Emsi Software Support English

KMW_SYS.sys - Rootkits can't be removed

Sun, 13 May 2012 14:29:26 +0000

New here. Protocols ask for files and logs that do not exist on my pc. Error message received

C:\WINDOWS\System32\Drivers\KMW_SYS.sys - Rootkits can't be removed
automatically. Please consult the experts in the Emsisoft online forum for
help with manual removal of this Malware: http://support.emsisoft.com

I'm basically a babe in the wood when it comes to this game any help would be appreciated.

Attached Files

a2scan_120513-042105.txt 604bytes 4 downloads
a2scan_120513-042133.txt 924bytes 4 downloads
quarantine_120513-091526.txt 21.13K 5 downloads

Riskware.Win32.InstallCore.AMN!E1 wont delete.

Sun, 13 May 2012 04:23:20 +0000

Hi

Emsisoft found Riskware.Win32.InstallCore.AMN!E1 and wont delete or move it to the quarantine. Avira found two trojans spy.zbot or somthing like that and found an infection when scaning for rootkits but wont remove it unless i have the full version. I really need some help on what to do next to get rid of these infections thanks.

- Johnny

Virus.Win32.Vundo!E2

Sat, 12 May 2012 12:41:01 +0000

2 viruses found during Deep Scan: Virus.Win32.Vundo!E2 and Trojan.Win32.Webprefix!E2

I tried to follow directions on START HERE but OTL got stalled.

Can you help me?

Thank you,

Jeanne

Virus.Win32.Obfuscator!IK

Thu, 10 May 2012 17:36:47 +0000

iexplore process starts, and system speakers keep playing advertisements. Virus.Win32.Obfuscator!IK detected by EEK

Attached Files

a2scan_120510-120158.txt 4.46K 4 downloads
Extras.Txt 56.85K 4 downloads
OTL.Txt 97.42K 5 downloads

Conficker helpppppp

Wed, 09 May 2012 21:00:24 +0000

I have 4 different networks with the virus listed below, your antimalware picks it up and removes it but it doesn’t prevent it from being pulled down, Also your scheduled task scans do not remove the threats automatically… please fix.I am still working on this issue but I was wondering if there was anything you would suggest, I have the file guard and behavior blocker enabled, with surf protection. These computers continue to get infected within a couple of hours of removing the conficker virus. Any idea’s?

-Windows Firewall Group Policy forced enabled
-Computers have all windows updates
-tdsskiller all rootkits
-Clean temp files
-CCleaner reg fix/temp cleaners
^^Have all been applied to the computers and still remain to get infected

Windows XP Pro in a work environment with multiple sites connected 120+ computers
Thanks

http://www.emsisoft.com/en/malware/?Virus.Worm.Downadup!E2

cant locate definition of infections

Tue, 08 May 2012 22:04:42 +0000

I found this when I was scanning a friends computer. He got these files from school. I am trying to research where these came from. Is it possible they are positive negatives?

J:\Seagate Backup\THEOMNIMAX-PC\History\Level2\C\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll detected: Adware.Win32.Yontoo.A!E1
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 4-6\cdaclas1_MSH.exe detected: Trojan.Win32.KillFiles!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 4-6\copydata_MSH.exe detected: Trojan.Win32.Shutdowner!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 4-6\For fun\collatz.exe detected: Trojan.Win32.Regrun!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 4-6\For fun\change2_MSH.exe detected: Trojan.Win32.Shutdowner!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 1-3\multdivide.exe detected: Trojan.Win32.Regrun!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 1-3\Various Practice\charprac.exe detected: Trojan.Win32.Regrun!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 1-3\Just Fo' Fun\boardfoot.exe detected: Trojan.Win32.Regrun!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 1-3\factors_MSH.exe detected: Trojan.Win32.Regrun!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 1-3\Just Fo' Fun\square_root.exe detected: Trojan.Win32.Shutdowner!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 4-6\stream1a.exe detected: Trojan.Win32.Shutdowner!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\Documents\School Stuff\High\Senior\D C++ Programming\Chapters 4-6\For fun\getprac.exe detected: Trojan.Win32.KillFiles!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\3a8d4910-2946cbce -> ER.class detected: Exploit.Java.CVE-2010!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\3a8d4910-2946cbce -> b.class detected: Exploit.Java.CVE-2010!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\3a8d4910-2946cbce -> Inc.class detected: Exploit.Java.CVE-2011!E2
J:\Seagate Backup\THEOMNIMAX-PC\C\Users\The Omnimax\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\3a8d4910-2946cbce -> c.class detected: Exploit.Java.CVE-2010!E2

my pc infected by virus-Win32.virut.E2

Tue, 08 May 2012 20:00:26 +0000

Good evening,
My PC is infected by the viruswin-32.virutE2 the access path isC:\windows\systeme32\drivers\http.sys,
I provide you a copy of the report of scan. My English ispoor then if you could E answer in French it would be well
I cannot quarantine it, can you bring to me of the assistance.
Cordially.

Version - Emsisoft Anti-Malware 6.5
Dernière mise à jour : 08/05/2012 10:01:36

Paramètres du balayage :

Type de balayage : Scan en Détail
Objets : Rootkits, Mémoire, Traces, C:\, D:\
Recherche dans les archives : Marche
Balayage des ADS : Marche

Début de l'analyse : 08/05/2012 11:46:09

C:\Windows\System32\Drivers\http.sys Objets détectés : Virus.Win32.Virut!E2

Analysé 416102
Objets trouvés 1

Fin du balayage : 08/05/2012 12:56:27
Temps de balayage : 1:10:18

En quarantaine 0

Ebay Confirm your identity malware

Tue, 08 May 2012 13:00:40 +0000

Please can you help me?

Attached Files

Extras.Txt 59.97K 9 downloads
a2scan_120508-131723.txt 45.72K 8 downloads
OTL.Txt 79K 9 downloads

Ebay etc. confim your identity malware

Sat, 05 May 2012 11:11:17 +0000

Could you please assist me with my computer that has been infected causing windows to pop up when using sites such as ebay. These windows request personal credit card info. It also seems to have severely slowed down the functioning of my web browsers. I have attached the required files.

Thanks

Attached Files

a2scan_120505-103641.txt 16.37K 6 downloads
Extras.Txt 61.11K 3 downloads
OTL.Txt 48.55K 3 downloads

Trace.Registry.palevo!E1 cannot delete

Sat, 05 May 2012 09:53:41 +0000

Emsisoft Anti-Malware scan Trace.Registry.palevo!E1 cannot delete why cannot delete？？

Root Kits removel

Fri, 04 May 2012 17:16:22 +0000

Hello. I got two recurring trojans on my weekley scan.
They are Trojan.win32.hider!e2 and trojan.sirefef!E2.
The rootkit is C:\WINDOWS\SYSTEM32\DRIVERS\MRXSMB.SYS
Then it tells me that c:\windows\system32\hpqcxs08.dll is locked
and will be removed on next reboot. Problem is it comes back after
reboot. Any help would be greatly appreciated.

Thank you.

