malwarebytes not finding malware, issues with running scan and bluescreen

Fiery said:
Your Appdata folder is a hidden folder. To access it, you will need to enable "Hidden files and Folders". It is not a folder you should not be accessing since there isn't any useful files there. If however you want to access it, click Start > Computer > organize > folders and search option > view > Show hidden files and folders > Ok

Right click the tool you just downloaded and select "Run as Adminastrator."
Click to expand...

yeah, i knew to click view hidden files.. i didnt see the option.. but its ok, i can wait on that was just trying to send u the log thinking it was useful, but since i am dl'ing a diff tool, lol, i guess it isnt useful to you :P
 
Gbaby614 said:
well it is scanning before i could disconnec, i will rerun it again after it stops if u would like, i tried to wait for an answer to the last question not knowing it was going to begin immediately after clicking Y, so im still here til it is done, then i will disconnect and try to scan again.. sorry.. i knew i would make an error sooner or later :|
Click to expand...

That is fine, if the tool doesn't find anything, you won't have to do another scan with it.

Proceed to the ESET scan if AVG finds nothing.
 
AVG didnt find anything.. maybe bc I am connected to the internet, bc we both know its there, but Eset is running, i had to restart it bc i forgot to disable my AV, i must be tired..lol.. but i will hang in there as long as you continue to help me, i would love to finish this tonight, i wont sleep well knowing it is there..
 
ESET will take a long time. We can continue tomorrow as I have to sleep soon.

May I know which Combofix link you used? (There were 2). Also, when we ran combofix for the second time, it didn't prompt to update right?
 
I can't remember which one, i know the scan we did earlier told me that it was infected so i will go back and check, let me see real quick if the one on my pc says the location: its saved to desktop, file description is combo fix NSIS Installer type application file ver 13.1.29.1 copyright sUBs size 4.86mb date mod 1/29/2013 10:12am lang Eng... and the scan is 1/2 done so it may not be much longer, if you need to leave just msg me when u do so i know u are gone.. but i know one of the combofixes did ask and one didnt ask to update but i didnt update the one that did if i remember correctly.. hopefully the info i posted is what u needed, if not tell me what to look for and i will send it.
 
i thought i just saw a combofix.ink but after i closed the properties and searches for other links that one isnt where i thought it was, not sure if that helps but i dont have access to the actual link that i clicked, just know i always choose blinkingcomputer links over others
 
Ok, the info does help. At this moment, the whole situation is still being investigated by the author so details are sketchy. When new info surfaces, I can use it to see if there are any implications.

Don't be too worry about your system. If Sality is currently active, you wouldn't be able to use .exe files. As I said before, this virus is extremely old, AVG and ESET would definitely detect and remove it.
 
ESET has found the threat although the scan is still going, it is the one i posted earlier.. Win32/Sality.NBA virus..
 
Gbaby614 said:
ESET has found the threat although the scan is still going, it is the one i posted earlier.. Win32/Sality.NBA virus..
Click to expand...

That is probably the combofix installer. You can drag it to the recycle bin now.
 
I'm head to sleep now, I will check back in the morning. After the ESET scan, I would like a more in-depth look at your current system.

Download OTL by Old Timer from here and save it to your Desktop.
  • Double click on OTL.exe to run it.
  • Click the Scan All Users checkbox.
  • Change Standard Registry to All
  • Check the boxes beside LOP Check and Purity Check
  • Click on Run Scan at the top left hand corner.
  • When done, two Notepad files will open.
    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized
  • Please attach the contents of these 2 Notepad files in your next reply.

If you don't know how to attach the files, please follow the instructions here: http://malwaretips.com/Thread-How-to-use-the-attachment-system?pid=16072#pid16072
 
I dragged the icon to the trash.. what's next? lol if I delete the contents is that gone, or should I re-scan the drive.. it will take abt 45 mins er so..
 
Gbaby614 said:
I dragged the icon to the trash.. what's next? lol if I delete the contents is that gone, or should I re-scan the drive.. it will take abt 45 mins er so..
Click to expand...

ignore this msg, i see the instructions now.. i never got aanything back after i asked about dragging it, so i must be on a delay bc of this virus.. reading ur instructions now...
 
Here are the Logs, I did not see OTLListIt but I did find OTL I think it is the one you need....
 

Attachments

also I wanted to mention.. the popups were still occurring as of yesterday.. I do not know what program is causing these.. one is a "war" tune??? maybe.. I know its the least of the worries but wondering if these scans show what is causing these popups on firefox.. the others are nysx1 or something like that.. maybe a browser hijacker?? my browser wasnt changed i just cant sstop these popups..
 
