Hi computerguy, do the following;
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.
* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
Reboot the computer
Please Run the ESET Online Scanner and attach the ScanLog with your post for assistance.
* You will need to use Internet Explorer to to complete this scan.
* You will need to temporarily Disable your current Anti-virus program. AND Spybot TeaTimer if it is running.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please post that log for us as directed below.
Reboot the computer
Download HiJackThis. Run a full system scan with it and save the log.
Post back here with all three logs.
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
No, we would need a new HJT log done AFTER the computer is cleaned or, we hope will be cleaned, those other two scans.
With these infections today it is very rare that only one program will remove them. Right now there are only two programs you need to run and HOPEFULLY that will be all, but I cannot make promises on that either.
virtumonde is a trojan not a virus. Probably one reason the two programs you have run will not remove it though they CAN detect it, which is good because hopefully it was found early enough that no permanent damage has been done. Trojans usually are NOT removed by an antivirus program, why? because it is not a virus. Virtumonde usually comes onto a computer because of outdated java programs, though there can also be other reasons too. Trojans usually need specialized tools for removal, one of these IS MBA-M, which right now seems to be the best program available for removal of trojans and malware. Take a look at the majority of threads here right now, the bulk of them have had MBA-M as one of the tools we recommend most because it does a superior job of removal today. We request the ESET online antivirus scanner or several others also because if there is one infection on a computer then chances become more likely there are others too, because the system defenses are weakened which can allow viruses onto the computer too. We need to cover ALL bases here to be certain your computer gets clean.
Neither of these two programs should take extraordinarily long to run and clean but even if they do if you choose NOT to run them what will happen for certain is more and more infections until finally the computer could suffer severe damage to key operating system files, possible loss of very important personal files, then your only option would be reformat.
So you choose.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
WOW, ok this sounds more serious than i thought.
I am running the malware scan as we speak now, then i will restart and run online scan. Then i will restart and run hijackthis and post the log as well as the other logs also.
Is there a chance malware program will remove it?
If not, you mentioned IS-MBAM i really dont know what it stands for....but it seems good. Would that remove it?
Thanks alot...
will post logs soon..:)
MBA-M stands forMalwarebytes' Anti-Malware
That is the first program I noted that you should run. When I capitalized the IS I meant it "IS" one of the best, didn't mean to make it part of the name. It takes care of hundreds of nasty items now and hopefully will do the trick for you. It is a super program and you should keep it and use it, updating before each scan, at least once a week. Remember though, it is not the "end all and be all" of removal programs, just one of the better ones out there today and it DOES remove many of the trojans out there now. You would still need a good, onboard anti-virus program and firewall too.
I will wait for you to post the three logs requested and we can better see where things stand.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
I have to ask that you ONLY run the programs requested here until told otherwise. Spybot is a great program but right now let's work with the two requested.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
I will be away for the next four days. Crunchie will be checking on threads. Please follow any instructions he may give you.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
Can you please do the following.
===============
Can you disable Windows Defender as it may interfere with the removal process. Please leave it disabled until your PC has been given the all clear.Open Windows Defender
Click Tools
Click General Settings
Scroll down to Real Time Protection Options
Uncheck Turn on Real Time Protection (recommended)
After you uncheck this, click on the Save button
Close Windows Defender
===============
Scan with HijackThis and then place a check next to all the following, if present:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O13 - Gopher Prefix:
Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".
===============
After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
The log looks ok to me. Post back if you still have problems.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
