Live Chat & Podcast at 1:00PM Eastern on Sunday!
There's no such thing as a stupid question, but they're the easiest to answer.
JoinTour
Login
Search
Tag Cloud
access acer asus bios bsod computer crash desktop dns driver drivers error ethernet excel freeze gaming graphics hard drive hardware hdmi internet laptop malware memory monitor motherboard network printer problem ram registry repair router slow software sound trojan ubuntu 11.10 uninstall usb video virus vista wifi windows windows 7 windows 7 32 bit windows 7 64 bit windows xp wireless
Search
Search for:
Tech Support Guy Forums > Security & Malware Removal > Virus & Other Malware Removal >
Infected Computer (New)

Reply  
Thread Tools
whyorwhynot's Avatar
Junior Member with 4 posts.
 
Join Date: Apr 2008
Experience: Intermediate
20-Aug-2009, 10:31 PM #1
Infected Computer
It seems I've contracted some ick-nasty buggers, and I need to discover a solution to get rid of them.

Here's the synopsis:
First of all, I'm using Windows Vista. Yesterday, I got a virus. While I was still using the computer, I got strange pop-ups related to the virus that imitated the Security Center, and through a little research, it looks like this is the work of "Windows Antivirus Pro". I restarted my computer, and once it passed the user name chooser screen and the Welcome screen, it went blank, except the mouse pointer. I tried to open the task manager to see if explorer.exe didn't load up. Task manager opened, explorer.exe was fine. I didn't see anything that looked like it would be related to Windows Antivirus Pro, though. I removed some of the other viruses (one being a Rootkit, which I'm still having difficulty removing) and now I'm able to go onto my main screen instead of safe mood. My computer is still going significantly slower, and there's evidence that something is still on here.
I've installed the following: RootRepeal, MBAM, SuperAntiSpyware, Spybot Search & Destroy, Antivir, and a few others I can't quite remember at the moment.

Fast forward to today. I ran SUPERAntiSpyware maybe 7-8 times now, and the one that continuously appears is called "Rookit.Cloaked / Service.GEN". I checked the log files to ensure that SAS wasn't just skipping over it, but it appears that one of the two files under the Rookit name is being found on different files each time. The other file seems to be the same each time. I won't post the whole log, but here are the two files I'm talking about:

SAS Log:
Rootkit.Cloaked/Service-GEN
HKLM\system\controlset001\services\kbiwkmiooqidow (This is the one that keeps reappearing)
C:\WINDOWS\SYSTEM32\DRIVERS\KBIWKMBDDVREQR.SYS (This is the one that keeps being found under a different file name. The source is the same, and so far all of the files have started with a 'K'.)

While using all of the Spyware programs I downloaded, it also came across several other trojans, but it seems that they've been removed for the most part. I can now at least start my computer normally instead of having to go on safe mode each time, so some progress is being made. But my computer is still noticeably slower, and I still cannot search anything related to virus removal or system restore without being redirected. If it helps, each time the redirected page is different, but the icon by the search bar is always a blue, somewhat cursive "2" looking symbol. For some reason I can now search some sites that I couldn't before, but from time to time I get redirected again.

I'm currectly conducting a RootRepeal scan to see if the issue can be diagnosed correctly.

So, I ran another Spyware remove program (SpyHunter 3), and it came up with some additional icky buggers.

- Windows Antivirus Pro.lnk (Rogue.Windows Antivirus Pro) (2)
- Some cookies
- Some registry keys (I think; they're labeled as "Hotbar"): InprocServer32 (2), ProgID (2)

These are the major files detailed below:
"Hotbar" Files
-HKCR\CLSID\{620D55B0-F2FB=464E-A278-B4308DB1DB2B}
---HKCR\CLSID\{620D55B0-F2FB=464E-A278-B4308DB1DB2B}\ProgID
---HKCR\CLSID\{620D55B0-F2FB=464E-A278-B4308DB1DB2B}\InprocSever32

-HKLM\SOFTWARE\Classes\CLSID\{620D55B0-F2FB=464E-A278-B4308DB1DB2B}
---HKLM\SOFTWARE\Classes\CLSID\{620D55B0-F2FB=464E-A278-B4308DB1DB2B}\ProgID
---HKLM\SOFTWARE\Classes\CLSID\{620D55B0-F2FB=464E-A278-B4308DB1DB2B}\InprocServer32

Windows Antivirus Pro
C:\Windows\System32\config\systemprofile\Desktop\Windows Antivirus Pro.lnk
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\ Star Menu\Programs\Windows Antivirus Pro\Windows Antivirus Pro.lnk


Unfortunately, the program will only let me see these files, not delete them. I'm wondering if it would cause harm if I deleted them by hand.

I have a log for RootRepeal with further details. If you'd like to see if (because the post will become too long if I post it), please ask me.

Thanks for the help, guys!
Reply

Tags
rootkit, virus

THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
WELCOME TO TECH SUPPORT GUY! Are you looking for the solution to your computer problem? Join our site today to ask your question -- for free! Our site is run completely by volunteers who want to help you solve your computer problems. See our Welcome Guide to get started.
Thread Tools



Facebook Facebook Twitter Twitter TechGuy.tv TechGuy.tv Mobile TSG Mobile
You Are Using:
Server ID
Advertisements do not imply our endorsement of that product or service.
All times are GMT -4. The time now is 09:47 PM.
Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved.

Powered by Cermak Technologies, Inc.