Potential Virus - Help please

DCodd

Hi waddler_8.

Can't post the log again so e-mailed it if that's ok?

Thanks

waddler_8

Combofix has removed a whole host of stuff, but is struggling with a few. How's the computer actually running?

Download Roguekiller from the link below.


LINK

• Double click roguekiller.exe to run it.
• Wait for the prescan to finish.
• Accept the EULA
• Under Options, click the Scan button
• When the Status reports Scan finished, click Report under Options
  
  If an infection is detected, do not delete anything yet!
  
  
• Notepad will open. Copy & paste the contents of that report in a reply here (or email me it).
• The log can also be found on your desktop entitled RKreport[**].txt
• Close RogueKiller. Click Yes to the prompt

DCodd

waddler_8 wrote: »

Combofix has removed a whole host of stuff, but is struggling with a few. How's the computer actually running?

Download Roguekiller from the link below.


LINK

• Double click roguekiller.exe to run it.
• Wait for the prescan to finish.
• Accept the EULA
• Under Options, click the Scan button
• When the Status reports Scan finished, click Report under Options
  
  If an infection is detected, do not delete anything yet!
  
  
• Notepad will open. Copy & paste the contents of that report in a reply here (or email me it).
• The log can also be found on your desktop entitled RKreport[**].txt
• Close RogueKiller. Click Yes to the prompt

Thanks, will do

The laptop is slow and I'm still having to run Chrome as current user with the protection box unchecked.

The other programs like IE, Malwarebytes etc still won't load. Avast still appears to run.

waddler_8

It shouldn't take long to scan.

DCodd

Hi waddler_8

Had to e-mail the report as it wouldn't let me post it.

Thanks

waddler_8

Roguekiller log looks ok.

download this and save it to your desktop.

http://files.avast.com/files/rootkit-scanner/aswmbr.exe

When you've downloaded it...

• Double click aswMBR.exe to run it
• With the AVscan set to Quick Scan, click the Scan button.
• When the scan reports "Scan finished successfully", click Save log & save the log to your desktop.
• Click OK when prompted. aswMBR.txt & MBR.dat will be appear on your desktop.
• Click EXIT.
• Copy & paste the contents of aswMBR.txt & post it here (or email me it).

Don't click to fix anything yet, just post the log.

DCodd

Hi waddler_8 do I do anything with rogue killer or just shut it down?

waddler_8

Just close it.

DCodd

Got an early start tomorrow. if it's ok I'll run the avast root-kit scanner tomorrow and post the log then?

Thanks

waddler_8

Yes, no worries. Things look ok at this stage. I'd also be interested to know if rkill still detects ZeroAccess. It creates a log at the root of your system drive, eg:

C:\rkill.log