chriscks Posted June 17, 2010 ID:268793 Share Posted June 17, 2010 Help please, ran Microsoft windows Malicious software removal too it foune virus : win32/alureon.h, it partially removed and told me to scan with anti virus tool I scaned with avg and it voune virus html/framer . I then scaned my root with avg anti-rootkit scan and it found hidden driver c:\windows\system32\mpenginestore\mpksl6dd53639.sys and my choices are to remove selected infections. this is where I'm at now, My system restore show its on, I do not want to reboot yet until someone looks at this to make sure I'm clean, I ran hijack copied to desktop but can't get them to upload to here. new to this please help Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 17, 2010 Root Admin ID:268896 Share Posted June 17, 2010 Please run the GMER and DDS scans as requested here and post back the logs.http://forums.malwarebytes.org/index.php?showtopic=9573 Link to post Share on other sites More sharing options...
chriscks Posted June 18, 2010 Author ID:269376 Share Posted June 18, 2010 how long should GMER take to run, I think my computer froze Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 18, 2010 Root Admin ID:269405 Share Posted June 18, 2010 It's possible. Restart your computer and try unchecking a couple items. If it still will not run then let me know.You can also try this one.RootRepeal - Rootkit DetectorClose ALL applications and as many items in the task tray that will stop and exit.Please download the following tool: RootRepeal - Rootkit DetectorDirect download link is here: RootRepeal.rarIf you don't already have a program to open a .RAR compressed file you can download a trial version from here: WinRARExtract the program file to a new folder such as C:\RootRepealRun the program RootRepeal.exe and go to the REPORT tab and click on the Scan buttonSelect ALL of the checkboxes and then click OK and it will start scanning your system.If you have multiple drives you only need to check the C: drive or the one Windows is installed on.When done, click on Save ReportSave it to the same location where you ran it from, such as C:\RootRepealSave it as your_name_rootrepeal.txt - where your_name is your forum nameThis makes it more easy to track who the log belongs to.Then open that log and select all and copy/paste it back on your next reply please.Quit the RootRepeal program. Link to post Share on other sites More sharing options...
chriscks Posted June 18, 2010 Author ID:269444 Share Posted June 18, 2010 Its scanning now thanks for helping me with this. I will post when it finishes its scan and I get it all together Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 18, 2010 Root Admin ID:269499 Share Posted June 18, 2010 Okay, sounds good. Thanks. Link to post Share on other sites More sharing options...
chriscks Posted June 18, 2010 Author ID:269996 Share Posted June 18, 2010 OK when GMER completes and I save file as ark.txt the computer freezes Link to post Share on other sites More sharing options...
chriscks Posted June 18, 2010 Author ID:270032 Share Posted June 18, 2010 Trying RootRepeal now Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 19, 2010 Root Admin ID:270036 Share Posted June 19, 2010 What operating system are you running and is it x86 32-Bit or x64 64-Bit ? Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270040 Share Posted June 19, 2010 windows xp 32bit Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270058 Share Posted June 19, 2010 Here are my logs chrisckrootrepeal.txt DDS.txt chrisckrootrepeal.txtdd.txt Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270063 Share Posted June 19, 2010 wow guess I don't know how to copy and paste on here Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 19, 2010 Root Admin ID:270074 Share Posted June 19, 2010 You have what appears to be 2 different Anti-Virus programs running. You also have what may be a mixed installation of them.For now please choose one of them and fully remove it. You can only install and run one Anti-Virus program as they conflict with each other.Then after you've removed one follow the instructions below.Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.---------------------------------------------------------------------------------------------Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.--------------------------------------------------------------------------------------------- Download ComboFix from below:Combofix download* IMPORTANT !!! Place combofix.exe on your DesktopDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.You can get help on disabling your protection programs hereDouble click on combofix.exe & follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:The Recovery Console was successfully installed.Click on Yes, to continue scanning for malware.Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next replyNote:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.---------------------------------------------------------------------------------------------Ensure your AntiVirus and AntiSpyware applications are re-enabled.--------------------------------------------------------------------------------------------- Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270079 Share Posted June 19, 2010 I have a good computer right next to the one that is infected. Its the one I've been using to do all this with, I've been using cd drive to transfer all the info to you, can I transfer combo fix to cd and put on infected desk top and run Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 19, 2010 Root Admin ID:270083 Share Posted June 19, 2010 Yes you may. That will work just fine.Just be careful transferring files back and forth as you can easily infect the "clean" system. Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270086 Share Posted June 19, 2010 I have avg anti on my computer, I opened remove program files and I do not see any other anti virus program to remove, I recently removed macafee using add and remove programs. Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270116 Share Posted June 19, 2010 Ok have combo fix on my infected computer but still don't know how to get the other anti virus program running off the system. and again thanks for all the help so far Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 19, 2010 Root Admin ID:270124 Share Posted June 19, 2010 Go ahead and try to run CF for now and if we run into problems we'll take care of it then. Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270165 Share Posted June 19, 2010 Ok started combo fix and it has detected the following real time scanner to be active: antivirus: McAfee Anti-Virus and Anti-Spywareplease disable these scanners before clicking ok Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 19, 2010 Root Admin ID:270199 Share Posted June 19, 2010 Yes, but there is a link as well in the post to another post to show you how to disable the AV. Please follow that link and disable the one that you think is installed and now the main AV. Then click OK and continue. Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270265 Share Posted June 19, 2010 it ws to update cobofix should I say yes Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270266 Share Posted June 19, 2010 says newer version of cobofix available would you like to update Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270345 Share Posted June 19, 2010 I just used the version I had its running right now Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270361 Share Posted June 19, 2010 Here is log: chrisckscombolog.txt Link to post Share on other sites More sharing options...
chriscks Posted June 19, 2010 Author ID:270389 Share Posted June 19, 2010 well my windows update is back, system still sluggish, I stopped windows firewall and it still says mcafee fire wall is on in my security center, and under virus protection it shows windows found more than one antivirus program on my computer. but when I do a search for mcafee it come up with no files. oh and my task bar is back blue again. again thanks for all your help Link to post Share on other sites More sharing options...
Recommended Posts