Solved I have a virus that reinstalls after a recovery. Please help.

[SevSaint]

I had some guys help me get rid of a virus a few weeks back. But it came back for some reason. My restore points gone, my diagostic tools not working again. When i click on it to do something the blue circle just spins for up to a minute if not more. Sometimes for so long i just shut down the computer and try restarting in safe mode.
In safe mode it runs ok, sometimes a lil laggy.
Btw its an HP Pavillion d7.
Amd duo core
4 gigs ram
Win 7 x64 home prem.

Please someone walk me through how to get rid of this problem!

 

[d00p98uy]

hello again sev happy to see you here again--wait, that didn't come out right... Anyways...
OT have you tried going thru the ropes of what we did last time? I added the link so you could see it again, or do you want to just go thru the steps again in this thread, since, of course, the thread is a bit mixed up?
http://www.sevenforums.com/general-discussion/302452-heat-damage-virus.html

 

[SevSaint]

Lets go through the steps again. But how does it keep coming back?

 

[cottonball]

SevSaint,

This tool has been updated, and would like for you to download a new copy of it.
There is a variant of the ZeroAccess rootkit that is very tricky to identify and remove.
Let's see what the reports show.

:info: Please go to the Farbar Recovery Scan Tool Download
Select the version that applies to your system.

Save it to your Desktop.http://www.sevenforums.com/
Double-click the downloaded file to run it.

When the tool opens click Yes to the disclaimer.
Press the Scan button.

FRST makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

:ar: Please provide the FRST.txt in your reply.

The first time the tool is run, it also makes another log: Addition.txt
:ar: Also post the: Addition.txt in your reply.

 

[SevSaint]

alrighty.. doing that now, but windows keeps trying to restart a funny box pops up and says windows has stopped working click to restart.. if i do it redoes broswer everything, so i just drag that box off to side.. nows its hung up...but got it downloaded to desktop

 

[SevSaint]

trying to get it uploaded.. taking a long time

 

[ICIT2LOL]

Hiyya Sev I don't know much about those attached files Cotton Ball is better qualified than me to read them. But out of interest what security have you got on this machine?
Plus have you got any on call scanners ir Malwarebytes SuperAntiSpyware or ADWCleaner on the machine you can run in safe mode?.

 

[UsernameIssues]

I had some guys help me get rid of a virus a few weeks back. But it came back for some reason....

I would suggest that you uninstall Java and see if you can live without it.

If you must have it installed, then at least use the latest (safest?) version.

The versions that you have...
Java(TM) 6 Update 15 (64-bit) (Version: 6.0.150)
Java(TM) 6 Update 15 (x32 Version: 6.0.150)
Java(TM) SE Development Kit 6 Update 15 (64-bit) (Version: 1.6.0.150)
...are way out of date.

You might want to read the bottom part of this post... and maybe this one too.

 

[ICIT2LOL]

SevSaint,

This tool has been updated, and would like for you to download a new copy of it.
There is a variant of the ZeroAccess rootkit that is very tricky to identify and remove.
Let's see what the reports show.

:info: Please go to the Farbar Recovery Scan Tool Download
Select the version that applies to your system.

Save it to your Desktop.
Double-click the downloaded file to run it.

When the tool opens click Yes to the disclaimer.
Press the Scan button.

FRST makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

:ar: Please provide the FRST.txt in your reply.

The first time the tool is run, it also makes another log: Addition.txt
:ar: Also post the: Addition.txt in your reply.

Cotton Ball I did a bit of scouting round and came up with a few hits on that Zero access rootkit. There were a few refs to the Kaspersky TDSS and the Eset online scanner plus a German listing that included GMER do you think they would be of any use??

 

[SevSaint]

the computer, even in safe, is barely useable. It keeps saying windows explorer has quit working and then gives me option to check online for solution and restart, or just to restart. Once it restarts it closes most of the stuff im doing down. So doing any updates on java etc.. are not going to happen. It took me 30 minutes just to get something uploaded due to constant resets on windows explorer.
Ill wait on Icit2lol and cottonball to come up with my next step.

 

[cottonball]

Did not see the ZeroAccess entries expected in the FRST reports.

:info: You may want to run Disk Cleanup, if possible at this stage, and remove any thumbs.db files created. The Addition.txt shows some issues with explorer.exe there.

Go to Start > All Programs > Accessories > System Tools > Disk Cleanup
In Disk Cleanup: Drive Selection make sure the (C) drive is showing
Click: OK
On the Disk Cleanup Menu make sure there's a check next to the Thumbnails entry.
Click OK, and the files selected are deleted.