If you have msg'd me, I have not recv'd it.. I dunno why my pc is not updating the site responses.. will keep trying back..
 
Hi,

Sorry i haven't replied yet, i have been sick (vomitting and fever for the past day). My colleague Kuttus will be working on your case :)

Fiery
 
ok, I am really sorry you are not feeling well, I hope you are feeling better soon! I will wait for them to reply.. thanks again for your help!;)
 
Hi Gbaby614,

Thank you for your patience. Please try the following steps...

STEP 1: Clean your temporary files to gain more hard drive space and remove the junk files
<ol>
<li>Download Ccleaner from the below link:
CCLEANER DOWNLOAD LINK</a> <em>(This link will automatically download Ccleaner on your computer)</em></li>
<li>Install Ccleaner by following the prompts</li>
<li>Start Ccleaner and the following should be selected by default, if not, please select:
<img src="http://i52.tinypic.com/4l5a4i.png" alt="Posted Image" /></li>
<li>Click <img src="http://i56.tinypic.com/16jox2o.png" alt="Posted Image" /> and choose <img src="http://i40.tinypic.com/5x3nu8.gif" alt="Posted Image" /></li>
<li>Uncheck <img src="http://i51.tinypic.com/amuvj8.gif" alt="Posted Image" /></li>
<li>Then go back to <img src="http://i41.tinypic.com/2jb4qyb.gif" alt="Posted Image" /> and click <img src="http://i25.tinypic.com/nf47ev.gif" alt="Posted Image" /> to run it.</li>
<li>Exit CCleaner.</li>
</ol>




STEP 2 : Run a scan with Kaspersky TDSSKiller
<ol>
<li>Download Kaspersky TDSKiller from the below link.
<><a title="External link" href="http://support.kaspersky.com/downloads/utils/tdsskiller.exe" rel="external">KASPERKSY TDSSKILLER DOWNLOAD LINK</a></> <em>(This link will automatically download Kaspersky TDSSKiller on your computer)</em>
</li>
<li>Double-click on <>TDSSKiller.exe</> to run the application.
<img src="http://img4.imageshack.us/img4/1907/tdss1.png" alt="Posted Image" /></li>
<li>Click <>Change parameters</>
<img src="http://img593.imageshack.us/img593/288/tdss2.png" alt="Posted Image" /></li>
<li>Check the boxes next to <>Verify Driver Digital Signature</> and <>Detect TDLFS file system</>, then click <>OK</>
<img src="http://img521.imageshack.us/img521/1456/tdss3.png" alt="Posted Image" /></li>
<li>Click on the <>Start Scan</> button to begin the scan and wait for it to finish.
<>NOTE:</> Do not use the computer during the scan!</li>
<li>During the scan it will look similar to the image below:
<img src="http://img6.imageshack.us/img6/9136/tdss4.jpg" alt="Posted Image" /></li>
<li>When it finishes, you will either see a report that no threats were found like below:
<img src="http://img696.imageshack.us/img696/9898/tdss5.jpg" alt="Posted Image" />
If no threats are found at this point, just click the <>Report</> selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved.</li>
<li>If any infection or suspected items are found, you will see a window similar to below:
<img src="http://img854.imageshack.us/img854/905/tdss7.jpg" alt="Posted Image" />
<ul>
<li>If you have files that are shown to fail <em>signature check</em> do not take any action on these. Make sure you select <>Skip</>. I will tell you what to do with these later. They may not be issues at all.</li>
<li>If <em>Suspicious objects</em> are detected, the default action will be Skip. Leave the default set to Skip.</li>
<li>If <em>Malicious objects</em> are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects
Make sure that <>Cure</> is selected. <>VERY IMPORTANT!</> - If <em>Cure</em> is not available, please choose <>Skip</> instead. DO NOT choose Delete unless instructed to do so.</li>
</ul>
</li>
<li>Click <>Continue</> to apply selected actions.</li>
<li>A reboot may be required to complete disinfection. A window like the below will appear:
<img src="http://img828.imageshack.us/img828/4812/tdss6.jpg" alt="Posted Image" />
Reboot immediately if TDSSKiller states that one is needed.</li>
<li>Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like <>TDSSKiller.2.1.1_2.12.2012_14.17.04_log.txt</> which is based on the program version # and date and time run.</li>
<li>Attach this log to your next reply.</li>
</ol>
<hr />
 
Last edited by a moderator:

You may also like...