possible virus, which forum to go to for help

[drmax]

Hello and thx for following up. Will do this in the morning after some shut eye.

 

[cottonball]

No problem, drmax.

Going to get some Zzzzsss also.

Might not het back to you until tomorrow afternoon. Having lunch with a couple of friends.

 

[drmax]

Here you go. Does this ck more than just the operating systems drive? I have another storage drive that pretty big. I'd like this looked over.

 

[cottonball]

drmax,

Let’s check the Master Boot Record; another location where Rootkits hide.

In the clean computer with the USB flash drive plugged in...

Please download MBRFix:
Download MBRFix 1.3.0.0 Free - Fix or create Master Boot Record (MBR) on harddisks - Softpedia
Save to the Desktop.

Right-click the file and select: Extract here…

Once extracted, there are three files in the folder that is created.

Copy only the MBRFix64 application to the USB drive.


Now, open Notepad: (Start > All Programs > Accessories > Notepad).
Copy the entire contents of the code box below.

HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess
SaveMbr: Drive=0

Save this info on the flashdrive as fixlist.txt
　

Once again, please enter System Recovery Options and select: Command Prompt

Run FRST and press the Fix button just once, and wait.

When done, the tool makes a log on the flashdrive called Fixlog.txt.

Please post its contents in your reply.

Another file, MBRDUMP.txt also appear on the flash drive.
It may look a text file, but it is not. It is a hex file! (Don't open it, it will be all gibberish.)

Please attach the MBRDUMP.txt in your reply.

 

[drmax]

will get to this asap, hopefully within an hour or 2

 

[drmax]

?

2 of the 3 app files are mbrfix and mbrfix64? my machine is a 64 bit. you asked me to use the mbrfix. double checking before you ask me to do over. thx dm

 

[cottonball]

That one went right over my head, my apology!

You are correct. It is: mbrfix64

 

[drmax]

last one

Here you go...and also, I thought since mbrfix64 is an exe program, i would have type that at comand prompt, rather that the frst64? (unless those too work together in frst64) Anyway's I did what you asked.
I gotta go work now. Thx for all your help....DM

 

[cottonball]

Got the MBRDump.txt, and will be looking at it.

Also provide the last Fixlog.txt

FRST64 produced it also on the USB flash drive.

 

[drmax]

ok

ok didn't catch that....

 

[cottonball]

There is no malware on the MBR, and the MBR code is also clean.

Good news!

FRST64 got things under control.

Please run RogueKiller once again, and let's see what it shows.
(RogueKiller instructions in Post #2)

Also, provide an update on how the system is running.

 

[cottonball]

Also, let’s check the Security status with the following:

Download Security Check:
http://screen317.spywareinfoforum.org/
Save to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside the black box.

When done, a Notepad report opens automatically, called: checkup.txt

Please post its contents in your reply.

Note:
SecurityCheck may produce some false warning(s). Please do not take any corrective actions!

 

[drmax]

here you are

Was my drive "D" scanned with any of what we did? If not, how would I go about this, as I swap info between master drive "C" and storage device "D"?

Thank you very much. You provided me with alot of help.

 

[cottonball]

When you go to the Microsoft Security Essentials (MSE) console, click the Settings tab.
On the left side, go to: Advanced
Select: Scan removable drives
　
Next, go to the Home tab
Select: Custom
Press: Scan now

A prompt appears with the drives on the machine.

Select the drives you want MSE to scan, and do a Full scan.

Post back on any issues.

 

[drmax]

ok

I will do just that and have a look on my other drive. Say, are you primarily in the virus section, or do you help out elsewhere? I created a post in the "windows updates" section entitled "error code 66A" earlier this morning and have not had a nibble, with 170 views.

 

[cottonball]

This old brain has enough to handle in the malware area. It keeps me totally confused!!

Hang in there, someone will show up to help.

Don't forget to post a new RogueKiller report. We need to see if it shows any more ZeroAccess.

 

[drmax]

missed that

I missed that request for another RK report. You're keeping me busy...
I'll do this in the morning when I get off from work...dm

 

[drmax]

I know I said I was going to purchase a plan from malwarebytes, and I intend to do so.
What is your take on that, cottonball? Or do you prefer another? I'll most likely keep MSE
as the primary A/V progy. Thx for your input.

PS, due to my habits and what I download, I pretty much need full time protection on both drives...

 

[Jacee]

PS, due to my habits and what I download, I pretty much need full time protection on both drives...

Nothing is going to protect you from bad habits and doubtful/harmful downloads.

Don't expect "FREE" help to continue for your negligence in abiding by the security rules of the net!! :shock:

 

[DBone]

due to my habits and what I download, I pretty much need full time protection on both drives...

You really need to invest in a virtualization program like Sandboxie as well as an anti-executable like EXE Radar Pro . . . . . . . No AV alone will protect you with your usage habits.