The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
Please vote in the Forum Structure Poll. Polling will close at 2PM EST on January 21, 2025.
big ole virus on my pc. or trojan.
Iriah
Registered User regular
Registered User regular
I was browsing youtube last night when firefox closed and popped up with a clearly fake Windows Defender panel saying I had viruses. Then it launched a clearly fake virus scan which found I had hundreds of viruses. It was coming from a process called ave.exe, which appears to be associated with something called the sndog worm - though I'm not convinced that's the real problem, it may have just been something another trojan downloaded. I closed it, but whenever I opened another .exe it popped up instead. Only google chrome works, for some reason.
I ran spybot S&D and AVG. Spybot found some registry changes, which I nixed, and it seemed to fix it for a while. Then it happened all over again.
The same thing happens in Safe Mode, too.
For a while I thought it was also the fault of lsass.exe, csrss.exe, lsm.exe, and some others, but they all appear to be in system32 so that seems to validate them.
Otherwise, I don't really know what to do! Any ideas?
I ran spybot S&D and AVG. Spybot found some registry changes, which I nixed, and it seemed to fix it for a while. Then it happened all over again.
The same thing happens in Safe Mode, too.
For a while I thought it was also the fault of lsass.exe, csrss.exe, lsm.exe, and some others, but they all appear to be in system32 so that seems to validate them.
Otherwise, I don't really know what to do! Any ideas?
Iriah on
0
Posts
Eventually, you have to realise that you're either not doing enough or there isn't anything else you can do. But definitely try a few other methods before killing the machine and starting over.
Do not engage the Watermelons.
This sure isn't good news...
Do not engage the Watermelons.
Download Malwarebytes. Change the name of the malwarebytes executable to Malwarebytes.com. This changes the extension, without preventing windows from executing it. It's a very simple trojan and will be fooled by the different extension, allowing you to run it. As long as the version hasn't been updated since last month, that'll clean you up.
It can take care of pretty much anything.
I make no judgments on its effectiveness, but then, my problem apparently wasn't as bad as the OP's. So I didn't need it in the end. If anything, it's an option to look into.
Do not engage the Watermelons.
edit: one thing to do in the future is create an account without administrative privileges and use that for your everyday stuff. Not being an admin when you get hit with something like this does a lot to prevent damage and preserve your ability to fix things without formatting.
that's why we call it the struggle, you're supposed to sweat
Worst a time for a virus...
I rebooted in safe mode, ran spybot first and removed the registry changes it suggested, then was able to install malwarebytes. the quick scan in turn found 2 things which I didn't bother to read about before nuking, which probably wasn't the smartest thing to do.
Still, it is probably solved for now. Thank you all very much for your help. It's going to run a full system scan while I sleep for reals now.
I had a problem with something similar. I ended up having to clear the registry entries for EXE files (you can then re-associate EXE files with Tools->Folder Options->File Types in any windows explorer window). This let me actually run Adaware (which didn't find the guilty files making it keep popping up) and subsequently get Malware Bytes Anti Malware (which did find them, and seems to be a lot like Adaware used to be). It seems like you went the easier route of going through Safe Mode, but if you need another option, maybe that'll be helpful.
There's always the "nuke it from orbit" option of formatting if it subsequently pops up.
Do not engage the Watermelons.
It sounds like you still have something.
is your computer connected to a public network or any storage device that you didn't scan?
did you run a full scan using malwarebytes?
edit: I'll give them a scan with malwarebytes too.
3DS Friend Code: 2165-6448-8348 www.Twitch.TV/cooljammer00
Battle.Net: JohnDarc#1203 Origin/UPlay: CoolJammer00
TDSS Killer
RKill
Malwarebytes
and once cleaned, installed Avast.
It was a series of things that faked virus scans and tried to get you to buy their program. It locked down everything >_< so annoying
I'm dealing with what you're talking about right now, in fact just got it last night on a coworker's computer (her personal one). XP Smart Security 2010 is what it is called, and it is just naaaasty. Throws tons of fake windows at you, security centre stuff, fake warnings, puts porn shortcuts on your desktop, "scans" the drive and finds hundreds of viruses, DOS prompt opens up and says "sending spam to theguy@mail.net --done" through your entire address book... its actually quite hilarious if it weren't so annoying, and of course all it wants is your credit card number.
Some googling said to install MBAM (Malwarebytes), but I couldn't as the program had thrown a bunch of hooks in. No task manager either, and the firewall was turned off.I was able to install Spyboy Search & Destroy though, which found and nuked all the hooks, then rebooted and was able to install and run malwarebytes, which found more stuff. Unfortunately after everything, while the computer is much more useable now (previously there was a redirect to the fake security alerts whenever any exe was run...) it is still there. I cant get rid of it. Now looking for a good solution, and we're taking it in to a shop in the city to get blasted.
PSN - sumowot
use RKill to kill any processes that might try to stop anything
use TDSS to get rid of the rootkits, reboot
Use RKill again for good measure, just to make sure MalwareBytes can install
Run MWB
Damn. Malwarebytes is finding it and killing it, but it keeps coming back. I've even gone into the registry and removed everything in there I could find and still nothing.
Also, a search of the drive for av*.exe is not turning up anything.
PSN - sumowot
TDSS Killer
srsly
This is the exact same thing I've fought with twice now and the same procedure worked both times
Was a bitch to figure out though.
And another co-worker just got it on their home computer. Seems to be the hot new malware.
The harder the rain, honey, the sweeter the sun.
PSN - sumowot
Alright, ran rkill and it runs, and then kills itself, which is kind of funny.
Ran TDSSKiller and it runs and finds a rootkit in c:\windows\system32\drivers\iastor.sys, but says cure failed.
This is in safe mode.
Reboot and try again, safe mode, same deal.
PSN - sumowot
In the end, I just did the whole reformat thing. It was annoying, but at least her PC is running faster now.
My Backloggery
Unfortunately TDSSKiller is still not able to cure the iastor.sys rootkit (if it is there) and this site doesn't give me confidence it will be fixed, but we'll see.
Still waiting for Malwarebytes to finish its scan in regular mode. If it kills ZIPDKG32.exe, then yay, and if not, I'll just delete it myself and hope for the best. Killing the process via RKILL made all the popups and nonsense go away so I have high hopes.
edit - Malwarebytes came back with nothing, deleted the file using FileASSASSIN (MWB tool), rebooted, spybot search and destroy then found another taskmanager disable, killed that, rebooted again, and it has now been working for a good long while. yay. But man what a PITA.
PSN - sumowot
It's built into banner ads, as far as I can tell. I'm about 90% sure I got it from either MMO-Champion or Explosm.net (Cyanide and Happiness comic).
In both cases I've personally seen, it's installed itself without any need for the user to click on anything.
The harder the rain, honey, the sweeter the sun.
I've seen some mentions about these things being in .wmv files as well.
Do not engage the Watermelons.
I've never formatted a PC before, does anyone have a good moron's guide for this sort of thing? The old girl is going to be retired in the next few months before I go back to school with a laptop, but I want to keep it working as a backup. I've still got my old windows reinstall disc that came with the PC.
that's why we call it the struggle, you're supposed to sweat