[Closed] Please can someone help a totally non technical person even s

Hi - I am really hoping someone can help me. I must be the least technical person around. I have managed to get my computer badly infected. On advice from the mums chat board I use I installed various anti virus software but it hasn't helped much. I found it very difficult to install any anti virus software - almost like the viruses were stopping me doing this. Eventually got Malwarebytes installed. It got rid of lots of viruses/trojans. Then AVG - my computer kept turning itself off several times while trying to install. This has run once too.Then re run Malwarebytes. It found more viruses even though I had not been on the computer in the meantime. Then AVG and it did the same. When I checked my history it looked like I have trawled through about 100 pages today when I have not been on the computer at all. Some people told me I need a comeplete restore (i.e. lose what is on it - all my children's baby photos are on the machine so really don't want to do this) or a rootkit? Someone else suggested I come on here run a programme and post results and hope that someone responds - they were singing this boards praises. So I am now on here - can someone please explain to me in very simple terms what I need to do? I have opened up the sticky called WARNING and I can't even work out what that is telling me to do. I don't really want to run anything that might damage the computer further before I know what I am diung. Please can someone reply and then I can run what ever programmes I need to and then post results. Thanks very much.

Hi there, welcome to WhatTheTech

I will be happy to help you. If at any time I go to fast or don't explain anything in enough detail, just stop me and ask. We need to run two diagnostic tools before we begin cleaning, to find out what the problem is.

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done two logs should open:
  
• DDS.txt
• Attach.txt

• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

We Need to check for Rootkits with RootRepeal

• Download RootRepeal from one of the following locations and save it to your desktop.
  
  • Here
  • Here
  • or Here
• Open [external image: Posted Image] on your desktop.
• Click the [external image: Posted Image] tab.
• Click the [external image: Posted Image] button.
• In the Select Scan dialog, check
  [external image: Posted Image]
  
• Push Ok
• Check the box for your main system drive (Usually C:), and press Ok.
• Allow RootRepeal to run a scan of your system. This may take some time.
• Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Please post this log along with the DDS logs in your next reply.

Good luck

Hi - Thank you very much for offering to help me. I will do this is in a moment. First though please can you confirm if I should do that ERUNT programme first (described in the WARNINGS sticky as I did not do this as I didnto really understand how - but it said do this before doing anythign else so just thought I shoukld double check - thank you very much.

Yes, if you haven't already backed up with ERUNT it would be good to that now. Here are detailed instructions:

• Download ERUNT
• Double-click erunt_setup.exe to run.
• Follow the prompts and install using the default configuration (setup language, install location, shortcuts…).
• Say No to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later.
  [external image: Posted Image]
• Start ERUNT
• Choose a location for the backup
  The default location C:\WINDOWS\ERDNT\[today's date] is preferred
  [external image: Posted Image]
• The first two check boxes are ticked by default (System registry and Current user registry).
• Press OK
• When prompted, click YES to create a new folder.
• Progress bars will show backup status.
• A confirmation window will popup when complete. Click OK to close.

Then continue with the scans in my previous post.

hi - I am trying to do this - how do I zip something please? Thanks

Hi,

If you are trying to zip the report that DDS gives, don't worry about it, just attach the file as it is (attach.txt).

To zip anything else, just right-click and click Send To > Compressed (zipped) folder.

Hope that helps.

I suspect this is not even right but please can you let me know if it isn't and I will retry - this is one of the things to attach and I will dothe other one in a minute - thank you very much

I hope this is right- here is the second one. This is the first and last time I ever lend my computer to a friend! Right here goes:

Please can you confirm I attached the correct 2 things? I appreciate it will take you substantial time to look at them in detail but just would be nice to know I have given you the right stuff to look at. Thank you very much for your help.

Those are both correct DDS logs Can you please also perform the RootRepeal step while I have a look through these logs? Thanks.

Sorry I had forgotten to do this. I have done it now and post results- not sure it is correct though as it says in instructions that scan may take some time and mine took about 3 seconds. Please can you let me know if this is wrong -thanks: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/09/14 13:03 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP2 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xAA62F000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF8B25000 Size: 8192 File Visible: No Signed: - Status: - Name: hiber_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\hiber_WMILIB.SYS Address: 0xF8BBB000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA8F2F000 Size: 49152 File Visible: No Signed: - Status: - Hidden Services ——————- Service Name: gasfkylghvqyao Image Path: C:\WINDOWS\system32\drivers\gasfkypxcphwvj.sys ==EOF==

Hu - please can you confirm tha you have this and this is all you need as my husband suggests I remove this info now as someone with less then virtuous intentions might be able to use this info (or is he talking garbage) . Many thanks

You can remove those logs now, but keep the tools a little longer, we may need them again later.

OK, now I know what is on your system, we can begin cleaning.

LimeWire
You have LimeWire, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of Malware we see. You'll be doing yourself a favour by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm
See Clean/Infected P2P Programs here

I would recommend that you uninstall LimeWire, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.



Please download ComboFix to your desktop from one of these locations. You must rename it before saving it. Save it to your desktop.
Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on Combo-Fix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making IE the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Thanks ever so much for this. Children due back in few minutes so may not be able to do this until a bit later but I will be back asap, Thank you so much for this!

No problem I may or may not be around to reply later, but should be around first thing tomorrow if not (I'm on GMT time).