[Closed] Windows Antivirus Pro

I've got the dreaded Window Antivirus Pro popping up on my XP machine. I have tried to shut it don with the windows task monitor, but it just pops back up. I shut down both prosesses but does not stop the program. I cannot run malwarebytes antimalware. Help.

unhide files and folders.

• Double-click My Computer.
• Click the Tools menu, and then click Folder Options.
• Click the View tab.
• Clear "Hide file extensions for known file types."
• Under the "Hidden files" folder, select "Show hidden files and folders."
• Clear "Hide protected operating system files."
• Click Apply, and then click OK.

Then do this:


Navigate to your c:\documents and settings\all users\application data folder

Look for a folder with a random 8 digit number ie 19285624 (your number will be different)

Drag this folder c:\documents and settings\all users\application data\19285624 to the desktop (drag - not delete)

Reboot.

then try and run these programs


run them in safe mode if you need to - rename them to a .com extension if you need to.

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries


NEXT

We Need to check for Rootkits with RootRepeal

• Download RootRepeal from the following location and save it to your desktop.
  
  • Zip Mirrors (Recommended)
    
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
  • Rar Mirrors - Only if you know what a RAR is and can extract it.
    
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
• Extract RootRepeal.exe from the archive.
• Open [external image: Posted Image] on your desktop.
• Click the [external image: Posted Image] tab.
• Click the [external image: Posted Image] button.
• Check all seven boxes: [external image: Posted Image]
• Push Ok
• Check the box for your main system drive (Usually C:), and press Ok.
• Allow RootRepeal to run a scan of your system. This may take some time.
• Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

NEXT

Please run this batch file:

• Go to Start->Run and type in notepad and hit OK.
• Then copy and paste the content of the following codebox into Notepad:
  
  

  @ECHO OFF
  DIR /a/s C:\WINDOWS\scecli.dll C:\WINDOWS\netlogon.dll C:\WINDOWS\ntelogon.dll C:\Windows\eventlog.dll>Log.txt
  START Log.txt
  DEL %0

• Save the file to your DESKTOP as "find.bat". Make sure to save it with the quotes.
• Once saved, the icon to click should look like this on your desktop:
  
  [external image: Posted Image]
  
• Double click find.bat. to run it. A small black box should open and close - this is normal.

Post the content of the resulting log.


if one of these steps fail - move on to the next…post what you can

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log