I'm infected with some sort of malware

[chefboyclakie]

I have been infected with some sort of malware or virus that will not let me open up any programs. I can not open up my antivirus software, it ask what program I want to use to open it. I can get onto the internet and into my e-mail, I can open up documents on my computer just cannot open any exe programs. I can download but cannot install so am not able to run any antivirus at all. I am running windows Vista Home edition

Please help

[Maniac]

Hello chefboyclakie! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  
• Post all of your log files, don't attach them.

Download DDS and save it to your desktop from here, here or here

Double click dds to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
     
  2. Attach.txt
     

  [*]Save both reports to your desktop. Post them back to your topic.

[chefboyclakie]

Okay

Here are the reports that u requested

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Jean-Claude at 9:14:39.51 on 02/04/2011

Internet Explorer: 8.0.6001.19019 BrowserJavaVersion: 1.6.0_23

Microsoft

[Maniac]

Step 1

Please, uninstall the following applications:

1. MediaBar
   

You can read, how to do this here:

• Windows XP
  
• Windows Vista
  
• Windows 7
  

Step 2

I see the Ask Toolbar in your log.

I strongly recommend you remove Ask Toolbar from your computer because:

• It promotes its toolbars on sites targeted at kids.
  Fs-KgBd-It promotes its toolbars through ads that appear to be part of other companies' sites.
  
• It promotes its toolbars through other companies' spyware.
  
• At-Bd-It is Installed without any disclosure whatsoever and without any consent from the user whatsoever.
  
• It Solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.
  
• It makes confusing changes to user's browsers -- increasing Ask's revenues while taking users to pages they didn't intend to visit.
  

You can read more about Ask.com here

To remove it:

Click Start-->-Control Panel-->Programs and Features

Click on the program name AskBarDis to highlight it

From the menu at the top, select Uninstall or Remove.

Please reboot the computer.

Step 3

Going over your logs I noticed that you have LimeWire installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  
• They are a security risk which can make your computer susceptible to a smorgasbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.

I would recommend that you uninstall LimeWire, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Step 4

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)

There are seven different versions. If one of them won't run then download and try to run the other one.

Vista and Windows 7 users need to right-click and choose Run as Administrator

You only need to get one of them to run, not all of them.

1. rkill.exe
   
2. rkill.com
   
3. rkill.scr
   
4. eXplorer.exe - This renamed copy may trigger an alert from MBAM. It can be ignored and is safe.
   
5. iExplore.exe
   
6. WiNlOgOn.exe
   
7. uSeRiNiT.exe
   

Once you've gotten one of them to run then try to immediately run the following:

• Launch Malwarebytes' Anti-Malware
  
• Go to Update" tab and select Check for Updates.
  
• Go to Scanner tab and select Perform Quick Scan, then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

In your next reply, please post the following logs:

1. Malwarebytes' Anti-Malware log
   
2. a new fresh DDS log only
   

[chefboyclakie]

Okay

I uninstalled mediabar and limewire

I couldn't find AskBarDis but i uninstalled the limewire toolbar that was published by ask.com

I tried to install and run all 7 files u suggested, and only rkill.com started running.

The cmd window popped up, but nothing was happening for a few minutes so I closed the window.

Now Its not starting

what should i do now?

[chefboyclakie]

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Jean-Claude at 11:21:00.54 on 02/04/2011

Internet Explorer: 8.0.6001.19019 BrowserJavaVersion: 1.6.0_23

Microsoft

[chefboyclakie]

Hey Borislav

The computer started working properly on its own an hour ago.

To be safe, I tried to run the rkill software.

But everytime I tried to run it, my antivirus would detect a malware threat.

Should I run it anyway?

[Maniac]

Yes, please.

[LDTate]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!