:info: Next, using another computer, you may want to download the following program to a USB pendrive, and then move it to the Desktop of the problem computer.

Download aswMBR:
http://www.bleepingcomputer.com/download/aswmbr/
Save it to the pen drive, and then move it to the Desktop of the problem computer.

Make sure your AntiVirus is temporarily disabled!!
For information on how to disable protective programs, refer to this Link:
http://www.bleepingcomputer.com/forums/topic114351.html

Right-click the aswMBR file and select: Run as Administrator

When promped with: This Application can use the Avast! Free AntiVirus for scanning...etc.
Select: Yes

The last line of the run in progress will provide the status of the Avast! scan.
It will say: Downloading Avast! virus definitiond database, etc.
When the Avast! scan is done, the last line changes to: Avast Engine definitions #####

At this point, click the Scan button on the lower left of the aswMBR screen.
The last line will now say "Scanning" while in progress.
Upon completion of the scan, click >Save log< and save it to the Desktop.
Note: Please do NOT attempt to fix anything!!
Exit the program.

:ar: Please post the new aswMBR log in your reply.

Note that a file named MBR.dat is also created on the Desktop.

Please submit MBR.dat for analysis to the following online services that analyze suspicious files:
Jotti's virusscan

:ar: Please post the links for the file analyses in your reply.

 

[SevSaint]

the disk cleanup worked on the constant crashing of windows. thanks for that..
i didn't select any options for the scan. it was defaulted to quick scan so thats what this log includes..
if you wanted me to full scan etc.. then specify with reply and ill update with another log.
i noticed my mbr has an error but im sure you all will figure it out.

thanks again!!

http://virusscan.jotti.org/en/scanresult/cc6e50d4c9066655c108e469598be521f2417919

 

[cottonball]

SevSaint,

My apology for the obsolete links. Did not realize they needed updating.

Did not see what could be pointing to malware.

Take up the suggestions made by UsernameIssues and ICit2lol. Doubt that TDSSKiller will come up with anything, but, the ESET Online Scanner is a good detection tool.

Run the following when you have the time, though, it may take a while...
The ESET Scanner is implemented as an ActiveX control, so it is best run on Internet Explorer.
Right click the IE shortcut and select: Run as Administrator

Next, download: Free Online Virus Scanner | ESET

On the ESET website, click on: Run ESET Online Scanner
Click: Start

When asked, allow the add-on to be installed
Click: Start again

On the next prompt, Computer Scan Settings, check: Remove found threats
Next, click on: Advanced Settings



Make sure these options are checked:

• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology

Click: Scan


When the scan is completed, if threats are found, in the Scan Results prompt:

• Click on: List of threats found
• Click on: Export to text file
• Save to the Desktop and name it ESET Scan Results
• Click on: Back
• Place a check on: Uninstall application on close
• Click on: Finish, and close the program.

If anything is found, please provide the ESET report in your reply to determine if any further action is necessary.

 

[SevSaint]

it's not even running in safe mode now. it takes 1 minute or more for anything to happen. sevenforums will not load.. i am beginning to think its hardware related.

 

[ICIT2LOL]

Hello Sev mate I have found this it might be worth a try and the two bottom answers have alternatives How to solve Windows explorer has stopped working... - Microsoft Community

 

[SevSaint]

alrighty ill make some adjustments. will be a few days since im in the process of moving just bookmark and check back if you will.

 

[ICIT2LOL]

No probs - happy moving

 

[SevSaint]

i got on the computer to recover the computer since it was totally hung every time i clicked on anything in safe mode and it was running fine. someone said it might be a satr cable on the hard drive thats lose.
sometimes i hear a slight pop when turned on or off. dont have a clue what that is.. going to do what has been suggest and its currently at factory install condidtion again for the 6th time in a month

 

[d00p98uy]

SevSaint, I think the only thing you can do about now is a Clean ReInstall. I'd do a scan with TDSSKiller and MalwareBytes Anti-Rootkit (MBAR) before reinstalling to make sure no rootkits are involved. We've tried just about everything, and if something does end up working, the computer wouldn't be trustworthy due to whatever virus got in it in the first place.
I think It's the best solution.

NOTE: Make sure you follow these instructions for TDSSKiller:
when starting the application, click the Preferences button. Then make sure the following are checked

Then start your scan

As for the pop when the computer starts or shuts down, I am not experienced with this, for some laptops it's normal, although I do not think good, someone with more knowledge than I would have to address that situation

--Brad

 

[SevSaint]

alrighty red.. downloading the iso sp1 for my OS right now.. might take a few days since all the work and stuff i gota do.. but if that doesn't work then i know its the hardware and not software issue.