Windows XP 2011 security virus

[liam123]

Everytime I log onto my PC I keep getting a pop-up message for Automatic Updates on the taskbar on the bottom right of the screen. Once you click on this balloon, you then get a pop up box on screen saying you need to Update to Windows XP 2011, once you have clicked on this the virus starts scanning your computer and finding 30 or so errors. You have the option of buying the Windows Update or continuing without protection. At first the virus was stopping me from logging onto the Internet. I logged onto another User Area on same computer and was able to open the internet. I have downloaded a couple of free Virus Scans (AVG and PCTools) but they haven't been able to remove the virus. Does anyone know what will get rid of it?.

Help would be much appreciated.

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

[liam123]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6562

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

13/05/2011 05:42:47

mbam-log-2011-05-13 (05-42-47).txt

Scan type: Full scan (C:\|)

Objects scanned: 416915

Time elapsed: 5 hour(s), 3 minute(s), 40 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\system volume information\_restore{e32051ca-753f-4701-8962-e1d70d7bd61f}\RP1011\A0109958.exe (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.

[liam123]

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6562

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

13/05/2011 05:42:47

mbam-log-2011-05-13 (05-42-47).txt

Scan type: Full scan (C:\|)

Objects scanned: 416915

Time elapsed: 5 hour(s), 3 minute(s), 40 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\system volume information\_restore{e32051ca-753f-4701-8962-e1d70d7bd61f}\RP1011\A0109958.exe (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.

Here is the scan log:

DDS.txt

[liam123]

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6562

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/05/2011 19:06:01

mbam-log-2011-05-12 (19-06-01).txt

Scan type: Quick scan

Objects scanned: 234297

Time elapsed: 24 minute(s), 49 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 3

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 6

Files Infected: 6

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\AppID\activex.DLL (Adware.180Solutions) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Liam\Local Settings\Application Data\yli.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.

Folders Infected:

c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0} (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults\preferences (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\program files\questbrwsearch (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\questbrwsearch (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Files Infected:

c:\documents and settings\Liam\application data\microsoft\stor.cfg (Malware.Trace) -> Quarantined and deleted successfully.

c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome.manifest (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\install.rdf (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome\questbrowse.jar (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults\preferences\prefs.js (Adware.QuestBrowse) -> Quarantined and deleted successfully.

c:\program files\questbrwsearch\uninstall.exe (Adware.QuestBrowse) -> Quarantined and deleted successfully.

This is the results from the Quick scan the one i posted before was from a full scan

[screen317]

Hi,

I notice that you are using more than one antivirus program (Spyware Doctor and Microsoft Security Essentials). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[liam123]

Hi,

Have been to Add or Remove Programs but cannot find Spyware Doctor to unistall, tried to run ComboFix but it wont let me. It says please disable MSE and Spyware Doctor first.

Not sure what to do now.

Really appreciate your help.

[screen317]

Hi,

Grab a fresh copy of ComboFix and save it to your Desktop. Do not run it yet.

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Click Start --> Run, and enter this command:

"%userprofile%\desktop\ComboFix.exe" /killall

Click through any prompts you receive and see if ComboFix will run now.