Author Topic: Start avast! Antivirus ... (Read 15958 times)

Circlip · « **Reply #15 on:** November 21, 2009, 12:05:52 AM »

Hi folks,
So i`ve found something promising, all the w`s safer-networking download 1.6.2.46 on Spybot.
I`m gonna try that one now

Circlip

Tarq57 · « **Reply #16 on:** November 21, 2009, 12:11:34 AM »

That'll work.
But what's wrong with trying MBAM first?
More state of the art, better detection and cleaning ability, smaller download IIRC.

Circlip · « **Reply #17 on:** November 21, 2009, 12:35:31 AM »

Oh ... yeah ... erm ... right ...

It`ll take me a while to find MBAM, is it staring me in the face on spybot somewhere?
Ok, i`ll say it i`m confused.

oh and Tarq57 ... as I said i`m out of my depth, I wouldn`t know how to post the log on here.

I have not ticked the Tea Time option as asked by bobo1 before I installed something ...
AND do I Create Registry Backup as asked by a box that pops up, seam a reasonable thing to do. $:-\$

Tarq57 · « **Reply #18 on:** November 21, 2009, 12:41:48 AM »

MBAM is download-able via the link titled "here" at this post.
It has nothing to do with Spybot, although the nature of the program and its purpose is similar. (A bit like saying a Chevy is the same as a Honda. They're both vehicles, and there the similarity ends.)

Circlip · « **Reply #19 on:** November 21, 2009, 01:16:43 AM »

Hmmm... I can`t download mbam-setup.exe or my PC wont because the setup files are corrupted. Please obtain a new copy of program it is asking.

Now going to try SAS now ... and I have to log off all windows programs.

Might crack open a bottle of Malt Whisky at some point tonight.

Later ... Circlip

Tarq57 · « **Reply #20 on:** November 21, 2009, 02:12:01 AM »

Do you have a clean computer you can download the setup file (for MBAM) with?
If so, save it to a flash drive on that computer, and when prompted at the beginning of the download, save it as "circlip.exe".
transfer it from the flash drive to the desktop of your computer, then run it, see if it will install.
Post back.

Circlip · « **Reply #21 on:** November 21, 2009, 02:34:31 AM »

whoa whoa whoa ... I`ve now downloaded SAS and have done a scan.

And whoa whoa whoa again ... whats flash drive?

The best I can do is just dot down what SAS has found and put that up on here ...
like this:-

Adware Vundo Varient 3
Unclassified Uknown origin 1
Trojan.FakeAlert-IEBT 3
Trojan.Smitfraud Variant/IE Antispyware 1
Adware.TrackingCookie 7
Trojan.Media-Code c/V4 2
Adware.Vundo Varient/Rel 3

Thats on a quick scan and it`s took half an hour.

So what do I do now?

Oh by the way the Whisky is good

Circlip

DavidR · « **Reply #22 on:** November 21, 2009, 03:30:48 AM »

Flash Drive = USB Stick of Flash Memory, a.k.a. Flash Drive.

The reason it was suggested is if your system was infected it might no have been able to access security sites to download it. So if you had access to a known clean PC you could have used that to download MBAM and copy to a Flash Drive so it can be transferred to the infected system.

What to do next:
Let SAS deal with the detections it has found, then try to download and run MBAM.

MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later. Download it, install, update and run it and report the findings (it should product a log file).

bobo1 · « **Reply #23 on:** November 21, 2009, 04:04:52 PM »

Hi,
Remove what malware bytes has found. Did you run this in safe mode ? as this is inportant to remove all malware as in safe mode only the basic operating system is running without the malware running on normal boot process. Run spybot search and destroy also in safe mode also! ( Access safe mode by hitting F8 all the time as the computer is booting and select safe mode only. and click on as Administrator default NO PASSWORD ) once clean try re installing avast and do a boot time scan.

Pondus · « **Reply #24 on:** November 23, 2009, 10:16:18 PM »

Quote

Remove what malware bytes has found. Did you run this in safe mode ?

@bobo1
Malwarebytes is not recomended to be run in safe mode

http://www.malwarebytes.org/forums/index.php?showtopic=5590

http://www.bleepingcomputer.com/forums/index.php?s=&showtopic=259717&view=findpost&p=1435912

Tarq57 · « **Reply #25 on:** November 23, 2009, 10:41:09 PM »

@bobo 1,
At this stage the OP hasn't yet indicated if they can even get MBAM installed. So we're waiting for that.

Circlip · « **Reply #26 on:** November 24, 2009, 09:22:10 AM »

Morning folks,

As I had problems downloading spybot I then went to malwarebites and downloaded that. I did a scan though NOT in safe mode. This came up with a few things mentioned in the post on 21st Nov. I then downloaded spybot and did scan in safe mode, still the annoyance that i`ve got large size 3D fuzzy page and desktop window has a black background, though I wasn`t bothered.
This found 7 different problems and one of those is this: 1 entries malware (SBI $C490BA88)IE Toolbar ... HKEY_USERS\S-1-5-21-727277332-2133720857-1....
The others are very similar and must mean something to someone but

Also Virtumonde had three things I deleted and another 3 Zlob.Downloader.vdt. All these were in Registry either value, key or file. It gets very confusing but as I said 7 problems sorted.

So then to do a scan with malwarebites in safe mode (adminstrator) as I hadn`t read the messages left by Pondus ... whoops!
I just followed the instructions = English (US) Ok and then an update box = yes. Then a new box, Protect Home Page (!!!) = yes as it was recommended to do so.

Oh! this scan was completed very quickly. No harmfull software was detected

I will now re-install avast as recommended by bobo1 ... a boot time scan ... is that in safe mode or not?

Cheers Circlip

Tarq57 · « **Reply #27 on:** November 24, 2009, 10:47:38 AM »

I think you may be getting MBAM and SAS mixed up.
SAS has the option to "protect home page", MBAM does not.

Quote from: Circlip

...The others are very similar and must mean something to someone but...

Maybe they would, if you posted the needed information.
Please attach the recent scan reports from SAS and MBAM (if you have actually run both of them) by using the "additional options" button at the lower left of the forum "reply" area, with your next reply.

These reported infections are potentially serious. Worst case scenario, you could basically loose all your files.
Please be specific and accurate in your answers; the quality of help you might get depends on it.

bobo1 · « **Reply #28 on:** November 24, 2009, 02:31:29 PM »

I would try & run avast in safe mode, virtumonde is very bad! & outright dangerous. And at least run spybot search and destroy in safe mode. Normally when i service computers with a bad case of viruses or spyware will normally go and end up formatting the computer and throw in the towel! as some spyware is very hard to get rid of. In your case its bad! Need a hijack this log to read what start up processes that is on your computer. Hijack this can be downloaded from trend micro.

DavidR · « **Reply #29 on:** November 24, 2009, 02:37:45 PM »

Why suggest a scan in safe mode for avast when the user can schedule a boot-time scan which is even better.