Please help remove Malware from my PC

[deltalima]

Hi strelok31,

Run OTL Script

• Double-click OTL.exe to start the program.
• Copy and Paste the following code into the textbox. Do not include the word Code
  

  Code: Select all

  :reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
  "AutoUpdateDisableNotify" = 0
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
  "DisableMonitoring" = 0
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
  "AntiSpywareOverride" = 0
  :commands
  [REBOOT]
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

You should Download and Install the newest version of Adobe Reader for reading pdf files, due to the vulnerabilities in earlier versions.
All versions numbered lower than 9.4 are vulnerable.

• Go HERE, UNCHECK any Free Add-Ons, and click Download to install the latest version of Adobe Acrobat Reader.
• After it completes the Installation, close the Download Manager.

Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 22.

• Download the latest version of Java Runtime Environment (JRE) 6 Here
• Scroll down to where it says "JDK 6 Update 22 (JDK or JRE)"
• Click the orange Download JRE button to the right
• Select the Windows platform from the dropdown menu
• Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh
• Click on the link to download Windows Offline Installation & save the file to your desktop
• Close any programs you may have running - especially your web browser
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions
• Reboot your computer once all Java components are removed
• Then from your desktop double-click on jre-6u22-windows-i586-p.exe to install the newest version

Please go to Kaspersky website and perform an online antivirus scan.

1. Read through the requirements and privacy statement and click on Accept button.
2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
3. When the downloads have finished, click on Settings.
4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
   Spyware, Adware, Dialers, and other potentially dangerous programs
   Archives
   
5. Click on My Computer under Scan.
6. Once the scan is complete, it will display the results. Click on View Scan Report.
7. You will see a list of infected items there. Click on Save Report As....
8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
9. Please post this log in your next reply and also let me know how your computer is running now.

[strelok31]

Hi deltalima,

What do these 3 commands do? I know you are setting 3 registry keys to 0. Is it to disable them? What is the purpose of doing it?



:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AutoUpdateDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiSpywareOverride" = 0
:commands
[REBOOT]

Thanks,
strelok31

[deltalima]

Each value was set to 1 and for example AutoUpdateDisableNotify would disable notifications for autoupdate, the script returns the settings to he correct value.

[strelok31]

Do I need to login in to OTL.exe as an admin in order to run this script?

I am software engineer and I used write code for installers and I created scripts to modify registry values.

[deltalima]

Yes - right click and runas administrator like when you ran the OTL scan then copy and paste in the script.

[strelok31]

Thank you for your help. I will try it when I get home.

Windows sucks. It is so insecure and vulnerable to all these garbage. I am thinking of switching to MAC or Linux.

[deltalima]

OK, please post the logs when you can, the Kaspersky scan will take several hours to complete.

[strelok31]

Hi deltalima,

I have run OTL Script, but the report did not appear after the reboot. I have upgraded to the latest version of Adobe Reader. I have uninstalled old versions of Java and installed the latest version. I did not get a chance to run Kaspersky anti-virus. I will post the logs once I ran Kaspersky anti-virus.

thanks,
strelok31

[deltalima]

OK, please post the Kaspersky log when complete.

[strelok31]

Hi Detalima,

When I go to Kaspersky website to do an online scan, I get an error during the database update and I am unable to run a scan. I disabled the anti-virus on my computer (according to the directions from Kaspersky) when I tried to do this online scan and I have also rebooted my computer and tried it and I still get the same error. I have tried to run the scan multiple times and I always get the same error. I have also started my browser as an administrator. Here is the error that I get.
---------------------------------------------------------------------------------------------------------
Updating the anti-virus database. Please wait...

Update has failed The program could not be started. Please close the window of Kaspersky Online Scanner 7.0 and start the program again from the web site of Kaspersky Lab. Successful updating of Kaspersky Online Scanner 7.0 and scanning of your computer requires uninterrupted Internet connection. Please make sure that the Internet connection is established. [ERROR: License has expired]
------------------------------------------------------------------------------------------------------------

My computer seems to be ok so far. Nothing is popping up and I get no alerts. I am currently running full scan using Spyware Doctor to see if it finds anything. Once it is done I will provide the logs and I also want to scan my computer using MalwareBytes.

Thanks,
strelok31

[strelok31]

Hi Detalima,

Spyware Doctor full scan did not find any threats.

strelok31

[deltalima]

Hi strelok31,

When I go to Kaspersky website to do an online scan, I get an error during the database update

Yes, I just tried and get the same, it looks like a problem with the site. Please run this alternative scan.

ESET online scannner

• Please go Here then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

I also want to scan my computer using MalwareBytes.

Always a good idea, please post the log in your next reply.

[strelok31]

Hi deltalima,

I will be home late today and tomorrow nights so I won't have a chance to run the online virus scan. I will ran it as soon as I can and post the logs here.

Thanks,
strelok31

[deltalima]

OK, when you get chance try the Kaspersky scan again as it may be working, if not then run the ESET scan.

[strelok31]

Ok. Kaspersky will be number one choice.