[jjatibm]

I can no longer play files with extension wmv ,
Infected by the PC Security 2009 malware and I cannot remove it completely need help .

[Polaris2KX]

Hello jjatibm. Welcome to TSG,

Please click on Report at the bottom of your thread and ask for it to be moved to the Malware Removal & HijackThis Logs forum.

You will also need to post a HijackThis log:
http://forums.techguy.org/malware-re...st-before.html

[jjatibm]

Thanks to Polaris2KX for your prompt response. I will transfer this problem to the recommanded forum section. I have since resolved the playing of wmv files but I am still working on the removal of malware 'PC Security 2009'.

[jjatibm]

I noticed that the problem was restricted to one user account on the PC for which the password was suddently not accepted anymore. In resolving the password issue the media player problem disappeared. WMV file are now played by Windows Media Player correctly.

[dvk01]

are you still having problems with pcsecurity malware



Please download Malwarebytes' Anti-Malware to your desktop
from HERE or HERE

Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following:

Update Malwarebytes' Anti-Malware. Launch Malwarebytes' Anti-Malware. Then click Finish.

If an update is found, it will download and install the latest version. Press Update to make sure the latest database is loaded.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad.
Please include this log in your next reply.

It might ask you to reboot to finish cleaning. Please do so. ( Press YES on the alert)
If you receive an (Error Loading xxxxxxxxxx .dll) error on reboot please reboot a second time . It is normal for this error to occur once and does not need to be reported unless it continues on every boot

[jjatibm]

Thanks to dvk01. I have resolved my problem by executing Malwarebytes Anti-Malware. PC Security was previously blocking access and displaying a pop-up message asking to buy their product when trying to access support sites like Symantec or Tech Support Guy. I could access them only after several retries. I did several tests after running Anti-Malware and these messages no longer appear. Great support from great forums many thanks to the Tech Support Guy!

[jjatibm]

Here is the Anti-Malware log. Sorry for the french text since I am running a french version of the product. If someone needs translation I can help.

[dvk01]

next
Delete any existing version of ComboFix you have sitting on your desktop

Please read and follow all these instructions very carefully

Download ComboFix from Here to your Desktop.

**Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus and anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
• Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
• Remember to re enable the protection again after combofix has finished

--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running

Double click on combofix.exe & follow the prompts.

If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.

[jjatibm]

I have executed Combofix as recommended. The log is attached.Thanks dvk01, JJ.

[dvk01]

looks OK now but I am suspicious that there might be a hidden virus

* Run Kaspersky online virus scan Kaspersky Online Scanner.

After the updates have downloaded, click on the "Scan Settings" button.
select the (b)"Spyware, Adware, Dialers and other potentially dangerous programs" for the scan.
Under "Please select a target to scan", click "My Computer".
When the scan is finished, Save the results from the scan!

Note: Kavscan is a scanner only & won't fix anything but will normally find the most infected files so it's report gives us a good place to work from

If that won't run then
Run an online antivirus check from one of the following sites
http://security.symantec.com/default.asp?
http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/
http://www.bitdefender.com/scan8/ie.html

[jjatibm]

Thanks dvk01 but this PC (used by my wife) is fully protected by Symantec's Norton 360 with the latest virus update. I tried to run Kaspersky Online Scanner on my other PC and it caused an unsolicited system reboot in the middle of the scan (at about 35%) so I am not going to do anything more with the product. I consider my original problem fixed and do not need any help untill further notice. Thanks!
JJ

[dvk01]

if Norton scans clean then

*Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
* Click START then RUN
* Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the /U, it needs to be there.


This will also purge the restore folder and clear any malware that has been put in there. Now Empty Recycle bin on desktop Then reboot.

go here http://www.thespykiller.co.uk/index.php?page=3 for info on how to tighten your security settings and how to help prevent future attacks.

and scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer and update whatever it suggests

Then pay an urgent visit to windows update & make sure you are fully updated, that will help to plug the security holes that let these pests on in the first place