below an we are finished. How is system running?

Thread Closing-------------------------------------------------------------------

Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

Remove ComboFix
Start-Run
type
combofix /u
Hit enter or click OK.

Please download OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

Save to desktop.

This will remove all the tools we used to clean your computer.

Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

If prompted to Reboot click, Yes.
OTCleanit will delete itself when finished, If not delete it by yourself.

-------------------------------------------------------------------------------------
Run CCleaner http://www.ccleaner.com/download/builds (get SLIM at bottom no Yahoo toolbar)
Run twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean. You may have this from the 8 Steps.

Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner. (When installing uncheck Relevant Knowledge do not install)
-------------------------------------------------------------------------------------
The issues can and are likely found is in System Restore so do the below

Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.
-------------------------------------------------------------------------------------
ERUNT
Add a redundent Reg backup, get and install ERUNT let it add itself to startup and do a backup on install check all boxes.

ERUNT http://www.larshederer.homepage.t-online.de/erunt/
Yes! Even if you use system restore and other backups Registry and Images.
-------------------------------------------------------------------------------------

Every two weeks or so, run MBAM and SAS until clean.

They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

If they find something they can not clean, then get back to us.

Additionally run CCleaner. ATF-Cleaner and KCleaner.
----------------------------------------------------------------------------------------
I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

It was designed to be used with and to co-exist with other Virus scanners.

Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

It's like looking at it with 2 sets of eyes and from a different angle.

It works like some Firewalls do to learn what is good/bad.

After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

As it queries you about the prompt to help you determine to approve or not you can google it with one click.

http://www.threatfire.com/Download/
-------------------------------------------------------------------------------------
Look at http://www.javacoolsoftware.com/spywareblaster.html

Run SpyBot ocassionally and use the Immunize function.
http://www.safer-networking.org/en/download/

I highly reccomend Hostman: Hostman http://majorgeeks.com/HostsMan_d4592.html

Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

A Disk Scan (chkdsk) and Defrag are in order.

Mike

 

[Bobbye]

The issues can and are likely found is in System Restore so do the below

Be SURE you do this as you do have malware in the restore points. They are protected files and are not removed in the cleaning programs. If you used them, you would reinfect the system.