I have a virus that reinstalls after a recovery. Please help.

SevSaint · 19 Sep 2013

I had some guys help me get rid of a virus a few weeks back. But it came back for some reason. My restore points gone, my diagostic tools not working again. When i click on it to do something the blue circle just spins for up to a minute if not more. Sometimes for so long i just shut down the computer and try restarting in safe mode.
In safe mode it runs ok, sometimes a lil laggy.
Btw its an HP Pavillion d7.
Amd duo core
4 gigs ram
Win 7 x64 home prem.

Please someone walk me through how to get rid of this problem!

redfang337 · 19 Sep 2013

hello again sev

happy to see you here again--wait, that didn't come out right... Anyways...
OT have you tried going thru the ropes of what we did last time? I added the link so you could see it again, or do you want to just go thru the steps again in this thread, since, of course, the thread is a bit mixed up?
Heat Damage or Virus?

SevSaint · 19 Sep 2013

Lets go through the steps again. But how does it keep coming back?

cottonball · 19 Sep 2013

SevSaint,

This tool has been updated, and would like for you to download a new copy of it.
There is a variant of the ZeroAccess rootkit that is very tricky to identify and remove.
Let's see what the reports show.

Please go to the Farbar Recovery Scan Tool Download
Select the version that applies to your system.

Save it to your Desktop.
Double-click the downloaded file to run it.

When the tool opens click Yes to the disclaimer.
Press the Scan button.

FRST makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

Please provide the FRST.txt in your reply.

The first time the tool is run, it also makes another log: Addition.txt

Also post the: Addition.txt in your reply.

SevSaint · 19 Sep 2013

alrighty.. doing that now, but windows keeps trying to restart a funny box pops up and says windows has stopped working click to restart.. if i do it redoes broswer everything, so i just drag that box off to side.. nows its hung up...but got it downloaded to desktop

SevSaint · 19 Sep 2013

trying to get it uploaded.. taking a long time

ICIT2LOL · 20 Sep 2013

Hiyya Sev I don't know much about those attached files Cotton Ball is better qualified than me to read them. But out of interest what security have you got on this machine?
Plus have you got any on call scanners ir Malwarebytes SuperAntiSpyware or ADWCleaner on the machine you can run in safe mode?.

UsernameIssues · 20 Sep 2013

SevSaint said:

I had some guys help me get rid of a virus a few weeks back. But it came back for some reason....

I would suggest that you uninstall Java and see if you can live without it.

If you must have it installed, then at least use the latest (safest?) version.

The versions that you have...
Java(TM) 6 Update 15 (64-bit) (Version: 6.0.150)
Java(TM) 6 Update 15 (x32 Version: 6.0.150)
Java(TM) SE Development Kit 6 Update 15 (64-bit) (Version: 1.6.0.150)
...are way out of date.

You might want to read the bottom part of this post... and maybe this one too.

ICIT2LOL · 20 Sep 2013

cottonball said:

SevSaint,

This tool has been updated, and would like for you to download a new copy of it.
There is a variant of the ZeroAccess rootkit that is very tricky to identify and remove.
Let's see what the reports show.

Please go to the Farbar Recovery Scan Tool Download
Select the version that applies to your system.

Save it to your Desktop.
Double-click the downloaded file to run it.

When the tool opens click Yes to the disclaimer.
Press the Scan button.

FRST makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

Please provide the FRST.txt in your reply.

The first time the tool is run, it also makes another log: Addition.txt

Also post the: Addition.txt in your reply.

Cotton Ball I did a bit of scouting round and came up with a few hits on that Zero access rootkit. There were a few refs to the Kaspersky TDSS and the Eset online scanner plus a German listing that included GMER do you think they would be of any use??

SevSaint · 20 Sep 2013

the computer, even in safe, is barely useable. It keeps saying windows explorer has quit working and then gives me option to check online for solution and restart, or just to restart. Once it restarts it closes most of the stuff im doing down. So doing any updates on java etc.. are not going to happen. It took me 30 minutes just to get something uploaded due to constant resets on windows explorer.
Ill wait on Icit2lol and cottonball to come up with my next step.