Computer infected with fake "spyware protection" program

Hi kristin031204, Sorry for all the problems you are having. I'm sure we can sort this out. Before we deal with MBAM you said your McAfee has expired. Do you have plans to renew it or do you wish to use a free alternative antivirus programs?

ah, not your fault!! i appreciate all your help!! yes, mcafee has expired. no plans to renew, i was going to use one of the free ones that WTT recommends.

Hi kristin031204,

Ok let's see if we can sort both the AV and MBAM situations out. The error you recieved could be caused by either a corrupt database or McAfee interfering.

This may seem llike a lot to do but the steps are short and quick.

First we'll get a new AV downloaded and a removal tool. Do not install the new AV yet.

Download and save to your desktop one of these free antivirus programs.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found here Avira Personal Support Forum
Microsoft Security Essentials
Support

Download the Mcafee Removal Tool from HERE and save it to your desktop.

Disconnect completely from the internet, pull the plug on the modem if necessary.


Next

click start > control panel > add/remove programs and uninstall

McAfee Personal Firewall Plus
McAfee SecurityCenter
McAfee VirusScan

While you are in there uninstall these very old vulnerable versions of java

Java 2 Runtime Environment, SE v1.4.2_03
Java 2 Runtime Environment, SE v1.4.2_06
J2SE Runtime Environment 5.0 Update 4
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7

Do not uninstall Java™ 6 Update 18


Next double click MCPR.exe to run the removal tool.

Restart your computer after receiving the message CleanUp Successful.
Your McAfee product will not be fully removed until the system is restarted.


Next install your new antivirus program by double clicking the setup files you downloaded and follow the prompts.


Ensure your windows firewall is turned on

• click start > control panel > security center
• Near the botton you should see Windows Firewall
• Click on it and ensure it is set to On (recommended)

Let's see if we can get MBAM to update.

Please do a search for and delete all copies of rules.ref including the one you renamed.

Open Malwarebytes and you should see the alert box with "The database could not be found. Would you like to download a new copy?".

Click OK to allow the updater of MBAM in downloading the database. When the update is finished, MBAM will open.

If all went well run a scan and post the log.

Thanks

ooookay… 1) Downloaded AVAST 2) Uninstalled all programs you listed and rebooted computer. Note that while uninstalling the programs quite a few windows kept popping up: -Spy Sweeper: "Browser Helper Object being installed in Internet Explorer" I chose to "block installation" each time this popped up -WinPatrol: "New Program Alert". Indicated that a program will run each time i restart my machine. I did not approve installation of the program. Hope I made the right choices 3) Ran the MCPR.exe removal tool, got the CleanUp Successul message and rebooted computer 4) Ensured that Windows Firewall is on 5) Ran a search for rules.ref. Nothing. Knew this wasn't true, so I went into all the Malwarebytes folders on the computer and manually deleted all rules.ref and rules1.ref files. 6) Opened Malwarebytes and it did indeed state that no database was found, so i assume i got all the rules.ref files. I clicked "yes" to download a new copy. Malwarebytes tried to connect to SecurityWonks.com but I got the error message "Update Failed. Make sure you are connected to the internet and that the firewall allows Malwarebytes". or something like that. I checked my windows firewall and malwarebytes and securitywonks are not on the "exceptions" list. Could this be the problem? ah nuts…just realized i didn't install the antivirus program (this is what happens when i attempt to do two things at once after 11pm!!) best go do that now… let me know your thoughts on the next steps. thanks!! kristin

Hi kristin031204,

I don't know if you made the right choice or not as I don't know what program was trying to add what to what. Can you recall any nams?

Windows firewall doesn't monitor outgoing traffic so that shouldn't be a problem.

Let's try the simple first.

Make sure these settings are correct.

Open Internet Explorer

• at the top click Tools
• Click Internet Options
• Click Connections tab
• Click Lan Settings button
• Make sure the box beside "Use a proxy sever for your Lan" is UNchecked
• OK your way out.

