Possible Virus Issues

[cbrogo]

I am having issues with Windows 7, and possible Virus. My PC starts randomly beeping at me, and then it starts talking about weight loss ads. In task manager there are any where from 8-12 iexplore.exe running, yet I have none open. I have run multiple virus scans in both normal and safe mode, and nothing. Any idea's? The only program I have running that may cause the issue is Incredimail.

 

[blah380]

Download Spybot (The home of Spybot-S&D!), update, and run a scan.

Sounds like spyware, which explains why you aren't detecting anything on your virus scans. Also, what anti virus have you scanned with?

If you end the process TREE of iexplorer (all of them), do they reopen?

 

[stevieray]

I have always had success with Malwarebytes. Just last week I helped my cousin clean his laptop of a particularly nasty rogue "antivirus program" called System Security 2009. It disabled all of his real anti virus/anti spyware programs and shut down his firewall, all the while trying to sell him a $50 "cure" ... to get rid of the spyware and pop-ups it installed itself!

Just download and run the installer, and when it finishes tell it to "get the latest updates" and "run a quick scan". That works on most malware out there.

 

[cbrogo]

I have ran my Rogers anti-Virus(in safe mode as it doesn't work in normal mode) Kaspersky Anti-Virus 8, and a Norton online vurus and spyware scan.

When I try to end the Process tree, they all revocer, and in the background, you can see the "this tab has been recovered" pop up, yet there is no visible IE window open. I will try some of the programs you have suggested. See what happens.

 

[Jacee]

Instructions for running MalwareByte's Anti-Malware:

download Malwarebytes' Anti-Malware to your desktop
|MG| Malwarebytes Anti-Malware 1.40 Download
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. Copy and Paste that log into your next reply.

 

[chev65]

My anti virus solution is to back up all important files and reinstall Win 7....It's the only way to be sure.

The ten minute installation time of Win 7 changes everything for me. You have no idea if those anti virus solutions will get everything or not and it's just not worth taking the risk.

 

[zigzag3143]

CB

What anti-virus are you running, and is it up to date? Have you tried to see if it does it when you boot into safe mode?

KEn

 

[Dinesh]

Download Avast Anti Virus and while installing it, it will give you an option to do a boot scan. Click yes and restart your computer. Avast AV will run a boot scan of the hard drive and the viruses should removed.

 

[gamepro127]

Do what the one person said and Download Malwarebytes.
You also should download SUPERantispyware at
SUPERantispyware.com
You can do a free online virus can which will scan (and remove) threats on your computer in under 30 minutes.
Free ESET Online Antivirus Scanner

 

[Zidane24]

Do what the one person said and Download Malwarebytes.
You also should download SUPERantispyware at
SUPERantispyware.com
You can do a free online virus can which will scan (and remove) threats on your computer in under 30 minutes.
Free ESET Online Antivirus Scanner

That would be Jacee

Being a MVP isn't just a title...I would listen and follow that reccomendation

 

[Adrian]

Is "Anti Virus Professional" malware?
Since I've been using xp with windows one care for the last couple of years I switched to xp-64 pro which has no support at all, I've installed OS 7 and need antivirus protection.
DOes anyone reccomend Anti Virus Professional.

 

[johngalt]

I am a beta tester for Malwarebytes' Anti Malware - I searched the private rooms, and it (Anti Virus Professional) is *indeed* a malicious product. Steer clear of it.

Best bet is to get Micro$oft's Security Essentials via M$ Connect.

 

[Dinesh]

I am a beta tester for Malwarebytes' Anti Malware - I searched the private rooms, and it is *indeed* a malicious product. Steer clear of it.

Best bet is to get Micro$oft's Security Essentials via M$ Connect.

You say that Malware bytes is a Malicious product?

 

[johngalt]

If Malwarebytes' products were malware, I sure as hell wouldn't be beta testing for them lol.

No, I was replying to the post before me, but I'll edit my post to reflect that more clearly.

