Solved Do I have the w32 Blaster?

[Prescottbob]

Yes FRST got the same error messages. What should I do next 78 or safe mode for your last post for I explore.exe. ?

 

[VistaKing]

Can he open REGEDIT and navigate to

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\RANDOM.exe

Also take a look in here

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security

Also look in here

%appdata%\amsecure.exe

 

[Prescottbob]

My head is twirling. I have not started 78 yet. Which step is next?

 

[VistaKing]

Start 78 . We will work from there .

 

[Prescottbob]

My old brain and body tell to start fresh tomorrow. Thank you guys for your tenaciousness . i'll be back at it at 8 am.

 

[VistaKing]

You're welcome .

 

[cottonball]

Prescottbob,

Getting a fresh start is good.

However, on second thought, start with Post #79 in Safe Mode with Networking, and go to Post #78 where the
--->> is, and requests you to take action with RKill, etc.

In Post #78, here:
--->> Please press the Windows key and the R key simultaneously to open Run dialog box.

In the Run box, type (or copy/paste with your mouse, if you can):

iexplore.exe http://www.bleepingcomputer.com/download/rkill/dl/132/
Press: OK

...press on with the rest of Post #78...

The best chances of getting this malware beat, is to go in Safe Mode with Networking.

Also, did an icon appear on your Desktop for this malware?

 

[VistaKing]

If I'm not mistaken the virus is called Internet Security 2013

 

[cottonball]

Yes, that is it, and may be a bear to get rid of.

It can also add a RootKit for dessert....

 

[VistaKing]

Yes most rogue antivirus software do .

 

[Prescottbob]

I'm back. Reading your Posts #87&88 jogged my memory. The window requesting me to buy the program to fix the 6 viruses it saw had a header of INTERNET SECURITY 2013. When I could not X out the window I clicked BUY to see if I could just say NO THANKS. At this point I believe the INTERNET SECURITY 2013 icon appeared which I deleted sometime before requesting some help. I'm in SAFE MODE WITH NETWORKING and starting to do post # 79.

 

[Prescottbob]

rkill will not download- same virus detected and deleted message. We've still got rkill on the flash drive. can I use that?

 

[Prescottbob]

V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : Download RogueKiller (Official website)
Blog : tigzy-RK
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Safe mode with network support
User : Binnie [Admin rights]
Mode : Scan -- Date : 05/08/2013 09:11:07
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤


I went ahead and ran rkill from the flash drive.

 

[Prescottbob]

I went and got MBAM on a flash drive and am running it now.
9:50 am MST

 

[Jacee]

Let's try flushing the bad DNS cache and resotring MS's Hosts file

Copy and paste these lines in Note pad:

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.

Double click on the flush.bat file to run it.Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

 

[Prescottbob]

Hi Jacee,

Take me thru highlite then copy then?

 

[Prescottbob]

I've got it in Notepad. Next step?

 

[Jacee]

Open Notepad.....
Select the Bolded text. Highlight the desired text by holding down the left mouse button and dragging across the text you wish to copy.
Release the mouse button. When you've selected the entire block of text desired, release your hold of the button.

The text should now be highlighted in your chosen highlight color
Right-click the selected text. Select copy'.
Now, at the blinking cursor in notepad, Select "Paste." The copied material will be inserted.

Click on 'file' (in the notepad window), select "Save as" and follow the rest of my instructions.

 

[Prescottbob]

Jacee,

I am still running MBAM in safe mode. The left side of Notepad is off the screen so I can't see anything left of "view". So I should wait till MBAM is finished-reboot-then try #95 ?

 

[Jacee]

Yes, wait until MBam has finished.