Can you tell me if the box beside Automatically detect settings is checked or unchecked?


Try updating Malwarebytes' Anti-Malware again to see if it now works correctly

the names were non-sensical to me, a jumble of letters/numbers. it wanted to add something to start-up. there was not a cancel option…only "yes" or "no". let's hope i didn't screw anything up…

[*]Make sure the box beside "Use a proxy sever for your Lan" is UNchecked

it was unchecked

Can you tell me if the box beside Automatically detect settings is checked or unchecked?

unchecked

okay, made sure i was connected to the internet…then went to the start menu in the infected computer, opened malwarebytes, it stated there was no database and asked if i wanted to download, i said yes, it tried to connect to securitywonks, and…."make sure you are connected to the internet and that your firewall is set to allow malwarebytes antimalware to access to the internet"

is there a reason why we haven't uninstalled malwarebytes and downloaded a new copy that would have the update in it already?

also….i need to start working on my taxes, and to do that i need to install turbo tax (which has been patiently sitting on my desk since this started!) can i install that? or should i sit tight a little longer?

thanks!!
kristin

Hi kristin031204,

it wanted to add something to start-up. there was not a cancel option…only "yes" or "no

Sometimes the uninstallers will add a runonce registry entry to finish the uninstall process.

is there a reason why we haven't uninstalled malwarebytes and downloaded a new copy that would have the update in it already?

In a lot of cases when MBAM won't update the problem is not within the program itself so we needed to check other possible causes. The new versions are not completely up to date and may or may not be more current than what you have depending on the last time you updated.

Now we'll try a new copy.

Download and save to your desktop Malwarebytes Anti-Malware

Do not install it yet we need the MBAM clean up tool (mbam-clean.exe)which you can get from HERE

• Click start > Control Panel > add/remove programs and uninstall Malwarebytes' Anti-Malware
• Reboot your computer
• Double click on mbam-clean.exe to run the tool
• Reboot your computer

The reboots are important.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Go ahead with Turbo Tax.

okay…done! it identified 2 items of malware. attached is the log! i've got a good feeling this time!!! -kristin

Hi kristin031204,

Just a couple of remnant by MBAM.

Let's see if we can resolve this issue:

Next, the computer beeps and the following messages come up:

Time-of-day not set – please run SETUP program
Strike F1 to continue, F2 to run the setup utility

I know I did post that a probable cause was the CMOS battery. You could try setting the time in the bios and see if the message goes away.

When the message appears press F2. This will open the bios screen. Look for an entry related to time/date. You will need to use the keyboard to navigate through the menus. The instructions as to which keys to use will be displayed somewhere on the page, usually near the bottom.


One more scan to check for stragglers. This scan can take some time so try to run it when the computer is not in use or overnight.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
• Click Start
• Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
• Click Scan.
• Wait for the scan to finish.
• Re-enable your Antivirus software.
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.

Please post back with the ESET log.

How is the computer?

Thanks

It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time. Please don't go surfing while your resident protection is disabled! Once the scan is finished remember to re-enable your antivirus along with your antispyware programs. I could use some help with this step…

forget it…figured it out… i'll run the scan and post back (hopefully) tomorrow thanks!

Hi kristin031204,

ran the ESET scan last night. this morning it said that there were 4 identified threats. closed the program, and went to look for the log. cannot find it. the only thing in the ESET folder is a subfolder titled ESETOnlineScanner and the only thing in there is the ESET uninstaller program. i used the search feature (right-click on start) and searched for anything with "log" in the name. nothing. i then searched for anything created since i started the scan last night. attached what i thought might make sense…

btw, they were in C:\Windows\Software Distribution\Data Store

Hi kristin031204, Sorry about not getting back to you sooner, had a long day yesterday. One of those logs are the Event logs and I'm not sure what the other is. Do you mind running the scan again. Make sure the results are saved before closing the scanner. Copy and paste the info from the web page and save it to a notepad if you need to. Thanks