HELP

WELL, i'ts happened again…..am INFEcted UP MY YING-YANG NINE MILLION RED FLAGS AND NOTHING WILL CLEAN THEM OUT, THEY TOTALLY HAVE JAMMED MY WINDOWS SECURITY, WHICH YOU GUYS RECOMMENDED TO ME, AND i UNSTALLED MY avast, so please help me again

Hello and welcome back to the forums,

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:

• Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
• Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
• Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
• Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
• Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!

Download and Run DDS by sUBs

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

Please Please copy / paste the scan reults.

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:

• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post

Scan With RootKitUnHooker

• Please choose one link and download Rootkit Unhooker and save it to your desktop.
  
  Link 1
  Link 2
  Link 3
• Now double-click on RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan.
• Check (Tick) Drivers and Stealth
• Uncheck the rest. then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished and then click File > Save Report.[/b
• Save the report somewhere where you can find it. Click Close.
• Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

cant download ANYTHING. NOTHING. ZILCH I tried all those programs you hve listed, dds, hijack, OTL, nothing will download was online for about an hour after it happend, hoping someone would show up…but then windows shut me down, the computer knows it's infected badly and said damage will occur, so they shut me down…and I gotta say, it was right, because the longer I was online, searching for any fix from TREND or whoever get ANY kind of scan to run, i couldn't, nothing will run…and the computer was acting strange….VERY SLOW i'm an old lady, really dumb, i'm afraid if i am connected, then the hackers who do this stuff are getting all my information, getting into my files, they are obviously smart to create these programs, and they are designed to do bad things, probably not just to mess with people's minds, they want information that they can use to clean you out, that's what i'm thinking, but i'm a paranoid old lady. please don't tell me all i can do is reboot the whole system….. had to that last time I was here and lost everything…and as I know nothing about backup, yeah, i tried, i went and looked in the archives here and got a memory stick thinking that at least i could get my important files, like my pictures and my poetry saved somewhere, but im so stupid, i got the stick, stuck it into the slot thingy and then was supposed to click on things that I didn't know what I was doing, so i stopped. Im typing this on my desk top computer, it's my laptop that's infected…it's a lenovo with windows explorer 8 i think and i'm pretty sure it's VISTA….. I AM AFRAID TO TURN THE MACHINE BACK ON SO THAT'S WHY I'M TALKING TO YOU ON MY OLD DESK TOP HERE EDIT: LOL, really on the floor here, L my fat AO…… you live in Maryland? Can I just drive up ????? LOL edit again…and yes, I tried both links for the DDS…. I even tried tsskiller i think it was on the laptop after the last time i was here, but that wouldn't run either, none of the programs i had on my computer would run and I had a few left over from the last time I was here and tried all those that are still there on my desktop and nothing would run… and of course i got that screen coming up telling me that if i upgrade from the microsoft security and take either one of 3 payment options, of course it will do the trick.

It is unlikely your computer will suffer any damage as a result of this infection. Most malware developers simply want to scare you. It is also highly likely we can clear the infection once we can focus on taking the appropriate steps. If you are concerned about someone stealing your data, you can simply change your passwords from a known good computer (your desktop) and do not access anything on the laptop with those new passwords until it is cleaned.

If you want to get the machine fixed, you will need to either learn how to download and save files on your USB drive for transfer to the laptop, or you will need understand and accept any risks that may come with being online on the laptop. Perhaps you have someone to assist you in completing the tasks if you are not comfortable in doing so? (And no, sorry, I only help in the forums, I don't do house calls.)

If you want to learn how to save files to USB/memory stick you can find the steps here. Since your desktop isn't infected, and you are not currently using the laptop, you might want to learn this skill as it is certainly a valuable one to have.

I also believe I can probably help get you online with the infected laptop, if you wish to do that instead of transferring files from one computer to another. It's your choice if you are comfortable in doing this or not.

Please let me know if you will be saving to USB or if you wish to use the laptop directly so that I can give the appropriate instructions.

ok, we seem to be online and on the same time frame, i can go turn on the lap top and hopefully they haven't disabled my ability to get on line, so here i go, gonna get the laptop, try to get on line, i'll post again from the lap top when I am all set to tackle this mess. should just be 3 minutes or so. thanks so much, I REALLY didn't think we were going to meet in some parking lot in Salisbury (first big city in MD near me, lol…but I would have driven to Annapolis, or further, LOL)

*(%$%T#)($_+#+FJK$_+#)#++@++$)$(%((%%^%*+@$$ yeah, that's me cursing my rear off now i can't get back tto the what the tech web page, was typing the laundry list of infections i had, and it hijacked me to the payment screen and YOU CANNOT GET OUT OF THE PAYMENT SCREEN… this is exactly what happened the last time i was here am on the desk top, will try again to get back to the WTTech web page… ok….am back, phew……. but seriously i hope we ccan get this done because this thing will interfere fast again or shut me down!!!!!!!!!!! ok…… it shut down again….. well, actually it didn't shut itself down, it FROZE, couldn't do anything…..i was checking , i was hitting the reset button to see if you had replied. did that like 4 timesin 7 minutes…. so we have 7 minutes seems to be my window my window of opportunity…. so please…..i'll stay here glued to my desk top screen. WHEN YOU GET BACK, PLEASE DO NOT GO AWAY. PLEASE. JUST POST WHATEVER I NEED TO DO, I'LL LOG BACK ONTO THE LAPTOP, TRY TO EXECUTE IT FAST

In an effort to get your laptop to a semi-decent state, I'm going to try something a bit different. Normally we'd save this for a few more steps down the road, but it may be the quickest way to get you to a point where you can get me the logs I really need to see.

