Welcome to ECCIE - Sign up today!

oden · 03-09-2010, 11:08 PM

I clicked on a video on one of the links here and got a pop up of windows security saying I was under attack by a virus. I knew better than to click on it and tried to close it with task manager: did not let me. Tried running mawlwarebytes and AVG, same results. Switched to a different profile on my computer(I have a business and personal profile) and was able to run AVG and Malwarebytes but they showed no infections. Went back to the infected profile and tried using the run command in Windows, wouldn't let me do it, still infected. Finally tried downloading malwarebyts to a flash drive from the uninfected profile and booting it on the infected profile: no go.

What gives? Any advice?

Mokoa · 03-10-2010, 12:09 AM

Get avast! It is a great free anti-virus program which allows you to do a scan during boot time before any start up programs are loaded. Yes, it will take a while but a boot time scan will be able to detect more because the malicious code will not be loaded at the time the scan is run. When you are done with that you may want to run the Malwarebytes stuff again.

Download avast!

If you have not already, get yourself CCleaner. It will remove any leftover garbage in the various temporary file areas. It is another great tool to have for cleaning out the crap.

CCleaner

Please let us know how it goes.

Good luck to you.

GneissGuy · 03-10-2010, 12:56 AM

Quote:

Originally Posted by oden

I clicked on a video on one of the links here and got a pop up of windows security saying I was under attack by a virus. I knew better than to click on it and tried to close it with task manager: did not let me. Tried running mawlwarebytes and AVG, same results. Switched to a different profile on my computer(I have a business and personal profile) and was able to run AVG and Malwarebytes but they showed no infections. Went back to the infected profile and tried using the run command in Windows, wouldn't let me do it, still infected. Finally tried downloading malwarebyts to a flash drive from the uninfected profile and booting it on the infected profile: no go.

What gives? Any advice?

Please report the post with the bad link to the mods. DON'T post it here. Some dummy would try it and get infected.

Greyhound · 03-10-2010, 01:40 AM

Download ComboFix to a flash drive, copy it over to your machine, then run it. It's a pretty good app and I've used it fairly extensively over the past couple years with over a 90% success rate.

Here's a basic tutorial on it (with 2 links to download the latest version)
http://www.bleepingcomputer.com/comb...o-use-combofix

Good luck man!

TexasT · 03-10-2010, 08:54 AM

I got E-Scan specifically because of the virus you refer to. Prior to that, I had to take my machine in for repair. E-Scan has worked well, despite the bug trying to install itself a few more times.

If you see it trying to do its thing, it seems like you have about 5 seconds to CLOSE EVERYTHING or you're screwed.

oden · 03-10-2010, 02:51 PM

Thanks everyone,
Since I got Mokoa's message first I downloaded AVAST on the profile that was not infected and set it to scan during the boot then shut down and rebooted. Took several hours but did the trick!

Just curious, why would it infect one profile and not the other on the same computer?

Mokoa · 03-10-2010, 06:33 PM

Quote:

Originally Posted by oden

Thanks everyone,
Since I got Mokoa's message first I downloaded AVAST on the profile that was not infected and set it to scan during the boot then shut down and rebooted. Took several hours but did the trick!

Glad to read that you were able to take care of it.

Quote:

Originally Posted by oden

Just curious, why would it infect one profile and not the other on the same computer?

The infection was located within files in the folders of one of the users so it would misbehave only when that particular user was logged on.

oden · 03-10-2010, 10:11 PM

Thanks again,
I appreciate you taking the time to help me out.

WetVelvetSAT · 03-10-2010, 10:41 PM

Hi mokoa,

I can use some help, too! I felt there was something wrong with my system so I downloaded zonealarm and avast. I have the CCleaner but avast caught something called error # 42127 and said "cab archive is corrupted. I haven't had any problems in a long time.

Help, how do I fix my problem. Do I have to reinstall windows? What could have caused it?

Sincerely,
Velvet

Mokoa · 03-11-2010, 12:11 AM

Reinstall Windows? I doubt that.

What I would like to know is what was it that first made you feel that something was wrong?

I would run CCleaner first to clean out any crap that may exist in the Temporary File areas. Next run a Malwarebytes scan. Then run an avast! boot time scan. Before doing these suggestions, please make sure that all of these guys are current.

Let me know how it goes.

Also...

A CAB file is a compressed file that can contain one or more files within it. CAB files are usually used to store components of a program for installation. However, they are not used for that purpose that much anymore since newer and better ways of creating install packages have evolved.

WetVelvetSAT · 03-11-2010, 12:45 AM

Quote:

Originally Posted by Mokoa

Reinstall Windows? I doubt that.

What I would like to know is what was it that first made you feel that something was wrong?

I would run CCleaner first to clean out any crap that may exist in the Temporary File areas. Next run a Malwarebytes scan. Then run an avast! boot time scan. Before doing these suggestions, please make sure that all of these guys are current.

Let me know how it goes.

Also...

A CAB file is a compressed file that can contain one or more files within it. CAB files are usually used to store components of a program for installation. However, they are not used for that purpose that much anymore since newer and better ways of creating install packages have evolved.

Hi,

My system started locking up on me over the past week. I, also, got a message from Norton saying my anti-virus software had expired when I pay monthly (4.95).

This is a used computer which I tried to re install windows on but it still has an administrator password which will not allow me to update the BIOS.

I have malwarebytes installed, also, and just today I installed avast and found the error when I ran the boot scan. (ieframe.dll, software distrubution download, BIT.dd.tmp) Whatever all that means! aheheheh

Sincerely,
Velvet

WetVelvetSAT · 03-11-2010, 06:17 PM

Hi,

Well, I am glad to know it isn't a virus (I guess). I can't understand, I had to redo my system back in September and haven't had any problem with all my system locking up all my screens until now.

I have learned my lesson on bartering...ahehehehe...Someti mes being friendly doesn't pay off! ahehehehe

Sincerely,
Velvet

mrhunt · 03-13-2010, 10:16 AM

I got that virus and had to call Norton. They took control of my machine and found the virus in my temporary internet files. They removed them and deleted them. If it ever happens again do not click on the screen if you do it will auto install no matter what you click. You have to shut your computter off by killing the power to it.