Solved Virus "Please update your internet explorer" even after formatting

[Wintermoon1919]

ok i reinstalled windows
i downloaded an image from Heidoc from a clean pc i burned the iso
i used "clean all" on my harddisk i reinstalled windows
i didn't install nothing and the virus came back
while windows was searching for updates i went to youtube.com and the virus was still there
i think it might be some "hardware virus" could it be?

thanks for your patience

 

[gregrocker]

Unplug from network while installing, wipe and reinstall, see if infection is there before connecting.

Did you clean the other PC's on your network with MBAM?

See if the same infection is found on this PC with MBAM.

Wait for more experienced help for this.

 

[Wintermoon1919]

ok i'll try
but how can i know if my pc is infected without connecting to the internet?

i checked the other pcs with MBAM and also the .iso file and the dvd after it was burned before using it for the new install
(MBAM detected and cancelled something on the other pcs but nothing serious anyway those pc work well)

 

[gregrocker]

There is such a thing as hardware or BIOS infection but I've not seen one before, and can't say for sure that's what you might have. Does MBAM find the rootkit now?

I'd wait for more advanced security help as this is above my pay grade.

 

[andrew129260]

ok i reinstalled windows
i downloaded an image from Heidoc.....

1.) Okay.

First, I am going to need to get your full system specs.

See this tutorial here and do what is instructed:

http://www.sevenforums.com/tutorials/306654-speccy-advanced-system-information-tool.html

(Make sure to edit your windows key out of the log)

Then upload the log here as instructed.

2.) Second, You have done a complete format of your drive correct? Using clean all? What kind of Drive do you have? A hard drive or solid state drive? (ssd)


3.) When you reinstall windows, are you copying your data back from a backup? Like pictures, documents and stuff? Or are you immediately trying the browser and the issue still exists?

4.) Are you now using opendns on your router?

Please answer and do all above so I can get enough info to help you.

 

[Slartybart]

There is such a thing as hardware or BIOS infection but I've not seen one before, and can't say for sure that's what you might have. Does MBAM find the rootkit now?

I'd wait for more advanced security help as this is above my pay grade.

Good point Greg.

Perhaps resetting BIOS to defaults might help.

@Winter: You're getting some good help here, so I'll make two suggestions, then return to the sidelines.

Follow Greg's advice on a clean install and do not go to any website until the machine is clean of the infection. If you follow Greg's advice, that will be impossible because he asked you to disconnect from the Internet.

The Necurs infection originates on a website - once it gets rooted, it takes over your machine.

Disconnect all hard drives except the drive you're installing windows (I think Greg already suggested that, perhaps it was Andrew).

Run the machine with just the one drive for a while.

Notes:

• Your hosts files is the default, but it puts the loopback control on the router. Normally this is ok. Prior to Win7, the loopback would be on the local machine
  127.0.0.1
  ::1
  The above lines are not commented out (#127.0.0.1)
  
• The bogus Flash update :http://www.sevenforums.com/attachme...net-explorer-even-after-formatting-second.png
  Always install software from the publisher site or a trusted aggregator site (Bleepingcomputer, filehippo, ...)
  The screen you posted show Flash pro and the text below the pop-up explains why you should avoid these things.
  
• Usernameissues makes a good observation too - re: DNS

Ok, I'm out and will leave you to the other folks who are giving you great advice.

 

[Wintermoon1919]

ok i reinstalled windows
i downloaded an image from Heidoc.....

1.) Okay.

First, I am going to need to get your full system specs.

See this tutorial here and do what is instructed:

http://www.sevenforums.com/tutorials/306654-speccy-advanced-system-information-tool.html

(Make sure to edit your windows key out of the log)

Then upload the log here as instructed.

2.) Second, You have done a complete format of your drive correct? Using clean all? What kind of Drive do you have? A hard drive or solid state drive? (ssd)


3.) When you reinstall windows, are you copying your data back from a backup? Like pictures, documents and stuff? Or are you immediately trying the browser and the issue still exists?

4.) Are you now using opendns on your router?

Please answer and do all above so I can get enough info to help you.

now i'm installing again without connecting to internet

1) do you think i should download speccy on my pc even if greg told me not to connect to internet?
2)i have a hard drive and i've done a complete format using clean all
3)i don't copy nothing from a backpup i immediately open the browser and after 2 or 3 sites correctly visualized i get the issue
4) i donw know if im using opendns but i dont think so

 

[ICIT2LOL]

Winter when you are done you might try this if you need to
http://support.kaspersky.com/4162 it will scan from boot.

 

[Wintermoon1919]

ok i've just re-installed windows now im disconnected from internet wht do i do?
do i have to install MBAM check for malwares and then try to surf the web?

 

[Slartybart]

Do NOT connect until you are asked to do so.

Do NOT connect any external drive (thumb or HD) until asked to do so.

You have been chasing this thing around and around, wait for assistance. I'm sitting this one out, there are many good folks helping and my input other than cautionary will only confuse the matter.

Please be patient and wait for assistance.

Thanks.

 

[gregrocker]

Wait for the Security specialists to guide you.

Keep a sterile environment with nothing plugged in, inserted or installed at all, no connection yet at all.

You can open IE to see what it does.

 

[andrew129260]

1.) Go on the infected pc we are dealing with:

Click start rb: type system info in the search. Click system information. Click file-export. Save the file.

If we want to be paranoid here, (And I suggest it) burn the file to a cd instead of using a flash drive or other device. Then go to another pc and upload the log here. Or burn speccy onto a cd, and then install it on the pc. Manually type in your system specs on the forum. Up to you.

2.)This is going to be slightly advanced, but you can do it by following all instructions.