Attached Files

a2scan_120430-111008.txt 2.25K 6 downloads
Extras.Txt 49.81K 6 downloads
OTL.Txt 77.53K 4 downloads

Amazon, ebay and paypal identification popups en slow internet

Fri, 04 May 2012 15:00:47 +0000

Since a few days I have had several suspicious popups regarding identification from amazon, ebay and paypal even when I was not visiting their websites. At first I thought it was just another phishing attempt so I refreshed my browser and was able to continue with the internet.
But now internet just gets slower with each day. I have run several virus scans, but the popups still continue.
After googling I discovered this forum and read the instruction and created all the logs you need. Can you please help me? Thank you! a2scan_120504-112300.txt 9.95K 7 downloads Extras.Txt 70.6K 8 downloads OTL.Txt 93.96K 5 downloads

New test-VirusBulletin

Fri, 04 May 2012 00:07:35 +0000

New Test for Windows XP SP3:

Failed Test: 1 False Positive: http://www.virusbtn.com/vb100/archive/test?recent=1
RAP Averages (I don´t find Emsisoft): http://www.virusbtn.com/vb100/RAP/RAP-quadrant-Oct11-Apr12-large.jpg

Ebay/ccbill/Online Banking confirm your identity and/or security confirmation malware

Thu, 03 May 2012 16:08:53 +0000

Hey guys,

my post pretty much has the same content as phil0sophy's had earlier (http://support.emsisoft.com/topic/8041-yet-another-ebayccbill-confirm-your-identity-malware-hijacker/).
I wasn't quite sure if I should start a new thread or comment on phil0sophy's. If I chose the wrong option I'd like to excuse myself in advance!

So as the topic already says, when I start the eBay, Amazon or my online banking website, I occasionally get asked for a confirmation of my security or account details. Of course I did not fill in anything whatsoever, but I guess that's something I should take care of right ?

Thanks a lot in advance and you guys cannot be appreciated enough for what you're doing here!

a2scan_120503-152243.txt 31.36K 5 downloads Extras.Txt 27.29K 4 downloads OTL.Txt 52.62K 5 downloads

Malware Win32.AMN!E1 In Quarantine.

Thu, 03 May 2012 01:56:54 +0000

Hello!
Currently in Quarantine in your Anti-Malware program are 2 source's of Malware.Win32.AMN!E1. I was only able to quarantine them but not delete until yesterday's update. I am worried that a delete will not be enough.

Could you please tell me how to proceed.

The required tests were run with Emergency Kit and OTL and are attached.
THANKS!!!! Extras.Txt 87.2K 8 downloads OTL.Txt 79.12K 10 downloads

Help, is my PC infected please

Wed, 02 May 2012 07:39:56 +0000

At the request of Fabian Wosar I am sending 3 logs. EEK scan, OTL & Extras.

So many weird things have been happening, unwanted files appearing, pages hanging, sound distorted etc. etc. Emsisoft sometimes freezes in middle of scans, Outlook express hangs & have many Emsisoft Guard logs of suspected malware attacks, also services turn themselves on/off & enable/unable themselves. Grateful for your advice. Many thanks.

a2scan_120501-175530.txt 956bytes 8 downloads OTL.Txt 61.28K 11 downloads Extras.Txt 26.91K 5 downloads

Yet another Ebay/ccbill confirm your identity malware/ Hijacker

Tue, 01 May 2012 19:49:42 +0000

Hey there,

I am having the same issues as a few others on here, keep getting a pop up with certain sites like ebay and other sites that need log in`s requiring me to enter my bank details and atm pin, which obviously I have not done, Browsing is very slow and it seems to be a browser hijacker or redirection of some sort but I will let the experts decide as I am probably way off the mark, I have all the logs you require attached.

Thanks very much and I really appreciate any help you can or may give me.

Attached Files

a2scan_120501-183556.txt 13.07K 8 downloads
Extras.Txt 116.02K 7 downloads
OTL.Txt 150.07K 6 downloads

plz >>> i need help

Mon, 30 Apr 2012 18:43:25 +0000

hi>>>

plz see

attach files

i had delete ftmgr.sys+ntoskrnl.sys from syestem 32?? because blue screean the problem know in norton

Attached Files

29.bmp 750.05K 9 downloads
30.bmp 1.2MB 9 downloads

How to remove this Malware.

Mon, 30 Apr 2012 15:50:14 +0000

\\.\PhysicalDrive0 - Rootkits can't be removed automatically. Please consult the experts in the Emsisoft online forum for help with manual removal of this Malware: http://support.emsisoft.com

1.http://i45.tinypic.com/1g5dn6.jpg

When i try to remove or quartine this it shows as below..

2.http://i45.tinypic.com/vnhwep.jpg

With warning as-"\\.\PhysicalDrive0 - Rootkits can't be removed automatically. Please consult the experts in the Emsisoft online forum for help with manual removal of this Malware: http://support.emsisoft.com"

Please let me know the solution.

I will be very thankfull 2 u.

Reports are attached

Attached Files

a2scan_120430-181517.txt 1.76K 12 downloads
Extras.Txt 33.88K 8 downloads
OTL.Txt 617.68K 12 downloads

How to remove this Malware.

Sun, 29 Apr 2012 12:52:08 +0000

1.http://i45.tinypic.com/1g5dn6.jpg
When i try to remove or quartine this it shows as below..
2.http://i45.tinypic.com/vnhwep.jpg

With warning as-"\\.\PhysicalDrive0 - Rootkits can't be removed automatically. Please consult the experts in the Emsisoft online forum for help with manual removal of this Malware: http://support.emsisoft.com"

Please let me know the solution.

I will be very thankfull 2 u.

Programs keep launching in multiples by themselves

Sat, 28 Apr 2012 20:29:16 +0000

I downloaded a PDF from an insurance agent and within the hour my PC was sluggish and freezing.

I ran Emsisoft to see what the problem was and it came back with a few trojans and a rootkit. Tried the delete selected and was told the rootkit could not be removed and was pointed here.

Attached Files

a2scan_120427-190032.txt 28.75K 12 downloads
OTL.Txt 90.06K 14 downloads
Extras.Txt 51.92K 8 downloads

rootkit problem

Fri, 27 Apr 2012 14:44:47 +0000

Attached are results for EEK and OTL scans. I am sending these from a different computer as my computer will not let me get on your site. I do not get the security or verification text boxes. My computer is very sluggish and I get sent to strange sites on the internet. The original scan report with your malware program is also attached. Thanks, bar

Attached Files

a2scan_120426-172925.txt 2.11K 5 downloads
a2scan_120427-060923.txt 978bytes 5 downloads
OTL.Txt 278.79K 7 downloads
Extras.Txt 61.93K 4 downloads

Virus.Win32.Vundo!E2

Wed, 25 Apr 2012 19:03:44 +0000

Please see the attached regarding the above named issue that could not be deleted or quarantined.
Thank you-

Mike

(518)280-9907

Attached Files

Extras.Txt 41.09K 7 downloads
OTL.Txt 55.07K 6 downloads
a2scan_120425-111618.txt 894bytes 8 downloads

Another Ebay "Confirm your identity" pop-up virus

Wed, 25 Apr 2012 11:29:35 +0000

Hi!

I got pretty much the same problem as the other dude who posted about this topic. Internet browsing has become super slow, IE does not even work. When I search some sites I get this pop-up that wants me to confirm my identity with my credit card details.

Please help and thx in prespect!

