HiJacked / Virus ???

[sarge212]

Running current ver of WebRoot AntiVirus w/ spysweeper 2010...wont buy this one again!!!...Ran full scan and found nothing...OK, it portrays itself as a solicitation to download Antivirus software, it throws up a fake scan and has constant red/white window pop up saying wuauclt.exe is infected, along with a box in lower right corner popping up saying Antivirus Alert - Infiltration alert and wants a yes or no to run a scan?...The only way i can get IE to work is to shut down and restart and then very quickly do cntrl-shft-esc and end the process of appjlenusbs.exe..then each time i have to go to LAN settings and uncheck proxy server and select auto detect...this the only way to get IE working......does anyone recognize "appjlenusbs.exe"??...and how to rid it???.....taskmgr is disabled as well... fairly new LP running Win 7.

[Maniac]

Hello sarge212! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  

Step 1

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Admin

You only need to get one of them to run, not all of them.

• rkill.exe
  
• rkill.com
  
• rkill.scr
  
• WiNlOgOn.exe
  
• uSeRiNiT.exe
  
• iExplore.exe
  

Please post the log in your next reply.

Note: The log can be found at the root of your installed hard drive entitled rkill.log

Step 2

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

1. RKill log
   
2. Malwarebytes' Anti-Malware log
   

[sarge212]

Hello sarge212! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  

Step 1

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Admin

You only need to get one of them to run, not all of them.

• rkill.exe
  
• rkill.com
  
• rkill.scr
  
• WiNlOgOn.exe
  
• uSeRiNiT.exe
  
• iExplore.exe
  

]Thanks for responding Borislav....i tried running all the above programs u mentioned..but i cant get any of them to run..it showed each one was 703kb in size and appeared to download...but after it only took a couple of secs for each i went and checked and no sign of them??...i hope im doing it right?

Please post the log in your next reply.

Note: The log can be found at the root of your installed hard drive entitled rkill.log

Step 2

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

1. RKill log
   
2. Malwarebytes' Anti-Malware log
   

[Maniac]

I'm waiting your reply.

[sarge212]

I'm waiting your reply.

Sorry Borislav, i did reply...but i squeezed it into the middle of ur post...guess i should have put it at the bottom...my mistake...again my aplogies...i tried downloading the rkill files and it appeared as though it did..but i cant see any evidence of them..???...it showed each one was identical 703kb..is that right?

[Maniac]

Yes, it is. Just, choose one of them and try to run it, if not try another one with different extension - .scr .com and etc.

[sarge212]

Yes, it is. Just, choose one of them and try to run it, if not try another one with different extension - .scr .com and etc.

.

OK...as instructed, I downloaded the rkill.exe file and saved to my desktop...I tried running it both from the desktop and the DOS side and each time i get a screen that says its working please be patient...this is the screen that appears...i let it run for 3 hours..twice??...I will try to download a diff one and see if i get same result...any other suggestions?...well!! i tried pasteing a pic of the screen shot, but it wont let me.

[Maniac]

• Download OTL to your desktop. Otherwise, try OTL.com or OTL.scr .
  
• Double click on the icon to run it. Make sure all other windows are closed to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
    

Once OTL has completed its first scan it will save notepad copies of the scans in the folder that OTL was started from. Unless set to produce an Extras log it will only produce OTL.txt in subsequent scans.

A copy of an OTL fix log is saved in a text file at

• :\_OTL\Moved Files
  • in most cases this will be C:\_OTL\Moved Files
    

[LDTate]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!