No idea where to go from here?

Discussion in 'Am I Infected?' started by cherokee rose, Jul 21, 2012.

Recommended: Click here to Fix Errors and Optimize Windows

Page 1 of 2

  1. cherokee rose Bronze Member

    Bronze
    Message Count:
    45
    Likes Received:
    1
    My System
    Loading...
    I was on my pc last night and my firewall suddenly turned itself off. I turned it on again and did a scan, I have avg 2012.

    Got up this morning and my computer has been giving me problems ever since.



    I keep getting random pop ups everywhere telling me I have won an iphone 4 etc, my avg is telling me I have a trojan, but it could not remove it.

    Decided to download malwarebytes, did a full scan, mentioned something about a rootkit, at the end of the scan I had 71 threats, malwarebytes said it removed one of them, restarted my computer, just done another scan it said zero threats, but I am still getting the pop ups.

    Also, everytime I go online i get a notification bubble from malwarebytes saying successfully blocked access to malicious website: 91.218.121.57, type: outgoing.

    Does anyone know what I could do to fix this? also, should I change my passwords etc or is that side of things ok?

    Thanks.
    cherokee rose, Jul 21, 2012
    #1

  2. vger STAFF

    PCHF Staff
    Message Count:
    17,747
    Likes Received:
    1,447
    My System
    Loading...
    Hello cherokee rose and welcome to the PCHF..

    Please go to my red prework link in my sig click it,once there just follow the instructions..
    vger, Jul 21, 2012
    #2

  3. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,825
    Likes Received:
    3,641
    My System
    Loading...
    In addition to the Prework logs please attach the Malwarebytes Anti-Malware log
    Crush, Jul 21, 2012
    #3

  4. Google Advertisement

  5. cherokee rose Bronze Member

    Bronze
    Message Count:
    45
    Likes Received:
    1
    My System
    Loading...
    I am doing what vger said to do now and will post when its finished, the malware log do i just paste it all here?
    cherokee rose, Jul 21, 2012
    #4

  6. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,825
    Likes Received:
    3,641
    My System
    Loading...
    Attach them all to your post via Upload A File when done
    Crush, Jul 21, 2012
    #5

  7. cherokee rose Bronze Member

    Bronze
    Message Count:
    45
    Likes Received:
    1
    My System
    Loading...
    I hope I have done this right, never done anything like this before. Thank you for your time.

    Attached Files:

    cherokee rose, Jul 21, 2012
    #6

  8. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,825
    Likes Received:
    3,641
    My System
    Loading...
    Hi,

    Have you rebooted your machine to complete the disinfection? Did you run aswMBR as well? I will need that log
    Crush, Jul 21, 2012
    #7

  9. cherokee rose Bronze Member

    Bronze
    Message Count:
    45
    Likes Received:
    1
    My System
    Loading...
    I have rebooted my pc and still have the same problems, here is the other file you needed.

    Attached Files:

    cherokee rose, Jul 21, 2012
    #8

  10. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,825
    Likes Received:
    3,641
    My System
    Loading...
    Download Combofix from any of the links below, and save it to your desktop.

    Link 1
    Link 2
    Link 3

    When saving ComboFix rename it to PCHelpForum.exe to prevent it from being blocked by malware.


    Refer to this image:

    To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.
    • Close any open windows and double click PCHelpForum.exe to run it.

      You will see the following image:
    [IMG]

    Click I Agree to start the program.

    ComboFix will then extract the necessary files and you will see this:

    [IMG]

    As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7

    It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

    If you did not have it installed, you will see the prompt below. Choose YES.

    [IMG]

    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [IMG]

    Click on Yes, to continue scanning for malware.

    When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

    Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

    Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
    Crush, Jul 21, 2012
    #9

  11. cherokee rose Bronze Member

    Bronze
    Message Count:
    45
    Likes Received:
    1
    My System
    Loading...
    thank you, one question before i do this, will it wipe my computer? I only have the one computer in the house at the moment so cannot backup anything, if i have to lose my stuff then so be it but just wanted to check first so i know what to expect?
    cherokee rose, Jul 21, 2012
    #10

  12. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,825
    Likes Received:
    3,641
    My System
    Loading...
    No, it will not wipe the data from your PC
    Crush, Jul 21, 2012
    #11

  13. cherokee rose Bronze Member

    Bronze
    Message Count:
    45
    Likes Received:
    1
    My System
    Loading...
    think this is right.

    Attached Files:

    cherokee rose, Jul 21, 2012
    #12

  14. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,825
    Likes Received:
    3,641
    My System
    Loading...
    Looks good. How is the machine running?
    Crush, Jul 21, 2012
    #13

  15. cherokee rose Bronze Member

    Bronze
    Message Count:
    45
    Likes Received:
    1
    My System
    Loading...
    I am still getting the pop ups, it only seems to happen if I go onto a search engine, other websites seem ok.
    cherokee rose, Jul 21, 2012
    #14

  16. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,825
    Likes Received:
    3,641
    My System
    Loading...
    Can you re-run OTL please?
    Crush, Jul 21, 2012
    #15
Page 1 of 2

No idea where to go from here?

Recommended: Click here to Fix Errors and Optimize Windows