One Nasty Virus/Trojan - Kills all virus scanners

[Lynn210]

Here comes stage 4 (didn't know it had a stage 4)

still going..

by the way as soon as Windows was almost up.. Avast updated itself.
but will do another as soon as combofix is done.

here we go....

stage 5 done
stage 6 done
stage 6A done
stage 7 done
stage 8 done

[edifyguy]

War and Peace, ROFL! 

This has been a rather epic journey, hasn't it? But it's a journey that is leading homeward.

I'm surprised that ComboFix made no mention of rootkit activity.....that's good! Really good. That means that we've definitely broken its back.

[edifyguy]

Here comes stage 4 (didn't know it had a stage 4)

still going..

by the way as soon as Windows was almost up.. Avast updated itself.
but will do another as soon as combofix is done.

here we go....

stage 5 done
stage 6 done
stage 6A done
stage 7 done
stage 8 done

There's 50 of them. 

[Lynn210]

Woops .. turned by back and we are all the way down to stage 33

The system seems to be stable for now.. so combofix should finish

then I will upload the results to you...

With a repair I will have to do a WIndows update too wont I?



Combofix deleted a bunch of files and folders and is now rebooting the computer...

I have never seen it do this before.. must have been a bad one.

[edifyguy]

For those with rudimentary knowledge of Linux:

Download and burn the Puppy Linux 4.1.2 iso file. (I don't trust the newer ones.....stick with 4.1.2 for now)

Download Avast! for Linux Workstation. Download the .tar.gz version.

From a console, run tgz2pet on the downloaded file.

From the explorer, click on the resulting file. It will self-install.

From the explorer, navigate to /bin, where you'll find a shortcut to Avast GUI. Click it.

Insert a valid key, download updates, and scan for bugs!

Lynn, ComboFix sounds like it is doing exactly what it was made to do now. You will have to apply many updates, but they can be done through the "yellow shield" updater. There's no great hurry, as MCE should have at least service pack 2 already with it.

[Lynn210]

Combofix is preparing its log report

all the same errors are popping up

plus some new ones

[edifyguy]

Errors are good at this point. It means that we've removed pieces of evilware that it has been instructed to execute.

Can you schedule an Avast boot-time scan now? If it just updated, you're good to go there.

EDIT: I also am eager to see your ComboFix log. Please upload it. It'll be at C:\combofix.log IIRC

[Lynn210]

Cant do anything till combofix finishes ... it says not to run any programs.

I can hear it running so I know it is still going .. must be a very long log
report??  

[edifyguy]

I dunno what takes it so long to prepare its report......but it does......but it's a great read when it's done! War and Peace-type epic stuff. 

I personally have disregarded it's warning to not start anything until it's done.....I'm impatient like that......but in this case, better to not.

Getting any really fishy warnings still, or just "XXX doesn't exist" type warnings?

[Lynn210]

Just a few warnings not as bad as before

The log is finished.. very interesting however it is 548kb

This site will only take 192 at a time.. so where should I upload it
to ...


 FYI  Avast wont load.. seems to be a problem with the skin.. so I guess
I have to download it again or do a repair or something

I will wait till you are back online so you can tell me the best way to fix
this..

[BRANDONN2008]

No new post in 26 min...the anticipation is killing me!

[Omega40]

No new post in 26 min...the anticipation is killing me!

Suspense is gruling as I'm sure it is more so to both Lynn and edifyguy.
I'm set on "Notify". Better than doing F5 F5 F5. lol

[essexboy]

Hi Lynn you could upload the log to Mediafire and post the sharing link.

I am looking at the Linux set up now, it is a lot smaller than the PE I use at 290Mb

[Lynn210]

Link to combofix log

http://www.mediafire.com/file/zmymy2ogz5j/ComboFix.txt

[Lynn210]

Be back later.. edifyguy must be taking a break ..