Author Topic: what to do with a virus  (Read 16295 times)

0 Members and 1 Guest are viewing this topic.

sshyman

  • Guest
what to do with a virus
« on: July 31, 2012, 01:45:53 AM »
Hi, apparently I got a virus, keep getting the malware pop up which allows you to report a false positive. My questions:How do you find and delete the infected file(s)? How do I stop the malware popup and shuld I report a false positive?

iroc9555

  • Guest
Re: what to do with a virus
« Reply #1 on: July 31, 2012, 01:53:08 AM »
sshyman welcome to the forums.

Could you give us a screenshot of the alert or what does it say ?

sshyman

  • Guest
Re: what to do with a virus
« Reply #2 on: July 31, 2012, 09:36:28 PM »
Thanks for your reply, attatched is a screenshot. I get one of these every 3 seconds. Each time they are stored in the chest and deleting them does not stop them from recurring. Please tell me what to do to get rid of the cause of this message.

Also, I have another question. I am getting some recurring advertising popups in firefox. How do you stop hte advertising popups from proping up?

Thanks


Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: what to do with a virus
« Reply #3 on: July 31, 2012, 10:06:50 PM »
Hi you are infected

Download OTL  to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Local\AutoProxyCache /s
CREATERESTOREPOINT

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Post both logs
THEN

Download aswMBR.exe ( 4.8mb ) to your desktop.
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan 



On completion of the scan click save log, save it to your desktop and post in your next reply




sshyman

  • Guest
Re: what to do with a virus
« Reply #4 on: August 01, 2012, 01:41:03 AM »
Thank you very much for your help! Attatched are the 2 of the logs you requested.

sshyman

  • Guest
Re: what to do with a virus
« Reply #5 on: August 01, 2012, 01:42:00 AM »
Here is the other log

iroc9555

  • Guest
Re: what to do with a virus
« Reply #6 on: August 01, 2012, 01:47:17 AM »
Sshyman.

Still missing OTL.txt. Look at the instructions. Essexboy will need it to found the malware. Since Essexboy lives in the UK, you might not get an answer until tomorrow.

sshyman

  • Guest
Re: what to do with a virus
« Reply #7 on: August 01, 2012, 01:48:45 AM »
here is the full asw scan, i don't think the first one i sent completed

sshyman

  • Guest
Re: what to do with a virus
« Reply #8 on: August 01, 2012, 01:50:02 AM »
here is the otl.txt

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: what to do with a virus
« Reply #9 on: August 01, 2012, 01:50:34 AM »
Essexboy will be in bed now, 00:50am in the UK, he will be back on-line tomorrow probably mid to late afternoon after work.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: what to do with a virus
« Reply #10 on: August 01, 2012, 02:42:43 PM »
Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


    Quote
    :OTL
    O3 - HKU\S-1-5-21-660230534-9386771-3986129850-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
    O3 - HKU\S-1-5-21-660230534-9386771-3986129850-1000\..\Toolbar\WebBrowser: (no name) - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No CLSID value found.
    [2012/07/30 11:11:24 | 000,000,000 | ---D | C] -- C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum
    [2012/07/30 11:09:02 | 000,000,000 | ---D | C] -- C:\ProgramData\0C1CFB130074835F1A9A50BFF875F002

    :Files
    ipconfig /flushdns /c
    C:\Users\steve\AppData\Local\{17796498-62ef-634f-418f-d0855295ff5e}

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks




  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.[/b]
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

true indian

  • Guest
Re: what to do with a virus
« Reply #11 on: August 01, 2012, 03:04:56 PM »
hi essexboy,

does this seem like a new varient...anubis report says it tries to write something to explorer.exe virtual memory...does that indirectly mean it patches explorer.exe??

http://anubis.iseclab.org/?action=result&task_id=117b49454bb860a74ad47887ded6c3f7b&format=html


Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: what to do with a virus
« Reply #12 on: August 01, 2012, 03:08:48 PM »
Yep it is a variation on a theme

true indian

  • Guest
Re: what to do with a virus
« Reply #13 on: August 01, 2012, 03:11:26 PM »
Yep it is a variation on a theme

thank you!! for confirming ;D

sshyman

  • Guest
Re: what to do with a virus
« Reply #14 on: August 01, 2012, 04:19:44 PM »
OTL frim 2nd qucik scan