need help getting rid of malware

[zuth]

hello everyone
i recently started getting some errors in various places and antivirus notifications about some files that were quarantined immediately.
than i found out my firewall (windows) is turned off and cant be turned on again, when trying to do so i get 'error code 0x8007042c'
i tried turning it on manually through 'Services' and got another error
i ran scans with both Malwarebytes and Ad-aware, they removed some malicious files
yet i still cant turn on my firewall and i still get antivirus notifications such as : "a variant of Win32/Olmarik.AVQ trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\Windows\System32\svchost.exe"
now that i keep Malwarebytes running i also get a massage from time to time that it "successfully blocked access to a potentially malicious website"

so i guess that my system is not yet clean even though scans come up with nothing
im grateful for any advice on that matter

 

[seavixen32]

Hello zuth.

Did you run Malwarebytes in Safe Mode?

If not, I'd recommend that you do just that.

You might also want to download and run the Microsoft Windows Malicious Software Removal Tool: Download Details - Microsoft Download Center - Windows Malicious Software Removal Tool

 

[Francis93]

Download, install and update Malwarebytes' Anti-Malware as advised by seavixen32.

Click on the start orb and type 'msconfig' under the Boot tab select Safe Boot - Minimal. Click 'Restart' on the prompt. Once you have booted successfully, open Malwarebytes and do a full scan.

OR

Restart your PC, hold down the F8 key to bring up the Advanced Boot Options screen and choose Safe Mode with Networking. Once you have booted into that option successfully, open your browser then download, install and update Malwarebytes and perform a full scan.

You might want to try other on-demand scanners:
Hitman Pro
SUPERAntiSpyware

 

[Golden]

now that i keep Malwarebytes running i also get a massage from time to time that it "successfully blocked access to a potentially malicious website"

Hi,

The above behaviour is normal for the resident version of Malwarebytes - it appears to be working as per design.

Regarding your firewall, what antimalware software (aside from Malwarebytes) are you currently using? Perhaps it has its own version of a firewall, such as many anti-virus suites, which turn off the Windows Firewall.

Regards,
Golden

 

[gautam7]

AFAIK MBAM works best in normal mode rather than safemode. If MBAM is not completely removing the malware then give Hitman pro and Dr webcureit a go. These three combined should solve the problem completely. Even if this combo fail then burn a kespersky rescue disk and do a scan with the rescue disk. Should solve your problem.

 

[seavixen32]

Guatam7, having rechecked it would appear you are correct in your assumption that Malwarebytes should be run in normal mode.

Advice here from Malwarebytes if the computer is infected: I'm infected - What do I do now? - Malwarebytes Forum

 

[gautam7]

Thanks for the confirmation Seavixen32

 

[seavixen32]

You're welcome Gautam. I'm always concerned about giving wrong advice as it can be worse than no advice at all.

 

[zuth]

wow, thanks for all the replies
first of, just to set things straight, i ran Malwarebytes both in safe mode and normal
and i also ran Windows malicious software removal tool which found nothing

@Golden - im currently not using any software aside from Malwarebytes, and my antivirus is NOD32, which i dont believe is causing this, it didnt do anything like this up until now

im gonna give Hitman pro and Dr webcureit a go and report back

 

[zuth]

reporting back, with good news (hopefully)
i just gave HitmanPro a go, rebooted and my firewall is back on
also, i had no alarming massages yet (in this short time period) from either NOD32 nor Malwarebytes
so, hoping im not speaking to soon, but it seems i got rid of this annoyance for now
many thanks to everyone for their support, will let you know if anything changes

 

[Jacee]

You need to change all your passwords, using a known "clean" computer. Don't use the one that has/had the infection

See this article about Win32/Olmarik.AVQ trojan Cannot Uninstall Win32/Olmarik.AVQ - Win32/Olmarik.AVQ Virus Manual Removal | threatremoval

Win32/Olmarik.AVQ Description

Win32/Olmarik.AVQ is a destructive Trojan parasite which may occupy system resources and slow down computers. When infected by Win32/Olmarik.AVQ, you may find that certain files have gone missing from your hard disk or that your system is acting sluggish—or failing to start at all. You might even discover that Win32/Olmarik.AVQ can open up firewalls and allow remote hackers to access your computer without any permission or knowledge, which will enable the malicious hijackers to trace your web browser record and further steal your personal confidential information like credit card number and all kinds of passwords of your accounts. The problem with this stubborn virus is that there is no change/remove option in Add/Remove Programs. Win32/Olmarik.AVQ hides deep in registry entry and system files that pose a big threat to your PC and it’s necessary for you to terminate this bug quickly once detected.

 

[Francis93]

reporting back, with good news (hopefully)
i just gave HitmanPro a go, rebooted and my firewall is back on
also, i had no alarming massages yet (in this short time period) from either NOD32 nor Malwarebytes
so, hoping im not speaking to soon, but it seems i got rid of this annoyance for now
many thanks to everyone for their support, will let you know if anything changes

You don't need Dr. Web CureIt by the way. It's already integrated into Hitman Pro.

 

[gautam7]

Good to know hitman pro took care of your problem. Please change all the password as Jacee adviced. Report back if you still have problem we are all here to help.

 

[ICIT2LOL]

Thanks Francis I didn't know that re Dr Web - always pick up good tips in here

Zuth if it is of any help too mate I run KIS2012 and it does not like MBAM running in full version - I cannot speak for Nod and I just run the free version with it's scan settings as thus or else my KIS goes ape