Attached Files

Extras.Txt 62.29K 9 downloads
a2scan_120425-120743.txt 11.77K 6 downloads
OTL.Txt 67.96K 11 downloads

Trojan.Qhost.CU!IK

Tue, 24 Apr 2012 20:50:32 +0000

windows xp sp3 need help removing Trojan.Qhost.CU!IK

Attached Files

a2scan_120424-125013.txt 5.22K 9 downloads
Extras.Txt 42.64K 19 downloads
OTL.Txt 67.18K 6 downloads

Can't Browse or Ping Microsoft sites

Mon, 23 Apr 2012 18:34:11 +0000

On April 10, I could not log in to my Hotmail account. I then find that i cannot browse or ping Microsoft sites. I scanned with several anti-virus/malware programs. Only Emsisoft online scanner found Torjan.win32.scar!1k. I quarantined the infection, but the problem did not go away. I went to your site and followed the instructions on running the emergency kit and OTL on April 13. I was on vacation for a week, so I waited to run them again today. The OTL did not create a new Extras.txt file, so I am attaching the file from April 13. Can you help me with this problem? Thanks.

Attached Files

OTL.Txt 77.43K 6 downloads
Extras.Txt 53.99K 16 downloads
a2scan_120423-092452.txt 17.83K 11 downloads

sending logs

Mon, 23 Apr 2012 16:20:56 +0000

here are the logs requested. Also, when I try to use facebook through google chrome, I get a safety signature error.

Attached Files

OTL.Txt 119.22K 6 downloads
Extras.Txt 71.12K 7 downloads
a2scan_120423-082538.txt 11.31K 5 downloads

Computer infected with Trojan:DOS\Alureon

Sun, 22 Apr 2012 19:17:51 +0000

I have tried to run several virus scanners but nothing seems to remove the virus.

Attached Files

Emisoft Emergency Kit log.txt 7.86K 10 downloads
OTL.Txt 149.95K 14 downloads
Extras.Txt 50.15K 6 downloads

After running Anti-Malware still do not see folder on desktop or C:

Fri, 20 Apr 2012 11:22:21 +0000

I had an SMART HDD infection and rab your product to clean it up. IT had one file identified as suspect ,but the message when it went to quanatine it was "file not found". When the infection started desktop went black, Exploer favorites showed empty and got lots of mesages about hard drive errors. Since cleaning the messages have stopped, but I still can not see my files. Isuspect they are still there but that the permissions got messed with and took away visibility. Since I wasn;t sure I was clean, I downloaded emergency kit and completed the task listed and have attached the results.

Most important is confirmation that my mchine is clean. If you can help with how to fix visiblity that 's great, but I may be able to sort that by myself.

Extras.Txt 44.12K 6 downloads OTL.Txt 52.38K 7 downloads a2scan_120419-222954.txt 20.4K 11 downloads

What happened to my "Resizer" thread?

Fri, 20 Apr 2012 02:54:27 +0000

What it removed? Was it in the wrong section and was moved to another section?

Also, why didn't a moderator from the Emsisoft forum contact me and explain to me what happened?

trojan Rootkit- Help!

Thu, 19 Apr 2012 17:15:22 +0000

Hello,

I've recently been battling a nasty Trojan Rootkit on my company computer. I ran the Emsisoft software and it recommended I post to the forums.

I am unable to use my computer effectively about 70% of the time.

Attached are the three logs requested. I hope I did them right.

Please any help would be GREATLY appreciated!!

Thank-you in advance!
Sarah

Attached Files

OTL.Txt 222.85K 11 downloads
a2scan_120418-120839.txt 7.3K 11 downloads
Extras.Txt 32.15K 31 downloads

Trojan.Qhost.E! infection

Thu, 19 Apr 2012 05:24:57 +0000

I can't use google searches anymore since This trojan showed up. I am always redirected to other sites.

Attached Files

a2scan_120418-194646.txt 7.3K 9 downloads
Extras.txt 21.99K 5 downloads
OTL.txt 36.48K 10 downloads

Evasion attacks expoliting file-parsing vulnerabilities in antivirus products

Wed, 18 Apr 2012 00:15:38 +0000

http://seclists.org/bugtraq/2012/Mar/88?utm_source=twitterfeed&utm_medium=twitter

Bad result for EAM (19 vulnerabilities).

I hope EAM improves these problems.

Trojan when accessing online banking, H2 remove?

Tue, 17 Apr 2012 09:16:56 +0000

Hi, when accessing my online banking account i get this page (see attachment trojan-pic.png).

I have run all your suggested tools, see attached log files. Help is appreciated.

Thanks!

a2scan_120416-203610.txt   15.58K   12 downloads
OTL.Txt   98.17K   19 downloads
Extras.Txt   77.83K   9 downloads

Rootkit.Win32.ZAccess!E2

Mon, 16 Apr 2012 16:31:50 +0000

Hi,

After running Emsisoft Malware, there is a rootkit (Rootkit.Win32.ZAccess!E2) that cannot be removed automatically and requires your support please. I attached the 3 files required from the instructions.

I thank you a lot for your attention and your help.

Sincerely,
Candide.

Attached Files

a2scan_120416-105217.txt 2.05K 13 downloads
OTL.Txt 81.42K 8 downloads
Extras.Txt 39.52K 8 downloads

Can't get rid of Search Browsing (www.searchbrowsing.com) from Internet Explorer 9

Fri, 13 Apr 2012 09:54:40 +0000

I have somehow got a highjacker on my system, and I've tried different things, including your malware scanner, but to no avail.

I think I've got rid of it from Firefox, but in Internet Explorer, as soon as I change the start page, it's changed back to searchbrowser again.

I enclose the reports you've asked for.

Roy

Attached Files

a2scan_120413-094445.txt 1.52K 14 downloads
Extras.Txt 49.47K 13 downloads
OTL.Txt 477.34K 10 downloads

How do I remove/delete these?

Fri, 13 Apr 2012 01:06:39 +0000

Software directed me to this site to find out how to remove/delete the following:

C:\WINDOWS\System32\Drivers\mrxsmb.sys

c:\windows\system32\smserial.dll

Daily testing:

Thu, 12 Apr 2012 16:24:22 +0000

Daily Test: http://www.shadowser...VirusDailyStats

Weekly Test: http://www.shadowser...irusWeeklyStats

Monthly Test: http://www.shadowser...rusMonthlyStats

Today, Emsisoft is among the best.

trojan crypt cannot remove

Tue, 10 Apr 2012 14:42:21 +0000

Am unable to remove trojan.crypt, I have disabled system restore as it said the trojan was their, but it still remains? I was unsure as I run/use Emsisoft Anti-Malware whether I should run the emergency scan. Any help would be appreciated - OTL scan is attached. Tony Cole.

Attached Files

Extras.Txt 39.06K 11 downloads
OTL.Txt 80.58K 10 downloads

I have Malware.Win32.AMN

Mon, 09 Apr 2012 17:56:19 +0000

I scanned my computer and found that I have Malware.Win32.AMN and when I ran emsissoft anti-malware 6.0 it scanned everything and then I quarantined the selected file and I need help with the manual removal of this malware.

The files that couldn't be removed by EA6.0 are:

AdWare.BHO!E2
Trojan.SuspectCRC!E2
BH0.Win32.Zwangi!E2

All help will be greatly appreciated.

edit:

Im doing the emergency kit and OTL scans and will post those files when they are complete.

Attached Files

OTL.Txt 87.59K 15 downloads
Extras.Txt 48.19K 15 downloads

ZMRYKR0PWA HELP!

