[Resolved] cant run any virus scanners

Try uploading it to Mediafire and post the sharing link.

Here it is http://www.mediafire.com/?mkymmz4hjzm

Looking better

——————
Step 1:
——————

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

——————
Step 2:
——————

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report… at the bottom.
• Click the Save report… button.
  
  [external image: Posted Image]
  
  
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Thursday, September 17, 2009 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Thursday, September 17, 2009 03:28:09 Records in database: 2837152 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ I:\ Scan statistics: Objects scanned: 72092 Threats found: 6 Infected objects found: 10 Suspicious objects found: 0 Scan duration: 02:53:56 File name / Threat / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03400000.VBN Infected: Trojan.Win32.Vilsel.fk 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03400001.VBN Infected: Trojan.Win32.TDSS.amve 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08C00000.VBN Infected: Trojan.Win32.TDSS.amve 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08C00001.VBN Infected: Trojan.Win32.Vilsel.fk 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08C00002.VBN Infected: Trojan.Win32.Vilsel.fk 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08C80000.VBN Infected: Trojan-Downloader.WMA.GetCodec.c 1 C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-33b6f0bc Infected: Trojan-Downloader.Java.OpenConnection.at 1 C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-3076feec Infected: Trojan-Downloader.Java.OpenConnection.at 1 C:\Program Files\mIRC\backup\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.62 1 C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 1 Selected area has been scanned.

How's everything running now? Go ahead and empty the quarantine in Symantec.

Please download OTM by OldTimer

• Save it to your desktop.
• Please double-click OTM.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Files
  C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-33b6f0bc Infected: Trojan-Downloader.Java.OpenConnection.at 1
  C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-3076feec Infected: Trojan-Downloader.Java.OpenConnection.at 1
  
  :Commands
  [emptytemp]
  [Reboot]

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

All processes killed ========== FILES ========== File/Folder C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-33b6f0bc Infected: Trojan-Downloader.Java.OpenConnection.at 1 not found. File/Folder C:\Documents and Settings\Daniel\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-3076feec Infected: Trojan-Downloader.Java.OpenConnection.at 1 not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Daniel ->Temp folder emptied: 83515483 bytes File delete failed. C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 2085047 bytes ->Java cache emptied: 61719211 bytes ->FireFox cache emptied: 60544972 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Guest User: Incomplete User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32902 bytes ->FireFox cache emptied: 1723184 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Tony %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2162283 bytes %systemroot%\System32 .tmp files removed: 2679191 bytes Windows Temp folder emptied: 14797954 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 218.70 mb OTM by OldTimer - Version 3.0.0.6 log created on 09172009_122157 Files moved on Reboot… Registry entries deleted on Reboot…

Well done! Your log appears clean!

We're almost done. We need to do some clean up and get you on your way.

——————
Step 1:
——————

We need to remove all the tools that you have used. This is so that should you ever be re-infected, you will download updated versions.

Follow these steps to uninstall Combofix

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  [external image: Posted Image]

(This will remove all restore points to rid your machine of saved infected files and create a new restore point)

——————
Step 2:
——————

Download OTC by OldTimer to your desktop and run it

[external image: Posted Image]

• Click Cleanup! to beginning the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Now delete any logs that you have left over on your desktop.

——————
Step 3:
——————

Download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• It will close all programs when run, so make sure you have saved all your work before you begin.
• Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

Note: It is a good idea to run TFC to clear out all your temp files every now and again. This helps to keep your computer running more efficiently. It also can assist in getting rid of files that may contain malicious code that could re-infect your computer.

——————
Step 4:
——————

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Windows Updates are constantly being revised to combat the newest hacks and threats. Microsoft releases security updates that help your computer from becoming vunerable.

Please go to Microsoft's Windows Update and download all the critical updates to help prevent possible re-infection.

It is best if you have these set to download automatically.

Automatic Updates for Windows

• Click Start.
• Select Settings and then Control Panel.
• Select Automatic Updates.
• Click Automatic (recommended)
• Choose a day and a time when you know the computer will be on and connected to the internet.
• Click Apply then OK.

———————————————————————————————

This is a good time to set up protection against further attacks. Read our How Did I Get Infected In The First Place?. You need an antivirus that is continually updated, a good firewall, a spyware blocker, and a real time spyware program to prevent malware intrusions. Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

———————————————————————————————

Anti Spyware

Anti Spyware helps to eliminate certain types of infections. I would recommend getting these and running the scans at least twice a month. Also a real-time protector is beneficial to stop infections before they start. SpywareGuard is an excellent choice here.

• 🖼Click to load external image (Posted Image)SUPERAntiSpyware is a powerful tool that can eliminate nasties that make it onto your machine.
• 🖼Click to load external image (Posted Image)SpywareBlaster to help prevent spyware from installing in the first place. A tutorial can be found here.
• 🖼Click to load external image (Posted Image)SpywareGuard to catch and block spyware before it can execute. A tutorial can be found here.

Note: If you find your system slows down after installing any of these, just uninstall it, or disable it from running at startup.

———————————————————————————————

Safer Web Browser

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are some good free alternatives:

• 🖼Click to load external image (Posted Image)Firefox
• 🖼Click to load external image (Posted Image)Opera
• 🖼Click to load external image (Posted Image)Google Chrome
• 🖼Click to load external image (Posted Image)Safari

All are faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these.

If you choose FireFox, here are a couple of addons that I recommend:

• NoScript - for blocking ads and other potential website attacks
• McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must have if you do alot of Google searches.

———————————————————————————————

Other Recommendations

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.

Take Care and Happy Surfing! :wave:

Followed all steps. Also, downloaded the recommended anti-spyware :). Anything else I have to add to ensure this doesn't happen again?

Off to bed soon, but run this so I can see what you have installed for an antivirus and firewall:

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

sResults of screen317's Security Check version 0.98.9
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Windows Live OneCare safety scanner
Windows Live OneCare safety scanner
Symantec AntiVirus


WMIC entry does not exist for antivirus; attempting automatic update.
``````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
SpywareBlaster 4.2
SpywareGuard v2.2
SUPERAntiSpyware Free Edition
Malwarebytes' Anti-Malware
McAfee SiteAdvisor
HijackThis 2.0.2
Java™ 6 Update 15
Java™ 6 Update 7
Out of date Java installed!
Adobe Flash Player 10
Adobe Reader 9
``````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe
Ad-Aware AAWTray.exe is disabled!


``````````````````````````````
DNS Vulnerability Check:

`````````End of Log```````````

It shows you are running Norton AV but not the firewall. I would not recommend running with the Windows firewall. Here are some recommendations. If you chose one, turn off the Windows firewall as you only want one firewall running

Using a firewall will allow you to give/deny access for applications that want to go online. For instance, if a keylogger gets installed on your machine and wants to send its data out across the internet, a firewall will detect this and ask if you want to give/deny access, which of course you would want to deny. Select one of these, or another of your choice:

• 🖼Click to load external image (Posted Image)Outpost Firewall is another free firewall
• 🖼Click to load external image (Posted Image)Online Armor (Free edition) personal firewall.
• 🖼Click to load external image (Posted Image)Sunbelt Personal Firewall is an excellent firewall.

I got the firewall covered. Thanks for your help.

You are welcome. Glad we could help

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.