[Resolved] trojan:win32/renos.n

please help. for the last 3 days windows defender pops up saying high alert virus- Trojan:win32/renos.n i am unable to access any antivirus software, it says i don't have permission even when ran as admin. ad-aware won't open-failed to connect to service? avg is off and won't turn on. unable to access hijack this. permission denied. also windows message pops up randomly: msa.exe stopped working. if you can help in any way i would really appreciate it. i regularly update and run scans on all my antivirus software: avg, ad-aware, cc cleaner, spybot. i also update windows regularly. not sure how this happened? -jen

Hi,

Please do the following:

Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


NEXT

To fix the permission issue

Download Inherit and save it to your desk top
Drag each of the exe files that you are unable to run into Inherit.exe (must be the exe - not the shortcut)
Then wait for it to say "OK"

NEXT

• Please save Win32kDiag to your desktop.
• Double-click on it to run a scan.
• When it's finished, there will be a log called Win32kDiag.txt on your desktop.
• Please open it with notepad and post the contents here.

i downloaded exehelper but cannot find it on my computer to open it and run the fix. it says it's completed downloading but not in my dowload folder?

Please run this program instead, then move on to the others

Please download exe_fix and save it to your desktop

Double click on exe_fix.com to run it.

Type the number 1 at the prompt and allow the tool to run

it's doing the same thing, i click on it to dowload, a box pops up asking me if i want to save file (gives me no option where to save file to), i click "yes", it scans for viruses and says download complete. i open my download file and none of these programs are there. i cannot find them on my computer.

If you are using Firefox, make sure that your download settings are as follows:

Tools->Options->Main tab

Set to "Always ask me where to Save the files".

Then make sure you choose "Desktop" as the location to save the files

i did what you said, exe_fix is now on my desktop..i double click on it-a blue screen flashes and then disappears.

Hi, That is what it should do, move on to the next set of instructions Thanks

inherit_exe- i downloaded and saved it to my desktop. it is not there.

Please save the files directly to your C:\ drive, then navigate to your C:\ drive and locate the programs and run then, work through from the beginning: exeHelper, Inherit then Win32kDiag

it won't let me save to my c: drive. says i don't have permission. it asks me if i want to save to my "jennifer" file in c: drive i click yes and it is not there. it is doing that with all 3 you asked me to dl. i am the only user on this computer, so it should be set to admin right?

The infection is messing with your permissions.

The inherit program should resolve that, but if you cannot save anything to your computer it is going to be more difficult.

If you have access to another computer please download the following program to the other computer and transfer it to the infected computer via USB - run the program from the USB.



Download Combofix from either of the links below. You must rename it to combo-fix.com before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
• Tools->Options->Main tab
• Set to "Always ask me where to Save the files".

Link 1
Link 2

———————————————————–

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  

  ———————————————————–

• NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.
  
  

  ———————————————————–

• Double click on the renamed ComboFix.exe & follow the prompts. When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt so we can continue cleaning the system.

———————————————————–

i don't have another computer.

Do you have a USB you can save it to?

i can get access to another computer tomorrow, should i dl all 3 original files and save to usb? or just combofix.