Mon, 09 Apr 2012 17:16:49 +0000

I've scanned my computer and found ZMRYKR0PWA.exe, which seems impossible to delete. My antivirus do not work, they seem blocked by this trojan.
Anyone knows how to delete it?
Thank you

Stepped away from the computer and PC shutdown.

Mon, 09 Apr 2012 12:36:13 +0000

I stepped away from the computer and my pc shutdown. Would really like someone to check my hijackfree log.
http://analyze.hijackfree.com/analyze/?id=38e57dea-69e9-4d31-88f6-90f8f9422449

How do i delete a Rootkey?

Sat, 07 Apr 2012 10:27:47 +0000

Attached Files

a2scan_120406-231524.txt 21.81K 10 downloads
OTL.Txt 75.63K 16 downloads
Extras.Txt 42.69K 11 downloads

Detected: Trojan-Banker.Win32.Banbra!E2

Fri, 06 Apr 2012 03:02:53 +0000

Hello there, I come to you with the same problem: Trojan-Banker.Win32.Banbra!E2. You resovled it a few day ago and it is there again. Emsisoft Emergency Kit says that there are no infections, but Emsisoft Anti-Malware - Version 6.0 says there is. What should I do? Do I follow the previous direction or should I wait for a new one? Thank You.

Attached Files

a2scan_120405-164351.txt 872bytes 16 downloads
a2scan_120405-170550.txt 954bytes 12 downloads
OTL.Txt 318.05K 12 downloads
Extras.Txt 26.97K 12 downloads

My PC is infected

Thu, 05 Apr 2012 09:21:01 +0000

I could not run the emergencykitscanner because I got an error that said it could not find a2emergencykit.exe. However I was able to run OTL.exe. I have attached the OTL.Txt and Extras.Txt files.

My browser is disabling my browser window and displaying phishing popups asking for my credit card numbers, pins and other personal info when I log into any of my credit card sites in Firefox. I am not seeing those popups in Windows.

Attached Files

Extras.Txt 40.85K 10 downloads
OTL.Txt 85.82K 14 downloads

Emsisoft Anti-Malware unable to quarantine or delete infected file - need help

Mon, 02 Apr 2012 01:24:20 +0000

File is: C;\Windows\System32\Drivers\UMDF\WpdMtpDr.dll

Infected by: Trojan.JPG.IframeRef!E2

EEK and OTL files attached.

Attached Files

Extras.Txt 41.77K 19 downloads
OTL.Txt 89.17K 16 downloads
a2scan_120401-134151.txt 50.5K 13 downloads

Can't log in to Windows

Fri, 30 Mar 2012 16:30:10 +0000

This may or may not be related to an issue I reported here on 3/12/2012, but now when I get to the log in screen and type in my password, it doesn't recognize my password and won't let me log in. I tried as administrator as well, to no avail.

I leave my computer on all the time, and sometimes I will come in to my office and find my computer at the log-in window, which means it had to have logged off on it's own. At the log-in screen, there will sometimes be two log-in options instead of the usual one: one option is as "Administrator," the other is my normal log-in as myself. When this happens, If I log in as Administrator, the desktop and icons look different than usual, and the files are not open that I had open originally. Sometimes when this happened in the past, it wouldn't let me log in as myself. But if I reboot the computer at this point, it usually takes me back to a normal log-in screen and let's me log in normally.

This time, however, no matter what I do, it won't let me log in, either as administrator or myself. I've tried shorting the CMOS, and still no luck.

Does this sound like some kind of virus, or some other problem? Any ideas for how to get back into my system?

Thanks.
Mark

Everything is gone

Thu, 29 Mar 2012 17:04:26 +0000

all of my computer data is gone. I only have on my desktop computer icon and recycle bin icon. I had stuff saved up like on my notepad
other programs stuff in my documents. Even the internet was inaccessible until I figured out a way around that. I'm on the internet by the skin of my teeth. Can you help me get everything back like it wass?

Attached Files

OTL.Txt 50.4K 29 downloads

pernicious rootkit

Wed, 28 Mar 2012 03:23:34 +0000

Please help me remove a rootkit

Attached Files

a2scan_120327-182140.txt 2.84K 18 downloads
Extras.Txt 33.92K 12 downloads
OTL.Txt 67.56K 25 downloads

Virus "ZX Games" ?

Tue, 27 Mar 2012 16:11:37 +0000

I'm afraid to have a virus / rootkit problem: Using Win 7 / 64 in the taskmanager apear after logon several processes with the description "ZX Games - The old ZX Spectrum Games" (32 bit process). The process names are random (looking like hex numbers). In the application list there are no additional entries. The main problem is that permanently more and more of this processes are started, causing the system to page to disk. After about 700 to 800 processes Windows gets stuck completely. Starting Windows in secure mode (boot to commandline) this does --NOT-- happen. It looks like the processes are started from %user%\AppData\Local\Temp, because the corresponding *.exe files (several hundred) can be found here, some of them having 0 size, what indicates they are written by an other process (I removed the power supply to stop the machine). Corresponding *.tmp files (same names, all of them zero size) are found in the same directory.

Since I can use the commandline only I tried a2cmd and stinger as commanline virus scanners, but nothing has been found.

What to do ???

MBR Rootkit not removable by EmsiSoft

Sun, 25 Mar 2012 16:24:07 +0000

Hi there,

last run with Emsisoft virusscanner showed an MBR Rootkit not removable

I followed your advice on the forum and used:

Emsisoft Emergency Kit (log included)

OTL (2 logs included)

I also ran Kaspersky TSS killer but the program did not recognise any Rootkit!

So I am very curious wether there is a problem or not.

Awaiting your response..........

MadMax

Attached Files

Extras.Txt 135.57K 28 downloads
OTL.Txt 207.42K 40 downloads
a2scan_120325-133457.txt 3.9K 17 downloads

Rootkits cannot be removed automatically. Consult forum experts.

Sun, 25 Mar 2012 00:58:24 +0000

Emsisoft scan advised \\.\PhysicalDrive0--"Rootkits can't be removed automatically ..." I believe the TSDDKiller note was "Heuristic.Possible.MBR.Rootkit!E1." Attached are the EKK and OTL files, as requested. I was unable to generate a TDSS report. That may have been a failure on my part, or perhaps a blocking action on the part of the rootkit.

TIA.

Francis

Attached Files

a2scan_120324-145832.txt 13.98K 17 downloads
OTL.Txt 128.87K 16 downloads
Extras.Txt 51.71K 23 downloads

Emsisoft Deep Scan found 2 files it could not remove

Sun, 25 Mar 2012 00:26:14 +0000

I am attaching the 3 logs per this posting protocol and also the log from a deep scan I did prior to downloading the EEK and OTL scanning software. Emsisoft deep scan instructed me to go to this forum for help manually removing the 2 files listed on the deep scan log.

I would gladly appreciate any help.

Attached Files

EEK_a2scan_120324-181549.txt 964bytes 14 downloads
OTL.Txt 74.2K 14 downloads
prior_to_EEK_a2scan_120324-134503.txt 1.74K 14 downloads
Extras.Txt 35.96K 14 downloads

How to delete these objects ?

Sat, 24 Mar 2012 11:42:31 +0000

Hi,

Could you help me to destroy these objects from my PC ?

Thanks in advance.

