Virus.org /for fucks sake.asp.=googleredirect please help

Sm_Art · Aug 22, 2009

I had the same problem and was struggling for 3 days with different antivirus software until i found the solution AVAST, most likely you have VIRUT(it has other names too), try not to run any programs or they'll get infected too.

download and run this Virut removal tool:

Code:

http://download.avg.com/filedir/util/avg_rem_sup.dir/rmvirut/rmvirut.exe

then download Avast Antivirus(there's no better antivirus on this planet and my situation proved it, I tried almost all Antiviruses and only avast was able to detect virus, and it always detects when websites try to infect you, when 99% of other Antiviruses can't, I tested )
install and run it (delete every infected file it finds)

Code:

http://www.avast.com/eng/download-avast-professional.html

serials for Avast Antivirus:

Code:

http://rapidshare.com/files/270211136/avast__4.8.1195_SERIAL.txt.html

you may have to reinstall windows, i had to
hit thanks if this helps you

BlackHattin · Aug 22, 2009

Sm_Art · Aug 22, 2009

NOD32 wasn't able to remove/detect when Avast did, so that's no fact and stop confusing her

oxonbeef · Aug 22, 2009

I used to use avast and it was great but it hogs your RAM like
crazy. An AV is only as good as its database so you should
choose one with anti heuristics that looks for strings that
are likely to be infections. Personally I dont have an AV enabled
on my pc and it's virtually bullitproof based on my permissions.

Numa68 · Aug 22, 2009

ruler0fall said:
didn't read the thread but try combofix, and if that doesn't help make a hijackthis log (google for it) and post it on one of the log analysis forums.

Absolutely. I own a company that does several malware cleanups each week and ComboFix is always one of the first steps in getting most of the driveby stuff off of systems.

@DebbieSprules - You will want to completely remove any realtime antivirus software from your computer before using ComboFix as they can interfere with it's rootkit scanner and also may have been compromised themselves. Also, turn off System Restore before running ComboFix.

Download ComboFix from one of the two mirrors here:

Code:

[B]http://www.bleepingcomputer.com/combofix/how-to-use-combofix[/B]

Never download it from any other site! Run it in real mode and let it do its thing. No matter what, do not stop the program while it's running. It will probably reboot your system and then prepare a log for you. You may also need to run it again, and in safe mode too.

After that, try running Spybot, Malwarebytes, and SuperAntispyware, again, without having a real time antivirus program running. Run them in real and safe modes until they come clean, then install the realtime antivirus of your choice and scan with it as well.

You mentioned that your system has been in the shop twice, I am assuming because of infections? Some malware can actually corrupt the permissions in your registry and filesystem making themselves invisible to scanners. If that is the case then you will probably need to find a competent person near you to remove the malware. You may want to ask them what they do about registry permissions and if they give you blank look, then go elsewhere.

Also, keep in mind that using VirusTotal or other systems like it to scan a RAR is not going to ensure that you are not going to get infected. Those scanners can only tell you about viruses they know about and it is trivial to create a virus for limited distribution that will not be detected by heuristics or patterns. Oh yeah, and FFS please keep your Java and Adobe stuff updated - those are two of the biggest causes of getting infected from compromised websites.

wealth54 · Aug 22, 2009

dude listen what " trophaeum " saying.....................

DebbieSprules · Aug 22, 2009

Any hijack this forums you recommend for fast love and help?

In the meantime I am bowled over by the responses dishing out thanks....

@tropheaus - how do I hook up kis? I feel honered when a Mod dives in.

@ numa - I hade NO F Idea you had to update Java and .net!!!! WTF and I also had no idea that a scan is not enough for .rar files. OH MY GOD I am F**&"&" without my helpful bots... I already spent 1k on bots so I need the shares.... AAAAAAAAAAAAAh

Attached my hijack this.

I reckon this might be a good time to maybe add a "FFS" thread with moderated DOS and DO NOTS for running a system and being busy

Right back in front of my machine now < let me work methodically through the steps in this help / love / thread.

