I'm infected and I don't know how to get rid of it...

[Magnetdragon]

So I've tried to open MBAM and every time I follow these instructions (XP Antivirus Removal) it would start to scan for 2 seconds and then just stop... Plz help and it also won't let me open a lot of programs and would give me messages like the application was not found... Any help would work...

[gringo_pr]

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

• 1.Please do not run any other tool untill instructed to do so!
  2.Please reply to this thread, do not start another!
  3.Please tell me about any problems that have occurred during the fix.
  4.Please tell me of any other symptoms you may be having as these can help also.
  5.Please try as much as possible not to run anything while executing a fix.
  

If you follow these instructions, everything should go smoothly.

I would like to get a better look at your system, please do the following so I can get some more detailed logs.

DeFogger:

• Please download

DeFogger to your desktop.
Double click DeFogger to run the tool.

• The application window will appear
  
• Click the Disable button to disable your CD Emulation drivers
  
• Click Yes to continue
  
• A 'Finished!' message will appear
  
• Click OK
  
• DeFogger may ask you to reboot the machine, if it does - click OK
  

Do not re-enable these drivers until otherwise instructed.

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Download DDS:

• Please download DDS by sUBs from one of the links below and save it to your desktop:
  
  Download DDS and save it to your desktop
  

Link1
Link2
Link3
Please disable any anti-malware program that will block scripts from running before running DDS.

• Double-Click on dds.scr and a command window will appear. This is normal.
  
• Shortly after two logs will appear:
  
  • DDS.txt
    
  • Attach.txt
    

  [*]A window will open instructing you save & post the logs

  [*]Save the logs to a convenient place such as your desktop

  [*]Copy the contents of both logs & post in your next reply

Gmer

Download GMER Rootkit Scanner from here.

• Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
  
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO
  
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  
  • IAT/EAT
    
  • Drives/Partition other than Systemdrive (typically C:\)
    
  • Show All (don't miss this one)
    

  [*]Then click the Scan button & wait for it to finish

  [*]Once done click on the [save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file

  [*]Save it where you can easily find it, such as your desktop, and post it in reply

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Note: Do not run any programs while Gmer is running.

information and logs:

• In your next post I need the following
  
  • 1.logs from DDS
    2.log from GMER
    3.let me know of any problems you may have had
    

Gringo

[Magnetdragon]

When I tried to open and run Defogger, it wouldn't let me run it because I had to search for a program to run it. So I just right clicked it and pressed Run As... And it opened but after I clicked Disable and the yes button, I get an error that says Unable to run/create file.

[gringo_pr]

Hello

It's most likely the rogueware is preventing programs as well as our tools from running. The following tool will hep running them.

Scan with exeHelper:

Please download exeHelper to your desktop.

• Double-click on exeHelper.com to run the fix.
  
• A black window should pop up, press any key to close once the fix is completed.
  
• Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)
  

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

If you have an active internet connection, copy/paste the links below into your browser, don't click them or the rogue might redirect. If you don't have an active internet connection, download the tools from another machine, and transfer them to the affected machine via USB flash drive.

There are 4 different versions. If one of them won't run then download and try to run the other one. You only need to get one of them to run, not all of them.

Vista and Win7 users need to right click and choose Run as Admin

http://download.bleepingcomputer.com/grinler/rkill.exe

http://download.bleepingcomputer.com/grinler/rkill.com

http://download.bleepingcomputer.com/grinler/rkill.scr

http://download.bleepingcomputer.com/grinler/rkill.pif

Note: You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message. Run rkill repeatedly until it's able to do it's job. This may take a few tries. You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.

At this point, you should now be able to run analysis tools.

Once the tool has run, do NOT reboot the machine, and then try once again to run DDS and GMER and send me the reports

If for some reason the machine reboots, repeat the process. Again, try not to restart the machine.

gringo

[gringo_pr]

Hello

three day bump

It has been Three days since my last post.

• do you still need help with this?
  
• do you need more time?
  
• are you having problems following my instructions?
  
  
• if after 24hrs you have not replied to this thread then it will have to be closed!
  

Gringo

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!