Best Regards from France,
Philippe

Attached Files

Emsisoft_help.zip 19.63K 12 downloads

Trojan-Banker.Win32.Banbra!E2 identified in scan

Sat, 24 Mar 2012 08:49:24 +0000

Followed the reporting /submission guidelines as posted. When I ran the EEK scan, the report was 'no suspect files were found.'

Emsisoft Emergency Kit log and OTL.txt attached. OTL scan opened only one notepad window: OTL.txt. I was not able to find Extras txt.

Thank you for your prompt assistance, Serge.

Attached Files

a2scan_120324-014532.txt 966bytes 17 downloads
OTL.Txt 302.49K 15 downloads

Rootkit Boot Wistler!E2 identified in scan

Sat, 24 Mar 2012 03:01:33 +0000

Followed the reporting /submission guidelines as posted. When I ran the EEK scan, the report was 'no suspect files were found.' I believe I have attahced the correct log.

OTL.txt and Extras.txt logs attached.

Thank you for your prompt assistance.

Attached Files

OTL.Txt 58.49K 18 downloads
Extras.Txt 37.15K 15 downloads
a2scan_120323-194349.txt 964bytes 13 downloads

How to delete rootkits manually ?

Thu, 22 Mar 2012 19:04:32 +0000

Hi,

My emsisoft version (6.0) can't delete rootkits automatically.

This the object that I want to delete:
C:\WINDOWS\System32\Drivers\netbt.sys

Can you help me please ?

Best Regards from France,
Philippe

PS: Sorry for my bad english

System Check Malware

Thu, 22 Mar 2012 02:21:07 +0000

My computer is infected with the system check malware, please find attatched the reports you need. Thanks

Attached Files

Extras.Txt 41.61K 16 downloads
OTL.Txt 150.45K 17 downloads
a2scan_120322-105140.txt 1.21K 13 downloads

another rootkit that wont quarentine.

Tue, 20 Mar 2012 02:27:09 +0000

Hello
I'm looking for some help. I've completed the directions in one of the other files and rescaned with eset and it says i have 3 files with rootkit trojan in them. I reran the EEK and OTL scans and am attaching them. This time when I did the OTL scan only got one file, i ran it a second time and still only one file. OTL.Txt 67.53K 16 downloads a2scan_120319-182447.txt 1.27K 15 downloads

"Confirm Your Identity" eBay pop-up

Fri, 16 Mar 2012 16:40:17 +0000

Hi!
I'm having the same problem as a few previous posters - every time I try to search on eBay, a pop-up appears asking for credit card info. As far as I know, it started yesterday. I've attached the requested scan logs, thanks for any help

Attached Files

a2scan_120316-144020.txt 4.2K 21 downloads
Extras.Txt 36.84K 17 downloads
OTL.Txt 86.97K 21 downloads

tmpassthru ?

Fri, 16 Mar 2012 01:22:08 +0000

HI I have the eek log otl txt & extras txt. in my documents but am not sure how to paste them.I apologize for my lack of knowlege. a2scan_120309-180337.txt 1.26K 16 downloads hijackthis.log 5.92K 11 downloads OTL.Txt 72.45K 14 downloads Extras.Txt 37.96K 11 downloads
hope this is correct.

rootkit that wont go to quarenteen plz help

Thu, 15 Mar 2012 21:45:36 +0000

i have a rootkit on my laptop that wont go to quarenteen when ive done a scan. the laptop has been unbarely slow for a few weeks and malwarebytes pops up every minute or so blocking unsafe sites. could you plz help to remove it, thanks

Ebay "Confirm your identity" pop-up virus

Tue, 13 Mar 2012 15:25:31 +0000

Hey guys, came across a couple threads from here about a similar issue I'm having,
every time i try to search something in ebay i get a popup asking me to confirm my details by entering in stuff like credit number and bank info, only noticed it in the past couple days.
i followed the instructions in ShadowPuterDude's thread and the logs are attached below
Any help would be greatly appreciated
cheers

Attached Files

a2scan_120313-235730.txt 2.58K 34 downloads
Extras.Txt 70.32K 20 downloads
OTL.Txt 55.51K 18 downloads

rootkit ...file in drivers directory, update.sys

Tue, 13 Mar 2012 04:00:26 +0000

Hi! The software was not able to remove a rootkit. It found update.sys in the drivers directory. When running the emergency kit, I did not see this entry come up. I have attached the requested files below. Thank you in advance for all your assistance!

a2scan_120311-230033.txt   968bytes   22 downloads

OTL.Txt   91.57K   21 downloads

Extras.Txt   38.8K   17 downloads

Is this malware - Safesurf / Surfguard?

Mon, 12 Mar 2012 21:02:10 +0000

First, I'm sorry for having to post again so soon since last time, but this install package just appeared on my desktop, and I never clicked it, but apparently it installed itself. I keep getting messages about Safesurf and Surfguard. I went to uninstall them but they didn't show up in Add/Remove Programs. But I found them under Processes in Task Manager and ended the processes. I'm sure they'll show up again when I restart my computer. I don't want them at all, but can't figure out how to uninstall them, so I'm assuming it's malware.

Note: When I changed my Folder Options to Show Hidden Files and Folders, a folder titled "js" showed up on my C drive. In it are the safesurf.exe and surfguard.exe files, among some other files. There is also a SafeSurf ABUSE README.txt document that reads:

ENGLISH VERSION BELOW
Если вы обнаружили этот файл, на вашем копьютере установлена программа SafeSurf, предназначенная для просмотра сайтов пользователями системы JetSwap
Если вы являетесь владельцем компьютера и программа была установлена без вашего согласия или ведома, перейдите по ссылке http://go.jetswap.co...4&authkey=98589
Пользователь будет заблокирован, а программа удалена с компьютера. Приносим Вам свои извинения за действия одного из наших пользователей, нарушающего правила системы.

If you found this file on your computer installed SafeSurf, designed for browsing by users of the system JetSwap
If you own a computer and the program was installed without your consent or knowledge, go to http://go.jetswap.co...4&authkey=98589
The user will be blocked and the program will be deleted from your computer. We apologize for the actions of one of our users who abuse the system.

I don't know if I should trust it enough to go to that website to have it deleted from my computer????

I've attached the EEK and OTL reports. I couldn't find the OTL.txt or the Extras.txt documents anywhere, but when I tried to save to my desktop the OTL.txt report that opened when the scan finished, it asked me if I wanted to overwrite the existing file there, even though I could not find a file there. So I saved it as OTL2.txt instead of overwriting it. I'm sure the Extra.txt file is there somewhere hidden, but I can't find it or see it.

Thanks.
Mark

Attached Files

a2scan_120312-151930.txt 18.35K 18 downloads
OTL2.txt 69.92K 14 downloads

Help with - Heuristic. Possible.MBR.Rootkit!E1

Sat, 10 Mar 2012 21:29:59 +0000

As i was enjoying my saturday morning I think my pc caught a bug, virus, malware? I am not sure. what i am sure of is I am in over my head and i need some help.

Attached Files

a2scan_120310-132623.txt 45.26K 17 downloads
Extras.Txt 43.58K 18 downloads
OTL.Txt 50.71K 21 downloads

EAM & OA (and others) Test by local hobbyist

Sat, 10 Mar 2012 04:23:14 +0000

On March 09, 2012 from 2315 to 2330 UTC I downloaded 24 malicious executables as posted on Malware Domain and Malc0de. No anti-anything applications were running when all files were saved to one directory. That folder was selected within the EAM and Immunet scan utilities while HMP and MBAM were used via the folder context menu. (Immunet was cloud only; no ClamAv or Tetra.) All scanning was completed within 25 minutes of downloading. See the screenshot for the results.