DebbieSprules · Aug 22, 2009

Sm_Art said:
I had the same problem and was struggling for 3 days with different antivirus software until i found the solution AVAST, most likely you have VIRUT(it has other names too), try not to run any programs or they'll get infected too.

download and run this Virut removal tool:

Code:

http://download.avg.com/filedir/util/avg_rem_sup.dir/rmvirut/rmvirut.exe

then download Avast Antivirus(there's no better antivirus on this planet and my situation proved it, I tried almost all Antiviruses and only avast was able to detect virus, and it always detects when websites try to infect you, when 99% of other Antiviruses can't, I tested )
install and run it (delete every infected file it finds)

Code:

http://www.avast.com/eng/download-avast-professional.html

serials for Avast Antivirus:

Code:

http://rapidshare.com/files/270211136/avast__4.8.1195_SERIAL.txt.html

you may have to reinstall windows, i had to
hit thanks if this helps you

This is amazing help but your last line says reinstall windows... does that not negate all your hard work with the posting the links to the avast?

Numa68 · Aug 22, 2009

DebbieSprules,

Open up HJT and put a check next to the following:

Code:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: (no name) - {0e6d7a5d-b560-4d1c-9713-18dd1ade6011} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - (no file)
O4 - HKCU\..\Run: [AV Care] C:\Program Files\AV Care\AvCare.exe
O4 - Startup: RpSync.exe.lnk = ?
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\lspbte.dll' missing
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/HOWARD~1/LOCALS~1/Temp/msohtmlclip1/01/clip_image001.gif

Once they're selected, hit the "Fix checked" button. Restart your computer and scan with HJT again, and see if any of the entries come back.

You are infected with a few trojans and something called AV Care, which is a rogue antimalware tool (a virus that poses as a virus scanner). To get rid of it, do this:

1 - Uninstall McAfee and Spyware Doctor completely, and reboot after uninstalling them.

2 - Run ComboFix and follow the prompts. If it asks you to download the recovery console from Microsoft, let it do so.

3 - Send me or post your ComboFix.txt log, located in the root level of C:

4 - Install and run Malwarebytes, SuperAntispyware, and Spybot. Scan, remove, reboot, and rescan until clean.

5 - Install Kaspersky or AVG. Scan, remove, reboot, and rescan until clean.

Sm_Art · Aug 22, 2009

I said you MAY have to, if u'll be able to make your windows work after cleanup you don't have to install windows, i had to, because my system was too fucked

flybeta · Aug 22, 2009

try iobit, ditch internet explore i'm sure your probably using it still. Install firefox with adblock plus and noscript plugin. looks like your lsp internets are messed up as well so download winsock fix, which fixes your tcp stack.

always run new programs found on sites that contain unreputable people in sandboxie.

gogugaozaru · Aug 22, 2009

try avast bart cd 2009

keinehabe · Aug 23, 2009

trophaeum said:
you are talking to the admin on the ppi forums, mcaffee is shit, kaspersky + malwarebytes is the best solution currently

kis will give you a 30day trial, just download and install it and run it, it'll do what it needs to to clean up the mess youv got

not to be rude my friend but I think you are talking with one of who's usually exploiting such areas :tee: . Anyway that's not important who we are and what we do right

? NONE of current antivir solutions can't never compete with mcafee not even after years , usually most of the time , it's users fault when their computers are compromised .

r00t said:
Not true.

1. There are several types.

You won't necessarily be infected by the website.

2.It generally has an iframe with an exploit pack. If you have a certain software that can be exploited by the pack, it'll download and execute an exe chosen by the iframer. Certain times the best way to avoid that is to update the software in your computer, such as acrobat reader.

And it can be any site, not just the warez ones.

