TechSpot

Help--Virus, Trojan???

By fantums
Jul 9, 2007
  1. My computer keeps getting pop-ups. Everywhere. Sometimes at least 5 pop up at a time.
    My AVG Anti-Spyware (by the way--is that a good/bad program?) found something called wauaboot.exe and cleaned and moved it to quarantine. There's a whole bunch of them in there now...and it's all like the same thing. AVG says it's infected with Adware.PurityScan.
    It's under the file C:\WINDOWS\system 32\AppPatch\wuauboot.exe
    What to do? Please, I need to fix this very soon.
     
  2. kitty500cat

    kitty500cat TS Evangelist Posts: 2,154   +6

    Hello and welcome to TechSpot.

    It's very possible that your system is infected with malware. Please do the following so that we can be sure.

    Go and read the Viruses/spyware/malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT, ComboFix, and AVG Antispyware logs as attachments into this thread, only after doing the above. Also post here the results of the AVG Antirootkit scan.

    Regards :)

    This thread is for the use of fantums only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.
     
  3. BlackScarlet

    BlackScarlet TS Enthusiast Posts: 100

    Yes, that is malware.
    (Even though this point may seem random, just in random passing I thought I'd mention it: the best thing to do in all situations is if something is warning you of spyware, and it isnt a program you installed, or if something is offering you an URGENT and FREE scan then say eff you to it.)
    AVG is a very good program, but do you have anything such as Spybot S&D, or CounterSpy? These are all good programs, as well as OutPost Firewall, which keeps a tight eye on the things coming and going from your network. Although I usually am very stuck to AVG antispyware 7.5, I discovered Counterspy, which in addiction to scanning also monitors execution of potentially harmful programs.
    Spybot also monitors changes in the registry as well as scanning.


    Files in quarantine are safe and cannot harm your computer.
    Also, don't be afraid to try and manually delete malware if your scanner is having a hard time with it, to see firsthand what error messages you might get, which give a very good indication of why it can't be deleted, at that time. If your scanner gives you the exact file and path, to the system file or registry key, then you needn't worry about ****ing anything up by deleting something you shouldnt have, because you will only be deleting that malware file or folder.

    After you install one or more of these programs (spybot can be used with any other scanning software, but using more than one antivirus at a time could cause conflicts) get all updates, then restart your pc in safe mode, and do a huge scan. Make sure you disconnect your internet while you do this, because some malware can contact its server to say 'hey, im being deleted, replace me'.
    The reason why you want to go into safe mode is because in normal startup certain malware cannot be removed because they are constantly 'in use' by some unknown source. In safe mode the system is loaded with minimal drivers and no startup programs, etc, which almost guarantees the file will not be in use.





    Let me know how that goes. =)


    ~BlackScarletLove~
     
  4. momok

    momok TS Rookie Posts: 2,265

    Hi

    Very Important: Malware infections can possibly lead to identity theft, loss of funds from bank accounts, misuse of credit card information etc. Therefore I strongly encourage you to please read this thread HERE before deciding what course of action to take regarding your infection.

    After you have read this, let us know your decision. If you wish to clean your system, continue with the instructions that kitty provided and follow them to the letter.


    Regards,
    Your friendly momok =)

    This thread is for the use of fantums only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. fantums

    fantums TS Rookie Topic Starter

    Hey everyone, and THANKS!

    Here's all the results aas attachments.
    No rootkits were found by the AVG Anti-Rootkit.
     
  6. momok

    momok TS Rookie Posts: 2,265

    Hi,

    I presume you have read the thread I gave and decided to clean. If you have not, please read the thread and let me know your decision.

    I noticed that your AVG log displays 'No Action Taken' for all the files detected.
    I require you to run AVG again and quarantine the files. Pictorial instructions HERE.

    Download the attached "CFScript.txt" (from my attachment) and save it to the same folder as Combofix.

    You may wish to copy and paste these instructions on notepad for easier reference later.

    Boot into safe mode under your normal user name. See how HERE
    Next turn on "Show all files and folders, including hidden and system". See how HERE

    1. Go to start > run and type msconfig. Press the enter key.
      Search for the following services and disable them by unchecking the box beside the entries.

      Trlm
      Echghr


      Press OK but do not restart your system yet.

    2. After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

      O2 - BHO: (no name) - {C75C4361-D5F8-DF2E-DD0A-F8ADAFE370C1} - C:\WINDOWS\system32\bxjbskp.dll (file missing)
      O4 - HKCU\..\Run: [Trlm] "C:\PROGRA~1\YSTEM3~1\rundll.exe" -vt yazb
      O4 - HKCU\..\Run: [Echghr] C:\WINDOWS\system32\?ppPatch\wuauboot.exe

      Close HJT.

    3. Referring to the image below, drag the CFScript.txt that you downloaded earlier over on to Combofix.exe and release.

      [​IMG]

      This will ask Combofix to execute the instructions within my file. Let Combofix run normally and do its job. Attach the resultant log in your reply.

    4. Reboot into normal mode and rehide your protected OS files.

    Thereafter, please post fresh HJT, ComboFix and AVG Antispyware logs from normal mode as attachments into this thread.


    Regards,
    Your friendly momok =)

    This thread is for the use of fantums only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. fantums

    fantums TS Rookie Topic Starter

    Thanks momok, but um...where's the attached file?
     
  8. momok

    momok TS Rookie Posts: 2,265

    Hi,

    Sorry about that. Here it is.

    Regards,
    Your friendly momok =)

    This thread is for the use of fantums only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...