Help!!! Cannot remove infection.

[ZOOYUKA]

How can I remove a virus when I can't get my antivirus to work? I am open to any and all suggestions. I will provide what ever information is necessary to rectify the problem and I am willing to paypal a reward to whoever solves the issue.

 

[masteryoda34]

Well you could try booting in safe mode. (Press F8 during startup to bring up boot options.)

Also, it would be much more helpful if you gave more description of exactly what is happening.

 

[Chiefcrowe]

I'd try burning an antivirus cd from Avira and scanning with the boot cd.

download this - Avira AntiVir Rescue System from here:

http://www.avira.com/en/support/support_downloads.html

 

[ZOOYUKA]

I've tried safe mode, but it errors. And chiefcrowe, it won't allow me to got to that site. That is the main thing it is blocking all security sites.

 

[mechBgon]

Originally posted by: ZOOYUKA
I've tried safe mode, but it errors. And chiefcrowe, it won't allow me to got to that site. That is the main thing it is blocking all security sites.

If possible, use a clean computer to go to that site and get the download.

You may also be able to make some headway by doing a System Restore to go back in time to before the infection happened. Start > All Programs > Accessories > System Tools > System Restore. Any good?

 

[ZOOYUKA]

I tried restoring, but that does not fix the problem.

 

[mechBgon]

Try using this URL to reach Avira's site like Chiefcrowe suggested:

http://62.146.210.133/en/support/support_downloads.html

If that works,

1) go ahead and back up your files, email, contacts, music, videos and whatever else you value,

2) ensure that you have your Windows CD or DVD and your license key, just in case you blow stuff up

3) then download and run Avira AntiVir Rescue System. It should create a bootable CD.

4) Boot the system from the CD and have it scan.

 

[ZOOYUKA]

Originally posted by: mechBgon
Try using this URL to reach Avira's site like Chiefcrowe suggested:

http://62.146.210.133/en/support/support_downloads.html

If that works,

1) go ahead and back up your files, email, contacts, music, videos and whatever else you value,

2) ensure that you have your Windows CD or DVD and your license key, just in case you blow stuff up

3) then download and run Avira AntiVir Rescue System. It should create a bootable CD.

4) Boot the system from the CD and have it scan.

It blocks me from all security websites.

 

[mechBgon]

Originally posted by: ZOOYUKA

Originally posted by: mechBgon
Try using this URL to reach Avira's site like Chiefcrowe suggested:

http://62.146.210.133/en/support/support_downloads.html

If that works,

1) go ahead and back up your files, email, contacts, music, videos and whatever else you value,

2) ensure that you have your Windows CD or DVD and your license key, just in case you blow stuff up

3) then download and run Avira AntiVir Rescue System. It should create a bootable CD.

4) Boot the system from the CD and have it scan.

It blocks me from all security websites.

Even by IP address? Did you try?

Anyhow, open Notepad, and use it to view C:\Windows\System32\Drivers\Etc\HOSTS. Remove all entries except 127.0.0.1 localhost and see if you can get through now.

 

[ZOOYUKA]

Originally posted by: mechBgon

Originally posted by: ZOOYUKA

Originally posted by: mechBgon
Try using this URL to reach Avira's site like Chiefcrowe suggested:

http://62.146.210.133/en/support/support_downloads.html

If that works,

1) go ahead and back up your files, email, contacts, music, videos and whatever else you value,

2) ensure that you have your Windows CD or DVD and your license key, just in case you blow stuff up

3) then download and run Avira AntiVir Rescue System. It should create a bootable CD.

4) Boot the system from the CD and have it scan.

It blocks me from all security websites.

Even by IP address? Did you try?

Anyhow, open Notepad, and use it to view C:\Windows\System32\Drivers\Etc\HOSTS. Remove all entries except 127.0.0.1 localhost and see if you can get through now.

I am not sure exactly what you mean. Can you break it down for me. I am not very knowlegable on this subject.

 

[ZOOYUKA]

Managed to get avast on my pc. Did a complete scan. Some things were detected, but the problem is still there. I cannot go to windows or any security websites still.

 

[n0cmonkey]

Start -> run -> notepad -> Ok

File -> Open ->C:\Windows\System32\Drivers\Etc\HOSTS

Delete all lines except the one that lists 127.0.0.1.

 

[ZOOYUKA]

Originally posted by: n0cmonkey
Start -> run -> notepad -> Ok

File -> Open ->C:\Windows\System32\Drivers\Etc\HOSTS

Delete all lines except the one that lists 127.0.0.1.

I did exactly what you said. I dont know what to do next. It will not let me save since it is a read only file. Thanks for the help.

 

[n0cmonkey]

Originally posted by: ZOOYUKA

Originally posted by: n0cmonkey
Start -> run -> notepad -> Ok

File -> Open ->C:\Windows\System32\Drivers\Etc\HOSTS

Delete all lines except the one that lists 127.0.0.1.

I did exactly what you said. I dont know what to do next. It will not let me save since it is a read only file. Thanks for the help.

If you're an admin you should be able to adjust permissions on the file.

 

[RebateMonger]

Originally posted by: ZOOYUKA
Managed to get avast on my pc. Did a complete scan. Some things were detected, but the problem is still there. I cannot go to windows or any security websites still.

AVAST! has an option to do a Rootkit scan upon boot. Try that.

Or, as noted, boot from a "Rescue CD" that does a scan before Windows loads. F-Secure makes one of these available, too.

Getting those needed files would be easiest if you have another PC available. If not, you could even create and boot from a Linux Live CD (try Ubuntu), go onto the Internet from the Linux Boot CD, and get the needed scan files that way.