Finally, Online Armor Free was opened and updated and each executable was run.
Every exe evoked a "wants to run" popup which was Allowed with neither Remember, Trust, Install nor RunSafer selected.
All further popups were Blocked and when available Remember selected.
Many required more than one remembered Block and for a few a popup appeared where Terminate could be selected.
Most popups were Orange. A few were Red and none Green.
carta and telipol remained in memory and were terminated with Task Manager.
MBAM found and cleaned three tmp files.
EAM6, HMP and Immunet scans returned zero hits.

Monitoring NirSoft CurrPorts and NetMeter, zero network connectivity was observed during the OA Free exercise.
There did not seem to be any evidence of the New cloud-based scan and Anti-Malware Network Integration as implemented in the release of 5.5.0.1543.

All popups were fully the result of OA's stellar (and IMHO unequalled) HIPS protection as none made any mention of signature detection. Some Red popups indicated the local threat database (a2wl.dat) came into play, as I understand it.

Environment was from a clean Windows XP Pro SP3 x86 single partion image slipstreamed up to December, 2012's Patch Tuesday blasted onto a low level formatted hard drive and then Windows Updated.

Cheers.

EDIT: The screenshot should read 2315-2355 UTC!

Attached Thumbnails

Help, my PC is out of my control

Wed, 07 Mar 2012 15:20:38 +0000

My computer has been taken over by Malware, other users and administrators. Can't even install Emsisoft, since internet connection has been altered.

Attached Files

a2scan_120304-155748.txt 2.8K 21 downloads
a2scan_120305-090005.txt 968bytes 14 downloads
a2scan_120306-085439.txt 924bytes 15 downloads
a2scan_120306-180202.txt 968bytes 16 downloads
a2scan_120306-200133.txt 968bytes 17 downloads
ImportGPO_error_2012_03_01_23 _30_09.txt 60.98K 23 downloads
OTL.Txt 71.33K 20 downloads

browser virus

Tue, 06 Mar 2012 18:20:50 +0000

http://support.emsisoft.com/topic/7533-malaware-10/ first topic.

a2scan_120306-202041.txt 5.27K 22 downloads a2scan_120306-214151.txt 1.02K 16 downloads Extras.Txt 29.1K 19 downloads OTL.Txt 80.55K 17 downloads

"ebay Confirm Your Identity" pop up asking for credit card and bank info

Mon, 05 Mar 2012 07:37:13 +0000

I came across this site through Google when I found someone else had posted here with the same exact problem.

Whenever typing in any ebay search box and pressing search, a pop up appears asking for CC info and ATM pin. All the fields are required and the only way to get out is to press back or open a new tab. This happens with both IE and Mozilla. It is not an issue with them as the site works fine from any other computer that I used.

Attached are the files you have asked for... please help.. thank you

Attached Files

Extras.Txt 76.73K 19 downloads
OTL.Txt 70.96K 21 downloads
a2scan_120304-214449.txt 1.73K 26 downloads

Manual malware removal

Mon, 05 Mar 2012 01:53:10 +0000

Hello,

There is malware on my system that I can't clear with the regular Emsisoft scan, and so I followed the instructions and have attached my EEK log, OTL & Extras text files.

I would appreciate advice as to what steps I should take from here.

Thanks!

Attached Files

a2scan_120303-112857.txt 19.32K 22 downloads
OTL.Txt 78.27K 19 downloads
Extras.Txt 40.89K 16 downloads

Please help with Trojan.crypt!E2

Mon, 05 Mar 2012 00:29:17 +0000

Hello.
Thank you in advance. We seem to have picked up some kind of trojan and need your assistance.
Log files attached.
a2scan_120304-145918.txt 127.67K 21 downloads Extras.Txt 47.83K 17 downloads OTL.Txt 148.02K 18 downloads

AV-Comparatives?

Sat, 03 Mar 2012 20:19:43 +0000

How I wish that Emsisisoft aloud AV-Comparatives to test the Emsisoft IS pack…

Will it ever happen?

Suspicious popup @amazon & ebay and running very slow in browser

Sat, 03 Mar 2012 11:52:40 +0000

My browser has been acting weird lately and I couldn't discover what the problem was since all my other programs were running smooth. This week I went to the Amazon website without logging on and tried to search something. A popup appeared asking me for my creditcarddata and ATM-pin. I clicked it away and googled this phenomenon. It brought me to this forum. I had seen that my virus scanner found some things the week before but I thought nothing of since it had dealt with the threat. Could you please help me? I'm in the middle of finishing a postgraduate course, so it's perfect timing for computer problems I've read the instructions and created all the logs you need. Thank you in advance

Attached Files

OTL.Txt 88.97K 17 downloads
Extras.Txt 61.89K 21 downloads
a2scan_120302-014324.txt 38.47K 16 downloads

Weird DISCOVER!

Wed, 29 Feb 2012 18:20:40 +0000

PLZ SEE THE ATTACH PICTURE

super anti spy ware discover

Attached Files

987654321.bmp 2.93MB 36 downloads

My pc is infected and i can't run OTL

Tue, 28 Feb 2012 22:27:28 +0000

Hi,
I have downloaded the Emergency Kit and run the scan, 2 trojans have been found, pls see attached file. Then tried to run the OTL following the instructions given, this appears to have been unsuccessful, there was no sign that a scan was in progress, and no logs were created. Please help

Attached Files

a2scan_120228-150542.txt 1.26K 21 downloads

Trojan.Alureon!E2

Tue, 28 Feb 2012 16:53:11 +0000

My Labtop is infected by a series of viruses or trojan (The operaton system is win7 64 bit).

The first attemped was carried out by running Eset smart security Nod32. The scan log show win32/Olmarik.TDL4 trojan, but unable to clean it.

The next solution was Emsisoft pakage. After running your Emsisoft Internet Security, The result show 10 Trojans and qaurantied 9 of them which has a low risk and the high risk trojan that named Trojan.Alureon!E2 was unable to clean or quarantined.
(Scan with malware.txt)

I follow the instructions to created a report.

after runnig the EEk, the result log dosen't show the high risk trojan that was mentioned above.

Attached Files

Emsisoft Emergency Kit log.txt 3.14K 17 downloads
Extras.Txt 62.57K 16 downloads
Scan with malware.txt 6.25K 21 downloads
OTL.Txt 70.97K 17 downloads

Help! Found Rootkit.Win32.Pihar!E2

Sun, 26 Feb 2012 20:21:04 +0000

Scanned with Emsisoft Anti-Malware, Deep Scan. Found Rootkit.Win32.Pihar!E2. Says to contact support for rootkit removal/repair. AVG Antivirus seemd to find the rootkit, but could provide no info, not even a name. Couldn't heal it either. I think whatever this virus/malware is...it's letting all kinds of other malicious junk in too. What do I do now?

Emsisoft Emergency Kit seemed only to find a minor "cookie", but I left everything untouched as instructed. Logs from EEK & OTL are attached.

