Help! Vista Security 2011

[zetland01]

Hello. I've been infected with Vista Security 2011. I have tried to run Malwarebytes in Safe Mode but it wouldn't allow me to. I then uninstalled it and tried to run it again by renaming the file to install.exe and install.com but it still wouldn't work.

I identified the virus program as rmi.exe and deleted it, but it still runs some how. I can kill it via Task Manager but anytime I try to open Malwarebytes or Internet Explorer I get the pop-ups again and rmi.exe pops up as a process in Task Manager.

Please can you help? Thanks in advance!

I have run the DDS program and here are the results:

.

DDS (Ver_11-03-05.01) - NTFSx86 NETWORK

Run by user at 13:02:20.60 on Wed 03/30/2011

Internet Explorer: 8.0.6001.19019 BrowserJavaVersion: 1.6.0_23

Microsoft

[MrCharlie]

Welcome to the forum.

Carefully read and follow this Guide.

Make sure you run rkill and then immediately run MBAM as desribed.

Most important....update MBAM before you run it.

Post the logs back here, Let me know....MrC

[zetland01]

Fantastic!! Rkill worked and I'm running Malwarebytes now. I'll post the logs when it's complete.

Many thanks!

[MrCharlie]

Great MrC

[zetland01]

Hi MrC,

Here is the log from MBAM, do I need to do anything else now?

Thanks!

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6214

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 8.0.6001.19019

3/30/2011 2:58:30 PM

mbam-log-2011-03-30 (14-58-30).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|)

Objects scanned: 368297

Time elapsed: 1 hour(s), 3 minute(s), 12 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 5

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Users\user\AppData\Local\rmi.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\user\AppData\Local\Temp\Low\windowsupdate.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\Users\user\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

c:\Users\user\Desktop\uSeRiNiT.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

c:\Users\user\Desktop\WiNlOgOn.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

[MrCharlie]

Yes we have to run ComboFix because these infections are often bundled with other malware and it's important that we check for it.

The most important things to remember when running ComboFix is download and run it from your desktop and make sure you disable your anti-virus programs before you run it.

----------------------

Please download and run ComboFix:

A few notes first:

[*]ComboFix is compatible exclusively with XP and W2K (32-bit only) <===> Vista and Windows 7 (32-bit and 64-bit)

[*]ComboFix must be run from an Administrative account.

[*]Vista and W7 users - Right click, choose "Run as Administrator"

[*]It must be downloaded to and run from your desktop.

[*]Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can and will interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". (see below)

[*]ComboFix Guide <---please read!

Download ComboFix from one of these locations: (you may have to use right click > save target as)

[*]Link 1

[*]Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon and choose disable/exit.

More info HERE<-------

They may interfere with the running of ComboFix.

Note: If you have AVG or CA Internet Security Suite installed, due to recent changes in how these AV's target the tool's internal files, they must be uninstalled before running ComboFix. If you have difficulty uninstalling the AV, download and run Opswat AppRemover

[*]Double click on ComboFix.exe & follow the prompts.

[*]Note: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

[*] Note: If you have SP3, use the SP2 package.

If Vista or Windows 7, skip the Recovery Console part

[*]ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

[*]Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

[*]**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

[*]1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

[*]2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

[*]3. Combofix permanently prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security.

Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. Read USB-Based Malware Attacks and Please disable Autorun ASAP!.

[*]4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If a reboot doesn't restore your connection, please try this:

Check HERE

For XP systems download and run WinSockFix and Here

Vista users: Check HERE

Windows 7 systems: Download and run this Winsockfix.bat

[*]5.Give ComboFix at least 20-30 minutes to finish if needed.

MrC

[zetland01]

Hi MrC,

Here you go:

ComboFix 11-03-29.06 - user 03/30/2011 16:19:47.1.2 - x86

Microsoft

[MrCharlie]

Please do this:

1. Close any open browsers. (If ComboFix wants to update.....please allow it to.)

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::

c:\windows\System32\drivers\qesd.sys

c:\windows\system32\drivers\hdidpdiq.sys

Driver::

ksxm

hdidpdiq

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

After reboot, (in case it asks to reboot)......

Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply.

MrC

[zetland01]

Hi MrC,

After I drag the CFScript into ComboFix.exe do I then run ComboFix again, then reboot?

Thanks

[zetland01]

Sorry never mind - it started running automatically after I dragged it in

[MrCharlie]

That's correct...you got it right, MrC

[zetland01]

Hi MrC,

It performed an auto reboot and here is the log:

ComboFix 11-03-29.06 - user 03/30/2011 17:10:54.2.2 - x86

Microsoft

[MrCharlie]

Looks Good...Well Done

Update and run a Quick scan with MBAM...post the log and let me know how it is, MrC

[zetland01]

Great!! Thanks so much MrC!! You're the man!!

Here are the results from the MBAM Quick Scan:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6218

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.19019

3/30/2011 6:03:21 PM

mbam-log-2011-03-30 (18-03-21).txt

Scan type: Quick scan

Objects scanned: 164257

Time elapsed: 3 minute(s), 12 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[MrCharlie]

Once in a while I get one right!

Please Uninstall ComboFix:

Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

----------------------

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any questions...please post back.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[zetland01]

Thanks very much MrC!! You're help is very much appreciated!

One last question - what are your thoughts on Apple Mac? Is that a better way to avoid all these viruses and malware??

[MrCharlie]

I don't have one but my cousin has one and it was very impressive, and yes you avoid all the viruses and malware from what I understand.

MrC

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.