Use this tutorial to create and boot into a linux live cd.

http://www.sevenforums.com/tutorial...ate-live-cd-dvd-usb-use-emergency-backup.html

Once you get it running by choosing to boot from live cd; Use the web browser and download the following files to your live cd desktop:

Anti-rootkit utility TDSSKiller

Malwarebytes | Anti-Rootkit BETA - Free Rootkit Scanner & Remover

How to remove viruses with Panda Cloud Cleaner -Technical Support-Panda Security

Then copy the files by going into menu-file manager. Drag the downloaded files from your desktop to your
C:\users*your user name*\downloads folder.

The links provided in the download links give you instructions on how to run them. I suggest printing them and then following the instructions.

Run them and Do a scan with all of them.

Remove anything found and report back.

If you need help on a step, let us know. Do not guess. As long as you follow directions and answer questions we ask you, we can get this resolved.

 

[andrew129260]

I also need to know that the installation we are using here is a genuine copy with a genuine key, and that you are indeed installing with the digital river iso and not your own.

 

[ICIT2LOL]

I still think a run with this is a go as it will not interfere with the OS

Download Kaspersky Rescue Disk 10

 

[Wintermoon1919]

1.) Go on the infected pc we are dealing with:

Click start rb: type system info in the search. Click system information. Click file-export. Save the file.

If we want to be paranoid here, (And I suggest it) burn the file to a cd instead of using a flash drive or other device. Then go to another pc and upload the log here. Or burn speccy onto a cd, and then install it on the pc. Manually type in your system specs on the forum. Up to you.

2.)This is going to be slightly advanced, but you can do it by following all instructions.

Use this tutorial to create and boot into a linux live cd.

http://www.sevenforums.com/tutorial...ate-live-cd-dvd-usb-use-emergency-backup.html

Once you get it running by choosing to boot from live cd; Use the web browser and download the following files to your live cd desktop:

Anti-rootkit utility TDSSKiller

Malwarebytes | Anti-Rootkit BETA - Free Rootkit Scanner & Remover

How to remove viruses with Panda Cloud Cleaner -Technical Support-Panda Security

Then copy the files by going into menu-file manager. Drag the downloaded files from your desktop to your
C:\users*your user name*\downloads folder.

The links provided in the download links give you instructions on how to run them. I suggest printing them and then following the instructions.

Run them and Do a scan with all of them.

Remove anything found and report back.

If you need help on a step, let us know. Do not guess. As long as you follow directions and answer questions we ask you, we can get this resolved.

I can't burn the log file from the infected pc because i dont have nothing installed to create dvds so do you suggest to copy a program from a non-infected pc and then install it to the infected pc?

With Rufus i cant create a bootable dvd with peppermint but only a USB....what do you suggest?

thanks

 

[Wintermoon1919]

new problem that might help to understand what't the real issue

i just bought a new phone and when i connected to my home wireless i encountered the same problem
so it might be something else and not the infected pc

again thanks for you patience

 

[ICIT2LOL]

1.) Go on the infected pc we are dealing with:

Click start rb: type system info in the search. Click system information. Click file-export. Save the file.

If we want to be paranoid here, (And I suggest it) burn the file to a cd instead of using a flash drive or other device. Then go to another pc and upload the log here. Or burn speccy onto a cd, and then install it on the pc. Manually type in your system specs on the forum. Up to you.

2.)This is going to be slightly advanced, but you can do it by following all instructions.

Use this tutorial to create and boot into a linux live cd.

http://www.sevenforums.com/tutorial...ate-live-cd-dvd-usb-use-emergency-backup.html

Once you get it running by choosing to boot from live cd; Use the web browser and download the following files to your live cd desktop:

Anti-rootkit utility TDSSKiller

Malwarebytes | Anti-Rootkit BETA - Free Rootkit Scanner & Remover

How to remove viruses with Panda Cloud Cleaner -Technical Support-Panda Security

Then copy the files by going into menu-file manager. Drag the downloaded files from your desktop to your
C:\users*your user name*\downloads folder.

The links provided in the download links give you instructions on how to run them. I suggest printing them and then following the instructions.

Run them and Do a scan with all of them.

Remove anything found and report back.

If you need help on a step, let us know. Do not guess. As long as you follow directions and answer questions we ask you, we can get this resolved.

I can't burn the log file from the infected pc because i dont have nothing installed to create dvds so do you suggest to copy a program from a non-infected pc and then install it to the infected pc?

With Rufus i cant create a bootable dvd with peppermint but only a USB....what do you suggest?

thanks

Yes Winter mate you would have to make this disk on (or stick I prefer a disk) on a non infected or at least a working machine.
There are others too if you prefer take a look at this list

Bootable AntiVirus Rescue CD for Windows: Free Download

Now it is coincidental too that I have a vaguely similar problem plugging my new phone in but yes any new stuff causing issues is worth a look at.

 

[gregrocker]

Use Windows Image Burner to burn bootable disks except for Win7 disk - type it in Search box or right click the ISO to Burn to disk with, or Open with.

For copying files to CD, just drag them to the CD.

 

[andrew129260]

new problem that might help to understand what't the real issue

i just bought a new phone and when i connected to my home wireless i encountered the same problem
so it might be something else and not the infected pc

again thanks for you patience

Problem with your phone the same thing? The flash player prompt?

Is this going to any website or the same website?

 

[Wintermoon1919]

new problem that might help to understand what't the real issue

i just bought a new phone and when i connected to my home wireless i encountered the same problem
so it might be something else and not the infected pc

again thanks for you patience

Problem with your phone the same thing? The flash player prompt?

Is this going to any website or the same website?

same thing on 2 smartphones that connect to the home wireless
when for example i go to youtube.com it comes out the page "please update flash player"

(remember that even connecting my pc by cable the same thing occurs)

the strange thing is that the other two pcs work well