Attached Files

a2scan_120226-120528.txt 1.27K 24 downloads
Extras.Txt 18.26K 20 downloads
OTL.Txt 36.76K 16 downloads

PC infected by Trojans

Sun, 26 Feb 2012 19:00:41 +0000

Hi,

An initial scan detected Trojan.Agent-UM!E2 and Trojan.Agent-UN!E2 however these were not removed.

I have not attached the requested logs as I cannot complete a scan in normal mode using either EEK or OTL (or with any other program I have tried). My PC freezes during any scan and I have to hard boot, although I can complete scans in safe mode.

Any help would be much appreciated thanks.

JPG.IframeREf!E2 removal?

Sat, 25 Feb 2012 21:39:16 +0000

Ok, so I followed the "Start Here or we..." page and downloaded the Emsisoft Emergency Kit (EEK) and OTL by OldTimer. I ran the EEK and did the Smart scan as directed. It took a while to run and it did NOT find the JPG.IframeRef!E2 problem!

I did get the Extra.note and OTL.note logs but not the EEK.log, because one was not made, I presume because the EEK did not find the problem.

I have Emsisoft 6.0.0.57 installed on my computer (Windows 7 - 64 bit) and when I run it, it finds the JPG.IframeRef!E2 and says it is a High risk. When I click on it, it takes me to Emsisoft's web site with instructions on how to remove JPG.IframeRef!E2 and all I have to do is buy Emsisoft Anti-Malware! I already have a license for EAM software and it exspires in 300 days - don't need to buy it again.

I have (2) questions:
1. Why did your EEK software not find the JPG.IframeRef!E2 during its long scan?
2. Why does my EEM software (6.0.0.57) not remove the JPG.IframeRef!E2 as the Emsisoft web site says it will do?

This is what my EEM Diagnosis states:
JPG.IframeRef!E2
+ Rootkits:c:\windows\system32\drivers\mpio.sys

When I try to delete it, a message pops up saying Windows cannot delete root kits (See Attached .jpg screen shot) and directs me to Emsisoft forums. C:\Windows\System32\Drivers\mpio.sys - Rootkits can't be removed automatically. Please consult the experts in the Emsisoft online forum for help with manual removal of this Malware: http://support.emsisoft.com

I have attached, per the Emsisoft forum requirements, (3) files
1. OTL.notes
2. Extra.notes; and
3. My EEM scan log a2scan_120225-160534.txt

In additon to the (3) files listed above, I have added a .jpeg file showing my EEM scan window with the diagnosis.

I hope you guys can help me out.

Thanks
capgun56

Attached Thumbnails

Attached Files

OTL.Txt 82K 22 downloads
Extras.Txt 79.2K 25 downloads
a2scan_120225-160534.txt 734bytes 25 downloads

Trojan.Win32.Qhost!E2

Fri, 24 Feb 2012 08:35:53 +0000

Good day! help on how to remove this virus Trojan.Win32.Qhost!E2 ??? the program Emsisoft Anti-Malware writes that can not delete it! help please

Emsisoft Internet Security Pack places first in comss.ru comparison

Mon, 20 Feb 2012 16:11:52 +0000

The highly accredited Russian IT platform comss.ru has recently published a dynamic test of Anti-Virus products which will be repeated monthly. Testing in February 2012 was conducted in virtual machines running Windows 7 x86 SP 1 with 500 samples of real threats, collected on the Internet. The dynamic test involves checks during unpacking an archive, on-demand scanning and executing files. Anti-Virus programs and their components have been configured for optimum protection.

The Emsisoft Internet Security Pack has received the Virusovnet High + award for the best detection rate from all of the test objects. This latest victory once more shows that the Emsisoft products stand out with their top detection rate and are capable to secure everyone’s computer reliably.

These are the complete test results with the overall detection rate in percent:

View the full article

Oddly Specific Facebook/Wordpress Redirect

Fri, 17 Feb 2012 16:24:34 +0000

We have a self-hosted Wordpress blog that we use as a Web site for our non-profit organization (http://laundrybasketsfulloflove.org). We also have a Facebook fan page for the same organization, and we have a FB app named RSS Grafitti that automatically pushes posts to the Wordpress blog to the Facebook fan page.

Everything has worked fine for about a month until this week, when an oddly specific redirect began happening.

My sister, who lives across the state and runs the non-profit, contacted me that she was having some problems with links onthe Facebook fan page when trying to visit the site. I went to the FB page and got the same result that she described:

When we click on a link to our site URL in a post (whether is was posted via RSS Grafitti or manually), the status bar shows the proper URL, but the browser address fluctuates and eventually takes us to one of several spam/malware sites, such as:

hxxp://www2.powertdc...%2B4727087H09qe
monkeyball.osa.pl

If we type the URL in the address bar of a browser, we can get to the site successfully.

If we post the URL to another web site on the FB fan page, we can click it and get to that site properly.

It ONLY happens when we click a link to our organization's site from Facebook.

I've run deep scans with about 10 virus/malware products (including Emsisoft Anti-Malware) and although a couple reported a moderate threat object and cleaned or deleted it, the problem persists.

Many supposed windows temp 0000000xxxxxxxxxx.av$ detections for many days?

Wed, 15 Feb 2012 09:46:12 +0000

Many supposed windows temp 0000000xxxxxxxxxx.av$ detections for many days?

Can that be right? They seem possibly to be antivirus definitions?

C:\windows\temp\00000008-ef6cecbb.av$

C:\windows\temp\00000008-f2d92057.av$

These are just two recent examples of many many more that have occurred.

always in the windows temp folder, always 0000000xxxxxxxxxx.av$ sort of file

Also for several days another thing happening many times repeatedly:

Malware removal notification.
Some infections could not be removed. It is required to reboot the PC in order to remove them completely. Do you want to reboot the PC now?
Restart computer Don't show again

That has happened many times over the past several days, and Yes, I have done many restarts, with that persisting and recurring.

Any ideas or help please? Thank you.

(I am about to run the scans Emergency Kit and OTL to post the logs)

Rootkit Trojan Can't be Automatically Removed

Tue, 14 Feb 2012 19:15:29 +0000

Here are the reports.

Also, received error report that C:\$mft is corrupt

Attached Files

a2scan_120212-201013.txt 46.32K 23 downloads
a2scan_120212-113509.txt 1.08K 32 downloads
Extras.Txt 63.67K 20 downloads
OTL.Txt 139.48K 22 downloads

my pc always crash

Tue, 14 Feb 2012 19:07:26 +0000

my laptob is always crash

Moderator Note: Please do not paste logs into a forum post. It makes navigating your forum topic easier if you attach them. Please click the "More Reply Option" button in the lower-right corner to be presented with controls for attachments.

Rootkit.win32.Phar!E2 Help!

Tue, 14 Feb 2012 00:17:05 +0000

Got the rootkit physical drive 0 issue. Followed directions as instructed. Please inform me on what to do next. Thanks.

