Computer Infected

[neildit]

First just want to say hi and thanks for the great work.

I am working on an infected computer and each time I try to run any of the requested programs under the topic "I'm infected - What do I do now?", the machine crashes. This is a 32bit Vista Home Premium machine. When running GMER it's showing the nc.exe and checker.exe programs being run. But as I previously stated, any time I attempt to save logs the machine crashes(blue screen). I need a place to start to get you guys logs so I can clean this up. I look forward to any assistance provided. Thanks!

[Maniac]

Hello neildit! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  

What about DDS and Defogger? If not, try again in Safe Mode with Networking:

http://www.microsoft.com/resources/documen...t_failsafe.mspx

[neildit]

Hi Borislav. Thank you for your asistance.

I was able to run both today and have attached the logs.

Logs.zip

[Maniac]

What about Attach.txt ?

[neildit]

When the program ran it never brought about an attach.txt file. The system only comes up with the log files thta I previously attached.

[Maniac]

Try again. There is DDS log only.

[neildit]

Reran the dds and have attached both files. Kept crashing the other days when it would get to the attach file.

Attach.zip

DDSLog.zip

[Maniac]

Step 1

First of all, you should not have more than one anti-virus program installed as they will conflict and cause problems. You have two so you need to uninstall one of them. Of the two, I would recommend keeping AVG 8.5 , so please uninstall:

Norton AntiVirus

Norton AntiVirus Help

Norton Confidential Core

Norton Internet Security

Norton Internet Security (Symantec Corporation)

Norton Protection Center

Norton Security Scan

Norton Security Scan (Symantec Corporation)

LiveUpdate (Symantec Corporation)

Step 2

Please, uninstall the following applications:

1. Adobe Reader 8.1.2
   

You can read, how to do this here:

• Windows XP
  
• Windows Vista
  
• Windows 7
  

Step 3

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Windows\Sun
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java
  

Step 4

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

1. JavaRa log
   
2. Malwarebytes' Anti-Malware log
   
3. a new fresh DDS log only
   

[neildit]

Followed all steps and attached logs as requested.

JavaRaLog.zip

MalwarebytesLog.zip

NewDDSLog.zip

[Maniac]

How are things after Malwarebytes' Anti-Malware?

[neildit]

Computer is no longer crashing and the Adam12 popup is no longer showing so great signs! I did try to run Microsoft Update and I keep getting error 80072EFE.

[neildit]

One more thing, I still am getting redirected at times away from any Microsoft update sites. I went in to download sp3 and got redirected to a different site. Regular sites like cnn.com, foxnews.com, amazon.com, etc., work fine though.

[neildit]

I looked into my issue with not being able to run Windows Update and found the tdsskiller program from Kaspersky. It found one item which was removed at bootup. I ran Windows Update which is now running! I hope I didn't screw up the whole process but it did fix that issue

[Maniac]

It's alternative way, too. Good!

Last steps:

Step 1

To enable CD Emulation programs using DeFogger please perform these steps:

1. Please download DeFogger to your desktop.
   
2. Once downloaded, double-click on the DeFogger icon to start the tool.
   
3. The application window will now appear. You should now click on the Enable button to enable your CD Emulation drivers
   
4. When it prompts you whether or not you want to continue, please click on the Yes button to continue
   
5. When the program has completed you will see a Finished! message. Click on the OK button to exit the program.
   
6. If CD Emulation programs are present and have been enabled, DeFogger will now ask you to reboot the machine. Please allow it to do so by clicking on the OK button.
   

Step 2

Please manually delete Defogger, JavaRa, DDS and GMER.

Step 3

Please download and install the latest version of Adobe Reader from:

www.adobe.com

About Java:

www.java.com/en

Step 4

Some malware preventions:

http://forums.malwarebytes.org/index.php?showtopic=9365

Safe surfing!

[neildit]

Awesome!! Thank you so much for all the help!!

[Maniac]

You're welcome!

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!