Hello everyone,
An anti-virus program I never knew I had, "Anti virus soft" popped up on my screen saying that my computer was being "attacked by an internet virus". When I had wanted to delete the viruses, the only solution was for me to purchase the full version of this program, and the current version I have does nothing but scans and detects the names of the viruses. I also was not able to delete or disable this program, "Add and Remove Programs" from Control Panel was not available.
A "security warning" window keeps popping up saying that the "Application cannot be executed. The file "…" is infected. Do you want to activate your antivirus software now?" whenever I try to open anything. It includes applications that I've downloaded such as "exeHelp, Erunt, Defogger, DDS, GMER Rootkit Scanner, ComboFix", or any others that I've already installed on my computer such as "AVG Free 9.0, Paint, MSN Messenger, VLC player". A possible solution I've tried was to try to restore my computer by using "System Restore", but once again it shows the popup, this time being that "rstrui.exe" is infected.
With the exception of opening Mozilla Firefox, nothing else works (Microsoft Works, Notepad, Paint, Realplayer, Disk Defragmenter, AVG". Every couple of minutes or so, my computer would pop up a window saying "Antivirus software alert-Infitration Alert (Virus Attack) Your computer is being attacked by an internet virus. It could be a password-stealing attack, a trojan - dropper or similar." It also gives the details:
"Attack from: 160.245.166.253, port 60201
Attacked port: 7855
Threat: Win32/Nuqel.E"
My Windows Security Center would open in an instant afterward, and I cannot do anything at the moment but browse the internet for possible solutions.
Thank you very much for reading this and helping.
Download the tools needed to a flash drive or other USB device. Transfer it to your desktop.
Run ABCD (Combofix) from the USB device if you can't run it from your desktop
Download Combofix from any of the links below but rename it to ABCD.exe before saving it to your desktop.
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Link 1 Link 2
Double click on the ABCD.exe ComboFix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the C:\ComboFix.txt so we can continue cleaning the system.
**Note: It is important that it is saved directly to your desktop**
——————————————————————–
With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Go to Microsoft's website => http://support.microsoft.com/kb/310994
Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.
Note: If you have SP3, use the SP2 package. Vista and Windows 7 users skip this part
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
[external image: Posted Image]
Drag the setup package onto ComboFix.exe and drop it.
Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
[external image: Posted Image]
At the next prompt, click 'Yes' to run the full ComboFix scan.
When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt in your next reply using Copy/Paste.
Notes:
Give it atleast 20-30 minutes to finish if needed.
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Also please describe how your computer behaves in your next reply.
At the moment I think I managed to install "ABCD" right before the popup stopped its installation. However, after clicking on the ABCD icon (after having installed it) located on desktop, the same pop up appears, "Application cannot be executed. The file wmiprvese.exe is infected. Do you want to activate your antivirus software now?" I tried saving ComboFix and renaming it as ABCD in some other folder before moving it onto my desktop. I don't have a USB here with me right now, but I'll probably have it by Tuesday. Although I wasn't able to produce the C:\ComboFix.txt yet I'll try again on my USB this Tuesday. I'll keep trying till then and keep updating this post. Thanks .
Vista users: 1. These tools MUST be run from the executable. (.exe)
2. With Admin Rights (Right click, choose "Run as Administrator") every time you run them
1) exeHelper
Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com) Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).
.