Boot your computer in Safe Mode with Networking

• Turn the computer on or Restart the computer
• As soon as BIOS is loaded, start tapping the F8 key (pretty much as soon as you hear it start up is when you want to start tapping)
• The Windows Advanced Options Menu appears.
  If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Use the arrow keys to select the Safe Mode with Netowkring menu option.
• Press Enter.
• The computer then begins to start in Safe mode with Networking
• Log into your usual account
  
  The please download Malwarebytes' Anti-Malware to your desktop.
  
  
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results (you might want to do this before rebooting while you are still in safe mode with networking and are more likely not to have issues connecting to the forum.)
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
  
  
• When you are finished with all troubleshooting, close all programs and restart the computer as you normally would.

I will be on and off the forum this evening. I'll keep an eye on my inbox and will do my best to get back to you as quickly as I can, but please understand that we are all volunteers and we do this along with our other responsibilities. Sometimes it may not be possible to get right back to you - but I'll try to make your wait as short as possible.

ok, are you still here? I have malware bytes already installed…so just open that up? edit, oh what the heck, i went and just did it anyway…. it is scanning right now awww cruddupswithcreamychunks, i hit full scan…oh well, hopefully in safe mode it won't shut down and we'll have a longer list of junk to go thru ….SORRRRRYYYYYY ok, put on my big girl panties, strapped on my sword, girded up my loins, put a brave smile on my face and intrepidly aborted the full scan and TAH DAH, it worked, it's doing the quick scan right now, oh i love when things go right on a computer!!!!!LOL… yeah, i am this nuts. you got the pickle in the bottom of the barrel today didn't ya??? LOL

A full scan is fine. However, I was going to tell you that you needed to update your definitions prior to running it. Since you have started the full scan already, please go ahead and let it finish and remove anything it finds. Afterwards, please update and run per the instructions below:

Please run Malwarebytes by double clicking the icon on the desktop.

• Click on the tab labeled Update and then click on the button Check for updates.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

After running Malwarebytes be sure to reboot into normal mode.

Along with the log produced, please tell me how the computer is running after running the program.

ok….. got the log, am on the desktop, so will go back to laptop and post the log….. she says holding her breath and with all fingers and toes crossed edit:!!!!!!!! hi TOM….i saw you lurking here!!!!!!!!!

ok, here is the correct scan, in safe mode, yes, i went back and aborted full, this is the quick scan result, it said i only had 3 infections, not 37 lol! does this mean i am clean? I am going to reboot again…. want to make sure….. it was VERY VERY SLOW to get all the items on my desktop to go from blank white to their logos…want to make sure it won't do that again a second time, other than that i don't detect problems Windows 6.1.7600 (Safe Mode) Internet Explorer 8.0.7600.16385 3/14/2011 5:03:55 PM mbam-log-2011-03-14 (17-03-55).txt Scan type: Quick scan Objects scanned: 143975 Time elapsed: 2 minute(s), 29 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gPiMkPc16633 (Trojan.FakeAlert) -> Value: gPiMkPc16633 -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\programdata\gpimkpc16633\gpimkpc16633.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\Users\cici\local settings\temporary internet files\Content.IE5\A3AWU7RT\download[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

When you are in safe mode, everything is a little slower and everything looks bigger on the screen. Hopefully, when you reboot into normal mode things will be functioning more as they should.

I still need the DDS and RootkitUnhooker logs so I can make sure nothing is hiding on your machine. Let's give them another try:



Download and Run DDS by sUBs

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

Please Please copy / paste the scan reults.

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:

• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post

Scan With RootKitUnHooker

• Please choose one link and download Rootkit Unhooker and save it to your desktop.
  
  Link 1
  Link 2
  Link 3
• Now double-click on RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan.
• Check (Tick) Drivers and Stealth
• Uncheck the rest. then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished and then click File > Save Report.[/b
• Save the report somewhere where you can find it. Click Close.
• Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

ok, back on desk top….. it did TRY to do the dss …but i got a note saying THIS TOOL DOES NOT SUPPORT YOUR OPERATING SYSTEM. OK…TRIED TWICE NOW, NO GO i'm gonna try the root kit thing next. ok have that.

No worries - we can use another tool instead of DDS. Please try this:



OTL Custom Scan

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click on Minimal Output at the top
• Download the following file scan.txt to your Desktop. Right-Click here and choose save to download it.
• Double click inside the Custom Scan box at the bottom
• A window will appear saying "Click Ok to load a custom scan from a file or Cancel to cancel"
• Click the Ok button and navigate to the file scan.txt which we just saved to your desktop
• Select scan.txt and click Open. Writing will now appear under the Custom Scan box
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

ok., got a report but do not see what tab or button there is anywhere to click on that says File > Save Report.[/b am on desktop, gonna transfer to laptop and just copy what popped up on the scan, hope it works