HDD OK, malware (fake virus?) Defragmenter

I was working on another problem with my computer running slow and giving me 'hangapp' So i thought I would check the defrag of C with the microsoft tool. I did a check as tp weather it was needed, and was told it was not necessary.

Several hours later as I was getting ready for bed, I decided to run defragment anyway. When I clicked on the system tools in the control panel as I've done many times before, I suddenly got this new window "HDD Defragmenter" that prompely proceeded to scan my C-drive and delivery this message about numerous faults. My computer went crazy with all sorts of ALERTS. Now I am unable to access the internet.

I googled this HDD Defrag program to find it was some sort of fake virus that wants to sell you some download to fix the problem. When I looked at a lot of the suggestions on fixing the problem it appears as though there are numerous software people that want to sell you some sort of fix….and WHO THE HECK DO YOU TRUST??

So I went here:
http://answers.yahoo.com/question/index?qi…23191253AAXiYTL

In the first place the instructions here do not exactly match my XP program, so I had a bit of a problem following those instructions to the letter. I did know that I needed to get to the SAFE mode, which I did. I then made numerous attempts to eliminate any file or folder with HDD in its name, but this dayam problem keep coming back. Obviously it has embedded itself deeper in the computer than I am able to diagnosis….but then how do I get rid of this carp**?? And can I do it without installing another anti-something on my computer??

And how did it get past Microsoft Security Essentials which I was told by a knowledgeable computer guy was all I needed to protect myself??

The people who put this stuff out should be locked up in jail…at least for some sort period of time….its fraud & deception.

I see you've posted elsewhere on our forum. Can you get to the internet? Have you tried System Restore?

I see you've posted elsewhere on our forum.

Can you get to the internet?
Have you tried System Restore?

I tried system restore but for some reason it only allows to to select one day….the day of my infection I believe. So I do not think it will allow me to go back before the infection.

I have tried multiple, multiple attempts to wipe every file associated withis this virus (fake, whatever?) from my computer, but it just keeps popping up. Appearly it has tenicles EVERYWHERE. I am getting real fustrated.

I just managed this morning to connect to the internet thru my laptop even while it is in Safemode. But I do have access to another desktop computer of my friends. Should I consider downloading this "Frontline Rogue Remover" software??.

I just spent 10 hrs trying to rid myself of this carp**, and it keeps coming back. Somewhere along the process I think i saw a reference to the creator company being iDisk, SDisk Software 2008-2011. These people need to be prosecuded, and I will look into that when I return to WashDC.

First off, don't install / run anything unless I suggest it.

You can download these tools to a USB device like a thumb drive, using a working computer.
Once downloaded, take the thumb drive to the infected computer and plug it in.


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• [external image: Posted Image]
• Then click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste".

I will try your instructions now (later in afternoon) as I had to go out for awhile with my friend to a museum

WOW, I followed your instructions and it appears to be gone. I was ably to do it directly on my laptop under 'safemode with networking turned on'. The Malewarebytes turned up 5 virus problems for me. Here is that log: ____________________________________________________________ Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5499 Windows 5.1.2600 Service Pack 3 (Safe Mode) Internet Explorer 8.0.6001.18702 1/10/2011 4:42:56 PM mbam-log-2011-01-10 (16-42-56).txt Scan type: Quick scan Objects scanned: 129743 Time elapsed: 6 minute(s), 48 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juHkevOpbCA.exe (Trojan.Dropper) -> Value: juHkevOpbCA.exe -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JWOYBOih3T75ry3 (Rogue.FakeHDD) -> Value: JWOYBOih3T75ry3 -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\all users\application data\juhkevopbca.exe (Trojan.Dropper) -> Quarantined and deleted successfully. c:\documents and settings\all users\application data\jwoyboih3t75ry3.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully. c:\documents and settings\all users\application data\xakljfsgosi.dll (Trojan.Dropper) -> Quarantined and deleted successfully. _______________________________________________________________________________ Is this log saying I had two different problems??

Can you restart in Normal Mode and run MBAM again?

I think so, I will try that. I do have a whole bunch of 'shadow icons' on my desktop that appear to be repeats of Word docments I have wriiten and saved before?? They are titled like this: ~WRL3552.temp-Microsoft Word all appear the same form with different numbers for each different document. and when I open them up I see a shadowy word document??

That's OK for now. It might be because we asked to unhide hidden files. Please run MBAM and post the results

Just finished that second scan,…and had NO problems:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5499

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/10/2011 6:00:05 PM
mbam-log-2011-01-10 (18-00-05).txt

Scan type: Quick scan
Objects scanned: 130543
Time elapsed: 20 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Cool

Next:


Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
  
  Note: If you have SP3, use the SP2 package.
  If Vista or Windows 7, skip the Recovery Console part
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

This sounds as though it will consume a bit of time (maybe an hour or more)?? No problem, BUT I need to take a little time right now and write my Thai wife a long note about a property auction she intends to go to on our part (she has NO experience with this), and I need to give her some instruction by email and phone. So I'll be back shortly….

Well my auction deal in Thailand did not worrk out for me yet.

So i have been using my computer quite successfully for the past few days, but all of a sudden it is slowing up again. And then tonight it got into its 'hungapp' stage again. Not only several 'hungapp' appearances, but one of them said 'mbam.exe' hungapp.

Oddly there appeared a Icon on my desktop representing a 'shortcut' to that HDD OK fake virus I had before. I became immeadiately concerned, and decided to run Malwarebytes again while I ate dinner. But it turns out that NO virus or problem was detected by Malwarebytes. Here is that log:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5499

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/12/2011 8:40:38 PM
mbam-log-2011-01-12 (20-40-38).txt

Scan type: Quick scan
Objects scanned: 132143
Time elapsed: 20 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

…and yet that icon shortcut remains??