Please help - fake antivirus

imho

There you go.
http://support.microsoft.com/kb/306084

aliEnRIK

Please open malwarebytes, goto LOGS and post the WHOLE of the last log

reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)
If you get a message that you cant write to the hosts file then Press the SHIFT key, and whilst holding it RIGHT CLICK and select RUN AS (admin)

RussJK

Just to clear up terminology. When you refer to an "antivirus" you mean the first traditional line of defence on the computer - a realtime antivirus guard and on-demand scanner like Avira Antivir, Avast, Kaspersky, Norton antivirus, McAfee, Microsoft Security Essentials etc. You don't want more than one installed at the same time let alone running together.

In addition to the main antivirus, you can have complementary malware scanners which are designed to work with an Antivirus such as Malwarebytes, Spybot: Search and Destroy, SuperAntiSpyware, etc. They may just be on demand scanners, or some can even have a realtime guard of their own that is specifically designed to work alongside the realtime guard of the main antivirus.. You can call these "malware scanners" or "spyware scanners" or whatever, but calling them an 'antivirus' is just going to cause confusion.

To do a system restore, go to Start > Control Panel > System Restore OR from control panel just do a search for 'system restore'. Check the date on the restore point, and make sure it is from a date before the problems occurred.

stilltheone

Can we see the logs produced by Malwarebytes AntiMalware and also a Hijack This log?

chopandchange

Thank you, imho. I will try and do it now.

Malwarebytes found nothing, aliEnRIK. Any logs I post here will just say zero zero zero. Avira said zero zero zero, apart from the warning I posted.

Yes, RussJK. That was what I meant. I have an AV program and also a malware one. I don't see anything wrong with that. I don't run them both at the same time, and they don't seem to interfere with one another.

stilltheone

Hitman Pro 3

aliEnRIK

chopandchange wrote: »

Thank you, imho. I will try and do it now.

Malwarebytes found nothing, aliEnRIK. Any logs I post here will just say zero zero zero. Avira said zero zero zero, apart from the warning I posted.

Hijack will say a lot more than zero - its a list of whats running

Was malwarebytes a QUICK or FULL scan, and whats the database version?

chopandchange

Do I need to be in normal mode to do the system restore?

I am currently in safe mode, and can't seem to find the place where I do it using any of the ways described in this thread or in the link.

Malwarebytes was a full scan done in safe networking mode with the latest version. I update it semi-regularly, and when I opened it, it announced it was outdated by a mere 8 days. I updated accordingly before proceeding. Malwarebytes found nothing. Since you don't seem to believe me, here are all the zeros. Please notify me if I did something wrong or if it's out of date, but I don't see how it can be.

warebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6373

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 9.0.8112.16421

16/04/2011 11:53:25
mbam-log-2011-04-16 (11-53-25).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 301621
Time elapsed: 35 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Should I do the Hijack one next then? Is that one of the web-based ones?

Thanks for all this advice.

aliEnRIK

chopandchange wrote: »

Since you don't seem to believe me, here are all the zeros.

I never claimed I dont believe you. I asked is it up to date and whether or not a full scan was run or not

Ive asked many times on here before and people tell me they have, but the logs tell me different

I work methodically, which is why I ask for malwarebytes then hijack.
Hijack more than often tells us that the OPs (not you, I mean in general) are running things they shouldnt (2 firewalls being the worst)
I can then determine if anything a little stronger is required or whatever

chopandchange

aliEnRIK wrote: »

I never claimed I dont believe you. I asked is it up to date and whether or not a full scan was run or not

Ive asked many times on here before and people tell me they have, but the logs tell me different

I work methodically, which is why I ask for malwarebytes then hijack.
Hijack more than often tells us that the OPs (not you, I mean in general) are running things they shouldnt (2 firewalls being the worst)
I can then determine if anything a little stronger is required or whatever

Oh, I see. I'm sorry if I got impatient, when you are helping me out of the kindness of your own heart. I just didn't understand why people kept asking me for things I thought I had already explained.

As far as I am aware, I am only running one Firewall. There should be a hardware one that apparently came with my reuter. I think when I installed my AV it didn't like the Windows Firewall being there and it got me to disable the windows one, so maybe there's some sort of a firewall that comes with the AV. I don't know. Maybe the AV just wrongly sees it as a threat.

Now I have successfully restored the system to yesterday - thanks to all the helpful advice - and the computer has restarted itself. It seems to be in normal mode. Does it need to be in safe mode, and what should I do next? Run Malwarbytes or my AV again,now that it's "yesterday" or do the Hijack one? If Hijack, could I please have the link?

Thank you very much.