My computer has been acting unusual lately, such as windows popping up saying I am infected, or need to update a program that are clearly not from my antivirus or any of my programs. In addition, my husband tried to sign into an account today and it redirected to youtube instead of logging in. Recently an avast deep scan ran on startup and said we had a root kit. We didn't finish the scan or try to clean it because I wanted to be sure I got it cleaned properly, so here I am.
I remember reading a computer security article when rootkits first came out that said that the writer would absolutely wipe the hard drive and start over if he had a rootkit infection. Are they able to be removed completely now? Also, how do I make sure to remove them from every user account? (We use three)
Anyway, here is the DDS log:
DDS (Ver_2012-11-20.01) - NTFS_x86
Hi computerwannabe I need a few more scans to formulate a course of action. OCD . I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic.
Copy and Paste logs directly into the reply window. DO NOT attach the logs
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so. DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.All Clear "Important: All tools MUST be run from the Desktop .========================= [external image: bullseye_zpse9eaf36e.gif] Security Check Security Check here here
Save it to your Desktop.
Windows XP Double click on the icon to run it Windows Vista, Windows 7 & 8 Right click and select "Run as Administrator"
A Notepad document should open automatically called checkup.txt ; please post the contents of that document.
========================= [external image: bullseye_zpse9eaf36e.gif] aswMBR aswMBR.exe
Windows XP Double click on the icon to run it Windows Vista, Windows 7 & 8 Right click and select "Run as Administrator"
When asked if you want to download Avast's virus definitions please select Yes
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat . Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.
========================= In your next post please provide the following
checkup.txt aswMBR.txt attach MBR.zip
Hi computerwannabe
Yes, I apologize, my schedule is full. I will run the scan tomorrow night and post the logs. Thank you for being willing to help me with this!
I tried to upload the MBR.dat file, but it tells me that I am not "permitted to upload this kind of file".
Here are the other results:
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Results of screen317's Security Check version 0.99.85 ``````````````Antivirus/Firewall Check:`````````````` `````````Anti-malware/Other Utilities Check:````````` Java version out of Date! Flash Player out of Date! Adobe Reader out of Date! Firefox out of Date! ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Defragment your hard drive soon! (Do NOT defrag if SSD!) ````````````````````End of Log``````````````````````
Hi computerwannabe [external image: bullseye_zpse9eaf36e.gif] ComboFix ComboFix User's Guide
Download ComboFix from the following location:Link * IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next replyNote: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Ensure your AntiVirus and AntiSpyware applications are re-enabled .NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.========================= In your next post please provide the following
Hi computerwannabe
Sorry for the delay!
ComboFix 14-07-25.01 - jtmeserole 07/25/2014 20:03:33.10.2 - x86http://www.gmer.net
Hi computerwannabe [external image: bullseye_zpse9eaf36e.gif] Uninstall via Programs and Features Start > Control Panel > Programs and Features . Locate and select the following that are present on the list and click the Remove button:
Java 7 Update 25 Adobe Flash Player 10 Adobe Reader 9 ========================= [external image: bullseye_zpse9eaf36e.gif] Update Java
Get the current version of Java (Version 7 Update 65) by going to http://java.com/en/download/installed.jsp
Select the Verify Java Version button and follow the onscreen instructions to update if necessary.
========================= ========================= [external image: bullseye_zpse9eaf36e.gif] Adobe Reader http://get.adobe.com/reader/otherversions/
Use the drop down menu's to select your operating system
Select your language > Select The current version of Adobe Reader for your language
Remove Free! McAfee Security Scan Plus "Click the Download button , and follow the onscreen directions to complete the installation.
Please note, depending on your settings, you may have to temporarily disable your antivirus software for the Adobe Reader update. ========================= [external image: bullseye_zpse9eaf36e.gif] Update Firefox - current version is 31.0
In the upper left corner of your monitor screen you will see an orange Firefox button [external image: Firefox-2_zpsa7259ec1.png]
Click the dropdown menu , slide your mouse cursor over to the Help sub menu.
Wait for the Help menu to expand, then click on About Firefox
A small window will open similar to the one below.
[external image: Firefox-3_zpsc32408ba.png]
Click on the Update button as shown in the image above.
Allow Mozilla Firefox to update, reboot if instructed to do so .
========================= [external image: bullseye_zpse9eaf36e.gif] Disk Defragmenter for Vista
Open Disk Defragmenter by clicking the Start button, > All Programs , > Accessories , > System Tools and then clicking Disk Defragmenter ..
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
Click Defragment Now .
Disk Defragmenter might take from several minutes to a few hours to finish, depending on the size and degree of fragmentation of your hard disk. You can still use your computer during the defragmentation process.http://windows.microsoft.com/en-US/windows-vista/improve-performance-by-defragmenting-your-hard-disk ========================= [external image: bullseye_zpse9eaf36e.gif] Reboot ========================= In your next post please provide the following
How is the computer running at the moment?
Hi computerwannabe
Due to inactivity this topic will be closed.
If you need help please start a new thread.
New members follow the instructions here
http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic
![[external image: Firefox-2_zpsa7259ec1.png]](http://s1269.photobucket.com/user/OCD-WTT/media/Firefox-2_zpsa7259ec1.png.html){kind=link}
![[external image: Firefox-3_zpsc32408ba.png]](http://s1269.photobucket.com/user/OCD-WTT/media/Firefox-3_zpsc32408ba.png.html){kind=link}