There are certain live cds that will format and write over in your hard drive dozens or hundres of times, so it'll most probably delete everything, not being able to recover.

read yourself your sentence man , ok I think I`ve pointed back just what I said before

no need for more info (* at least not on this forum

)

DebbieSprules said:
jesus christ of the pentecost this is ridiculous.

i have to say although my heart is in my mouth. coming on hear today has cheered me up 14% nothing like a bit of love when your machine goes down and you feel like shit for being a grubby internet theif too poor to buy software like a big issue seller

D. listen , I know it's ugly feeling when you are reading it , but ... try and understand sometime it's not your fault , when this happens , this peoples exploiting practically human behaviors and they have success because their techniques it's very similar and looking like a normal site act.
IF your computer was infected already try and make a backup of your important files (* pictures / music / movies / school projects ... you got the idea ... what you consider you need to save .... ) save them on some dvd's/cd's try to avoid saving them on external hdd's or another backup solution's . Next step will be go get yourself one of advanced formatting software's I can recommend you partition magic , formatting your hdd in advanced mode (* even small resizing of partitions ) it's ONLY way to make the old file unrecoverable ! Then and only then installing a fresh windows , and try to keep it update , if you can afford the mcafee total security then install it first thing on your computer asap after you just installed the OS and setup the internet connection, only then you can continue with installing all other software's witch you are usually using , and of course recover from the backup media storage your important files saved before.

Sweetfunny · Aug 24, 2009

keinehabe said:
mcafeee isn't shite lol usually and most of the time it's working like a clockwork

Oh yes it is shite, McAfee has never been any good.. period. In the latest Matousec tests it bombed out in round 2 of the 10 round testing and even Windows Live OneCare scored higher. McAfee failed almost every KillBit test, meaning it's process terminated in numerous ways and thread handle obtained directly. It was bypassed with the COM interface in the breakout tests, it failed to control Windows Explorer and Internet Explorer launches with the Tooleasy/Wallbreaker tests and the list goes on.

You are better off with nothing, at least you won't have the false sense of security your being protected.

keinehabe said:
NO you can't get infected by visiting a page until you don't click an run the activeX control / javas / and some one few more ways ... anyway it's need a real click from the users to have the malware to start to work.

Funny stuff indeed, and far from factual.

PS. Troph recommended Kaspersky, it scored 96% apposed to McAfee's 12% so i think he knows a little more than you claim.

trophaeum · Aug 25, 2009

http://search.pricewatch.com/search...+security&totalcost_min=min&totalcost_max=max if you want to buy it
http://esd.element5.com/demoreg.html?productid=300324330 to get a 30day trial (just need to give em your email and they send you a link to download it, when you install just pick the 30day trial)

as for malwarebytes, hit up tpb or watevr and find a keygen for it and activate it as the full version then it has a realtime monitor, that combined with kis is the best solution currently, i say currently cos with things like this it'll change again and again but for now they are your best choices

note: a 2009 license allows u to use the same product for the latest version so you can buy kis2k9 and install kis 2k10 with it without issues which means as soon as the new version comes out each year you can just upgrade instead of having to buy a new one again and then upgrade

kammykhan · Aug 25, 2009

dude check ur ie addons... disable and delete ones not requried..
then run cc cleaner...
then restart into safemode... run cc cleaner...
msconfig-- stop startup options... then deactivate unrequired services..
restart into normal windows...
run malwarebytes!

hope this helps!

pr0xy · Aug 25, 2009

The only good thing you need is UBUNTU, no viruses.

oxonbeef · Aug 25, 2009

pr0xy said:
The only good thing you need is UBUNTU, no viruses.

Who are you trying to fool? UBUNTU's just as vunerable to a rootkit
as any other OS.

Virus.org /for fucks sake.asp.=googleredirect please help

Junior Member

BANNED

Junior Member

BANNED

Registered Member

Regular Member

Senior Member

Attachments

Senior Member

Registered Member

Junior Member

Junior Member

Registered Member

Supreme Member

Elite Member

Senior Member

Regular Member

Regular Member

BANNED

Main Menu

Marketplace

Making Money

BlackHat World