Hey gang. I was refered here by someone who thought I could get help to rid my PC of these Total Security issues.
It's a rogue spyware….telling me my computer is infected and I need to download their stuff or let their scan run to get rid of the problems.
I've tried a load of methods. I got the darn thing while I was running Avast. It disables my anti spyware/virus software and prohibits my ability to get task manager open to stop it. It also disables add/remove programs, while it is running and even kicks me out of certain web pages that might assist with the issue.
I figured out that for the 1st 30 seconds or so, upon start up, I can use cntrl+alt+del to get task manager up and stop the Total Security malware. However, even the other anti spyware softwares I've downloaded are still disabled by this thing. I tried Avira, MalwareBytes anti malware, and removed my Avast, reinstalled it, then did a Bootscan that didn't remove the Total Security.
I was able to get Vipre anti spyware to load and run and perform a scan, but this did not remove the Malware.
I've been to bleepingcomputer.com, avast's forums, xp-vista.com…and other pages. Nothing has helped.
Any tips from the experts here?
Thanks in advance for any help.
In the right panel, you will see several boxes that have been checked. Uncheck the following …
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
NEXT
Download RootRepeal from the following location and save it to your desktop.
Open [external image: Posted Image] on your desktop.
Click the [external image: Posted Image] tab.
Click the [external image: Posted Image] button.
Check all seven boxes: [external image: Posted Image]
Push Ok
Check the box for your main system drive (Usually C:), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.
NEXT
Please download Sysprot Antirootkit from >>>HERE<<<
Unzip it into a folder on your desktop.
Double click Sysprot.exe to start the program.
Click on the Log tab.
In the Write to log box select ALL ITEMS
Look near the bottom left, and Check Hidden Objects Only
Click on the Create Log button on the bottom right.
After a few seconds a new window should appear.
Select Scan Root Drive. Click on the Start button.
When it is complete a new window will appear to indicate that the scan is finished.
The log will be saved automatically in the same folder Sysprot.exe was extracted to.
Open the text file and copy/paste the log here.
NEXT
Please download DDS from LINK 1 or LINK 2
and save it to your desktop.
Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:
DDS.txt Attach.txt.
NOTE: If one of these programs will not run - move on to the next - post the logs you can
CatByte….thanks for the tips. This looks like 2-3 hours of work, so I won't have time for it tonight. But I'll dig in after work tomorrow. Thanks again. Will follow up, when I have stuff to post.
*Edit, adding- >Here's the copy of the first step/notepad….
Log file is located at: C:\Documents and Settings\Jason _____\Desktop\Win32kDiag.txt
Removing all found mount points.
Attempting to reset file permissions.
WARNING: Could not get backup privileges!
Searching 'C:\WINDOWS'…
Found mount point : C:\WINDOWS\$hf_mig$\KB942840\KB942840
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\$hf_mig$\KB942840\KB942840
Found mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460
Problem- I don't have winzip.
Question…is this worth the effort? Can I really expect to get this PC fixed without days more effort or hours more trail and error?
Would a factory state restore be easiest, and how is that done?
We can clean this computer, shouldn't take more than a couple of days if everything goes well.
If you want to reformat/reinstall there is a guide here
You will need to back up all your important files/document/pictures/music etc. as everything will be over written
There is a zip utility built in with your OS. > right click on the file > send to Compressed (zipped folder)
But try this to begin with before you decide which way to go.
Download Combofix from either of the links below. Youmustrename it before saving it.
Save it to your desktop.
**Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
If you are using Firefox, make sure that your download settings are as follows:
Tools->Options->Main tab
Set to "Always ask me where to Save the files".
Link 1 Link 2
During the download, rename Combofix to Combo-Fix as follows:
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
———————————————————–
Double click on Combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" for further review.
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
———————————————————–
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click onthis linkto see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
———————————————————–
NOTE:If ComboFix asks to install the Recovery Console, please ALLOW it to do so.
Hey catbyte…a couple days? Whew…I was hoping to get this done tonight, but if you're willing to assist, I guess I shouldn't turn down the help. THANKS.
Okay, I just grabbed a winzip alternative for free, so I'll go back to step 2 from the initial post u made. Will follow up shortly.
No prob..well while you're there I'll be glad for the help.
Anywa, I tried to do the Combo-Fix dealio and it says I have 2 anit virus programs running that I wasn't aware of. I thought this Total Security thing was preventing them from running. Can ya tell me how to shut them?
No prob..well while you're there I'll be glad for the help.
Anywa, I tried to do the Combo-Fix dealio and it says I have 2 anit virus programs running that I wasn't aware of. I thought this Total Security thing was preventing them from running. Can ya tell me how to shut them?
The tip there about shutting Avast off, says the opposite of what mine shows. It says to click on stop on-access protection…mine is off, so it says start on-access protection.
![[external image: Posted Image]](http://i266.photobucket.com/albums/ii277/sUBs_/Gmer_initScan.gif){kind=link}