 

[Adrian]

Antivirus pro

This is a virus alert for Antivirus Professional!
After installing Windows 7 on a virgin machine I downloaded and installed "Antivirus Professional" BEWARE!! This is a rogue virus!
Using Malaware I immediately saw that the registry was hijacked along with other trojans wich installed themselves on the hard drive!

 

[Dinesh]

If Malwarebytes' products were malware, I sure as hell wouldn't be beta testing for them lol.

No, I was replying to the post before me, but I'll edit my post to reflect that more clearly.

i was shocked for a moment. But you cleared it.

 

[Adrian]

This is a virus alert for Antivirus Professional!
After installing Windows 7 on a virgin machine I downloaded and installed "Antivirus Professional" BEWARE!! This is a rogue virus!
Using Malaware I immediately saw that the registry was hijacked along with other trojans wich installed themselves on the hard drive!

I'm attaching the log from my last Malaware scan for everyone to view:
Malwarebytes' Anti-Malware 1.40 Database version: 2573 Windows 6.1.7100 8/6/2009 11:43:18 PM mbam-log-2009-08-06 (23-43-18).txt Scan type: Quick Scan Objects scanned: 73346 Time elapsed: 1 minute(s), 7 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 2 Files Infected: 6 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Anti-Virus Professional (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\anti-virus professional 5.0_is1 (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Program Files (x86)\Anti-Virus Professional (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. C:\Program Files (x86)\Anti-Virus Professional\logs (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. Files Infected: C:\Program Files (x86)\Anti-Virus Professional\Anti-Virus Professional.exe (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. C:\Program Files (x86)\Anti-Virus Professional\noadware4_021709.na (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. C:\Program Files (x86)\Anti-Virus Professional\nutilities.dll (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. C:\Program Files (x86)\Anti-Virus Professional\unins000.dat (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. C:\Program Files (x86)\Anti-Virus Professional\unins000.exe (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully. C:\Program Files (x86)\Anti-Virus Professional\UninstlDll.dll (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully

 

[johngalt]

Would you mind reposting the log, copying it from notepad and pasting it using either the [ quote ] & [ /quote ] tags or the [ code ] & [ /code ] tags?

First of all, that will leave all the line breaks in the log, making it a lot easier to read, and secondly, it will eliminate the black font coloring that you got (assuming you pasted from either Outlook or Word).

here is what it looks like to everyone using the Black - RC skin on these forums:



As you can see, the black font makes it nearly illegible, and the lack of line breaks makes it virtually unreadable even without the coloring....

Thanks.

 

[Adrian]

Malaware Log

Would you mind reposting the log, copying it from notepad and pasting it using either the [ quote ] & [ /quote ] tags or the [ code ] & [ /code ] tags?

First of all, that will leave all the line breaks in the log, making it a lot easier to read, and secondly, it will eliminate the black font coloring that you got (assuming you pasted from either Outlook or Word).

here is what it looks like to everyone using the Black - RC skin on these forums:

View attachment 21933

As you can see, the black font makes it nearly illegible, and the lack of line breaks makes it virtually unreadable even without the coloring....

Thanks.

Using Notepad..

Malwarebytes' Anti-Malware 1.40
Database version: 2573
Windows 6.1.7100

8/6/2009 11:43:18 PM
mbam-log-2009-08-06 (23-43-18).txt

Scan type: Quick Scan
Objects scanned: 73346
Time elapsed: 1 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 2
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Anti-Virus Professional (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\anti-virus professional 5.0_is1 (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files (x86)\Anti-Virus Professional (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Anti-Virus Professional\logs (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files (x86)\Anti-Virus Professional\Anti-Virus Professional.exe (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Anti-Virus Professional\noadware4_021709.na (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Anti-Virus Professional\nutilities.dll (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Anti-Virus Professional\unins000.dat (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Anti-Virus Professional\unins000.exe (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Anti-Virus Professional\UninstlDll.dll (Rogue.Anti-VirusProfessional) -> Quarantined and deleted successfully.

 

[cbrogo]

Thank You everyone for all your help. I installed Malwarebytes, and had over 300 infected files. All issues are gone now! Thank You