[Resolved] "Your System is infected backround"

My sister got a virus on her computer and now is says "Your system is infected! system has been stopped due to a serious malfunction. Spyware activity has been detected…." There is also a red circle with a white X on the right hand corner. If you can help me it would be appreciated.

Hi,

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done two logs should open:
  
• DDS.txt
• Attach.txt

• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

We Need to check for Rootkits with RootRepeal

• Download RootRepeal from one of the following locations and save it to your desktop.
  
  • Here
  • Here
  • or Here
• Open [external image: Posted Image] on your desktop.
• Click the [external image: Posted Image] tab.
• Click the [external image: Posted Image] button.
• In the Select Scan dialog, check
  [external image: Posted Image]
  
• Push Ok
• Check the box for your main system drive (Usually C:), and press Ok.
• Allow RootRepeal to run a scan of your system. This may take some time.
• Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Please post this log in your next reply.

I couldnt download the DDS. I got a pop up that said "Application cannot be executed. The file is infected. Please activate your antivirus software. It also did it when I did RootRepeal.

Thanks, that'll be the infection interfering. These things don't like it when you try and run certain tools

OK, let's get stuck in.

If you already have a copy of ComboFix, please delete it.

Please download ComboFix to your desktop from one of these locations. You must rename it before saving it. Save it to your desktop.
Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on Combo-Fix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making IE the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

ok I did this and now I cannot connect to the internet. Any Ideas?

Have you rebooted the computer? ComboFix temporarily disables Internet connection while it runs, on occasion the connection isn't restored.

If that doesn't help, do you have any way (i.e. USB stick) of transferring programs or logs to and from the computer? If so, please transfer the ComboFix log (C:\ComboFix.txt) and post it in this topic so we can see what happened.

Yes I tried rebooting. I will be going to buy a flash drive in about a hour. I will reply with the combofix log.

Here is the combofix report.

Thanks. OK, the remains of the Malware is interfering with your connection.

1. Please open Notepad

• Click Start , then Run
• Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\system32\winlogon32.exe
c:\windows\system32\smss32.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"smss32.exe"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"=-
"NoActiveDesktopChanges"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"=-
"NoActiveDesktopChanges"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smss32.exe]

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = 
LSP: c:\windows\system32\helper32.dll

3. Save the above as CFScript.txt

4. Copy this file over to your infected computer's Desktop using USB stick or whatever method your prefer.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

6. After reboot, (in case it asks to reboot), please post ComboFix.txt in your next reply.
This *should* restore connection. Again, make sure you have rebooted and let me know if internet works, and how the computer is running in general.


If it is back up and running, please run the following scan so we can catch anything that may be left. If it isn't let me know and post the log, we'll sort it out.

Eset online scannner

You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

• Please go here then click on: [external image: Posted Image]
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on: [external image: Posted Image]
• The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on: [external image: Posted Image]
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Here are the reports.

oh the internet is working and I was able to change the desktop picture. It looks like everything is fixed. If you see anything else I would need to worry about, please let me know. Thank you again.

ESET didn't find a lot to worry about, but there were a few things you should address. If you take a look at this folder:
C:\Documents and Settings\Marlene Monreal\My Documents\Downloads
Inside we can see there is quite a few movies, along with SmartDownload.exe, that are infected. To avoid re-infection, it would be best for to you to remove these, and seek a different source should you wish to download further movies from the internet.

We need to clear the Java cache, as there are still traces of infection in there. Click Start >> Control Panel, double-click the Java icon. On the General tab, scroll down to the Temporary Internet Files area, then click Settings… Click Delete Files…, make sure everything is selected, then click OK.

If you are having no further problems, then we can wrap this thread up in the next post.

Ok. I did everything you told me to. Thanks again. One more thing….is there a free antivirus software that you would recommend?

AVG, Avast! and Avira are the 3 that I would recommend. I've used Avast! for as long as I can remember, never had any problems.

To uninstall ComboFix, click Start >> Run, and use the following command:
ComboFix /Uninstall

Glad we could help

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.