 

[ZOOYUKA]

Originally posted by: n0cmonkey

Originally posted by: ZOOYUKA

Originally posted by: n0cmonkey
Start -> run -> notepad -> Ok

File -> Open ->C:\Windows\System32\Drivers\Etc\HOSTS

Delete all lines except the one that lists 127.0.0.1.

I did exactly what you said. I dont know what to do next. It will not let me save since it is a read only file. Thanks for the help.

If you're an admin you should be able to adjust permissions on the file.

Is this what it should look like?

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

 

[mechBgon]

Originally posted by: ZOOYUKA

Originally posted by: n0cmonkey

Originally posted by: ZOOYUKA

Originally posted by: n0cmonkey
Start -> run -> notepad -> Ok

File -> Open ->C:\Windows\System32\Drivers\Etc\HOSTS

Delete all lines except the one that lists 127.0.0.1.

I did exactly what you said. I dont know what to do next. It will not let me save since it is a read only file. Thanks for the help.

If you're an admin you should be able to adjust permissions on the file.

Is this what it should look like?

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Yeah, you got it. If necessary, remove the Read-Only attribute on the file by going to its location, right-clicking it, and choosing Properties to reach the Read-Only checkbox.

Also, Avast is not the greatest antivirus product out there. If you are able to reach other security sites now, try that AntiVir bootable CD for a second opinion.

 

[ZOOYUKA]

Originally posted by: mechBgon

Originally posted by: ZOOYUKA

Originally posted by: n0cmonkey

Originally posted by: ZOOYUKA

Originally posted by: n0cmonkey
Start -> run -> notepad -> Ok

File -> Open ->C:\Windows\System32\Drivers\Etc\HOSTS

Delete all lines except the one that lists 127.0.0.1.

I did exactly what you said. I dont know what to do next. It will not let me save since it is a read only file. Thanks for the help.

If you're an admin you should be able to adjust permissions on the file.

Is this what it should look like?

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Yeah, you got it. If necessary, remove the Read-Only attribute on the file by going to its location, right-clicking it, and choosing Properties to reach the Read-Only checkbox.

Also, Avast is not the greatest antivirus product out there. If you are able to reach other security sites now, try that AntiVir bootable CD for a second opinion.

Got it. I unchecked the read-only box and saved as i displayed above. I still am unable to go to security sites. Any other suggestions?

 

[mechBgon]

Originally posted by: ZOOYUKA

Originally posted by: mechBgon

Originally posted by: ZOOYUKA

Originally posted by: n0cmonkey

Originally posted by: ZOOYUKA

Originally posted by: n0cmonkey
Start -> run -> notepad -> Ok

File -> Open ->C:\Windows\System32\Drivers\Etc\HOSTS

Delete all lines except the one that lists 127.0.0.1.

I did exactly what you said. I dont know what to do next. It will not let me save since it is a read only file. Thanks for the help.

If you're an admin you should be able to adjust permissions on the file.

Is this what it should look like?

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Yeah, you got it. If necessary, remove the Read-Only attribute on the file by going to its location, right-clicking it, and choosing Properties to reach the Read-Only checkbox.

Also, Avast is not the greatest antivirus product out there. If you are able to reach other security sites now, try that AntiVir bootable CD for a second opinion.

Got it. I unchecked the read-only box and saved as i displayed above. I still am unable to go to security sites. Any other suggestions?

1) run the command netsh winsock reset by using Start > Run. Then reboot.

2) post a HijackThis 2.02 log. http://majorgeeks.com/download5554.html

 

[BriGy86]

Another option is to take the drive out and connect it to a completely patched computer and do a scan that way. make sure not to log in as an admin in case things try to auto install on the clean computer.

http://majorgeeks.com/download4372.html
This may do the same thing that Mech suggested just in a GUI.

 

[ZOOYUKA]

Here is my Hi Jack This log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:30:31 PM, on 5/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\winsvc32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Patrick\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\winsvc32.exe
C:\Program Files\Orb Networks\Orb\bin\Orb.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Patrick\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Patrick\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Patrick\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Patrick\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Patrick\My Documents\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netflix.com/WatchNow?lnkctr=mhWN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [winsvc32] winsvc32.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Patrick\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Orb] C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\PROGRA~1\MOZILL~1\plugins\NPSWF32_FlashUtil.exe -p (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\PROGRA~1\MOZILL~1\plugins\NPSWF32_FlashUtil.exe -p (User 'Default user')
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.micros...site.cab?1113588742984
O16 - DPF: {FC0A65F2-8DFF-4F0F-B411-D4A50311628D} (XMRADIO.XM_SystemProfiler) - http://xmro.xmradio.com/xstrea...on/dell/xmprofiler.CAB
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MediaMall Server - MediaMallTechnologies, Inc. - C:\Program Files\MediaMall\MediaMallServer.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

--
End of file - 8100 bytes

 

[mechBgon]

Try using HijackThis to remove these:

C:\WINDOWS\winsvc32.exe

C:\WINDOWS\winsvc32.exe (two instances of this)

O4 - HKLM\..\Run: [winsvc32] winsvc32.exe

Also, based on the logfile's info, you should run Secunia's PSI utility and fix everything it says to fix (out-of-date Adobe Reader, Java, Flash Player, and other easily-exploited stuff).

 

[lxskllr]

YGPM

 

[ZOOYUKA]

Still can't get the situation resolved. Any other suggestions?

 

[ZOOYUKA]

I just tried a fresh install of avg and avira. It will start to let me install and then it will not complete.