Attached Files

a2scan_120213-173427.txt 19.35K 25 downloads
OTL.Txt 99.61K 15 downloads

Keep getting the same traces in every scan even after quaratining or deleting

Mon, 13 Feb 2012 18:50:10 +0000

Keep getting the same 36 Free Majong traces every time

Attached Files

OTL.Txt 119.67K 18 downloads
a2scan_120209-182553.txt 20.99K 28 downloads
Extras.Txt 60.68K 23 downloads

Follow up from original post that got closed

Sun, 12 Feb 2012 22:44:40 +0000

MY PC is infected and I need assistance. It's a virus that tries to open my thunder bird email with a false certificate and send spam out using my contacts list. Attached are the files requested in the starting point instructions. Please let me know what the next steps are. Thanks! a2scan_120212-152251.txt 34.41K 29 downloads Extras.Txt 62.3K 18 downloads OTL.Txt 106.98K 21 downloads

cloud av 2012

Sun, 12 Feb 2012 18:56:49 +0000

I have the cloud 2012 virus, after a scan i found out that i have rootkits too. I have scanned with OTL but didnt get the extras.txt log.

Any help would be appreciated. Thanks

Attached Files

a2scan_120212-173353.txt 1.58K 33 downloads
OTL.Txt 57.81K 28 downloads

Emsisoft Internet security pack

Sun, 12 Feb 2012 07:27:37 +0000

here is the result of the test

Attached Files

Emsisoft Anti-Malware and Online Armor test.txt 2.3K 55 downloads

Virus.Win32.Tdss!E2

Sat, 11 Feb 2012 18:17:01 +0000

Need to remove a rootkit virus Virus.Win32.Tdss!E2. This was detected during Deep Scan. It was not detected during the Smart Scan.

Attached Files

Extras.Txt 31.4K 17 downloads
OTL.Txt 50.91K 22 downloads
a2scan_120211-082322.txt 1.19K 16 downloads

Not again?!?

Fri, 10 Feb 2012 20:24:04 +0000

It seems I just finished getting the Trojan crypt off my computer ( link to that thread) and now I have another rootkit showing up in my emsisoft scan. ugh ugh ughhhhh

I don't know, maybe they are getting on the computer when I use google chrome? Seems like that was the browser I was using the other day when I got trojan crypt, and now today was using it again.... grrr...

I attached scans. to get started..

Working on the Emergency kit scan, but it's taking a while. will upload when done.

Attached Files

OTL.Txt 103.38K 21 downloads
emsisoft scan.txt 864bytes 24 downloads

Trojan-Dropper.Win32.Sirefef!E2

Fri, 10 Feb 2012 09:32:15 +0000

Hello everyone. I have a big problem with persistent trojans. I had run MalwarBytes and Ad-Aware, but the trojans appears again and again. I've installed Emsisoft Anti-Malware and it found 7 trojans. I took them to quarantine, but it wasn`t possible to take one of them: Trojan-Dropper.Win32.Sirefef!E2

When I've tried to take it to quarantine, the software told me "C:\Windows\System32\Drivers\tdx.sys - Rootkits can't be automatically removed. Ask to http:/support.emisoft.com"

I have followed the instructions in the "START HERE" section of the forum, attaching the required files.

Thank you very much.

Attached Files

OTL.Txt 290.44K 168 downloads
Extras.Txt 64.07K 27 downloads
a2scan_120210-014208.txt 6.4K 28 downloads

PC Keeps Turning Off During Full Scan

Thu, 09 Feb 2012 01:11:48 +0000

I have EmsiSoft Anti-Malware running on Full Scan and keeps turning off my computer 1/2 way through. I can't even see which file it stops on before the PC powers off. I'm running Windows 7 Ultimate 32 bit OS, Service Pack 1, Intel Pentium R 3.8 mhz, 3 gb memory. Updated EmsiSoft Antimalware to the latest updates.

Please help!

Attached Files

OTL.Txt 33.26K 21 downloads
Extras.Txt 17.01K 22 downloads
a2scan_120208-172309.txt 956bytes 21 downloads

Someone is hacking me

Wed, 08 Feb 2012 20:28:37 +0000

a2scan_120208-194913.txt 7.31K 27 downloads OTL.Txt 71.79K 22 downloads Extras.Txt 28.26K 23 downloads

cannot clean infected PC

Wed, 08 Feb 2012 11:31:09 +0000

Did deep scan and could not quarentine most of trojans
Log attached/Also attached EEk log,OTL.txt & Extra.txt.
Help to clean appreciated.

Attached Files

a2scan_120207-171928.txt 1.12K 17 downloads
OTL.Txt 171.47K 20 downloads
Extras.Txt 43.18K 18 downloads
Emsisoft scan7.2.12.rtf 5.13K 21 downloads

Rootkit found

Tue, 07 Feb 2012 23:19:41 +0000

C:\WINDOWS\System32\Drivers\WRkm.sys Emsisoft Anti-Malware says that Rootkits can't be removed automatically. Please the experts
in the Emsisoft forum. Are are the prescribed files:

< INLINE LOGS REMOVED BY MODERATOR >

Virus Controls Keyboard and Disables Asquared

Tue, 07 Feb 2012 17:11:33 +0000

I'm sorry if someone has already posted something like this before, but I couldn't find one. So, a Windows XP computer got the "System Check" virus which was removed. Asquared Anti-malware and Online Armor werer then installed on the computer. After a hour or so whenever I would go to the taskbar to the start menu, clock, etc. the mouse would select something immediately and open it. When the computer was connected to the internet, Firefox would go to random pages constantly. I also noticed that Asquared's guard and the firewall was off and I couldn't turn it back on. (The computer was not connected to the internet at this point) I ran a deep scan with Asquared and nothing came up. I restarted the computer and the blue screen of "Disk Check" came up. (Didn't before) But before I could do anything, after about 3 seconds a "key" was pressed to stop the disk check. I didn't press anything on the keyboard. I knew it had to be some form of Malware. I tried pressing F8 to get into safe boot BUT when I get to the screen it would show up for a second then "Start normally" would be highlighted and selected. I tried different keyboards and it happened. I couldn't open anything because it would be closed, and I could only start the Task Manager. I didn't see anything out of the ordinary in processes but cpu and memory were at 100% used...and nothing was running.

Anyways, eventually I booted into safemode (By starting 'msconfig') and the problems persisted. I finally removed the "Virus" by finally getting asquared's guard to start again in safe mode. I ran a deep scan and this time a few "medium" level trojans were found. I can't remember what they were (I'm not going to work on the computer again till this Saturday) but they did consist of "DX" in the name and they were .exe. I removed them but the computer was still sluggish and firefox and other programs wouldn't run. I ended up manually going to the .temp folder where Asquared found the medium level trojans and moving ALL of them to Asquared's quarantine. (There were many more malicious sounding names in notepad files and .exe's that asquared didn't find anything bad in) After deleting them in Asqaured the compuer was fine again. NOTE: I tried running TDSS Killer and it wouldn't start.

I want to know if anyone knows what this virus is and why asquared was disabled and couldn't find them. Also, did this virus have to do with System Check? Thank you for your time and sorry if someone has posted this before.

Oh! And also is it possible this virus could come back again if the computer was connected back to the internet? (Since Asquared and the firewall were disabled by it.)

Firefox; Google redirect - virus in user32.dll

Tue, 07 Feb 2012 16:00:08 +0000

Hi,

Been having this problem for a while...tries various solutions. No fix.

At least Emisoft Anti-Malware detects and quarantines files, but the problem persists.
"C:\WINDOWS\SYSWOW64\USER32.DLL Quarantined by rule Virus.Win32.Bamital.AMN!E1"

Best Regards,

aklimamba

Attached Files

a2scan_120207-150237.txt 1.24K 19 downloads
Extras.Txt 32.94K 34 downloads
OTL.Txt 55.7K 16 downloads