1.

Solve : Computer help after virus?

Answer»

I got the "win 7 Internet security" virus on my vaio laptop and after doing some research online I used malwarebytes anti-virus to remove it and I think it's gone because I don't get the annoying pop ups anymore anyways after removing the virus, I can't open anything anymore because it wil either have an error or the "open with" box wil appear.  the only way I can open something is if I run it as administrator. Please help me with how to fix thisFirst things first - let's make sure that you are virus free.  Go HERE, follow the directions EXACTLY and post the requested LOGS in a new thread of that FORUM.i did all the six steps and this is what i came up with. the log for superantispyware is

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/23/2010 at 08:22 PM

Application Version : 4.46.1000

Core Rules Database Version : 5907
Trace Rules Database Version: 3719

Scan type       : Complete Scan
Total Scan Time : 01:53:06

Memory items scanned      : 761
Memory threats detected   : 0
Registry items scanned    : 13566
Registry threats detected : 19
FILE items scanned        : 199074
File threats detected     : 34

Adware.Gamevance
   (x86) HKLM\Software\Classes\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}
   (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}
   (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}
   (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32
   (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32#ThreadingModel
   (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID
   (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\Programmable
   (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib
   (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID
   (x86) HKCR\GamevanceText.Linker.1
   (x86) HKCR\GamevanceText.Linker.1\CLSID
   (x86) HKCR\GamevanceText.Linker
   (x86) HKCR\GamevanceText.Linker\CLSID
   (x86) HKCR\GamevanceText.Linker\CurVer
   (x86) HKCR\TypeLib\{014C4232-6904-47B9-9144-7E0FB7277444}
   C:\PROGRAM FILES (X86)\GAMEVANCE\GVTL.DLL
   (x86) HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser HELPER Objects\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}
   (x86) HKU\S-1-5-21-2175598002-276824424-936044750-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}
   (x86) HKCR\AppId\GamevanceText.DLL
   (x86) HKCR\AppId\GamevanceText.DLL#AppID

Adware.Tracking Cookie
   .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .atdmt.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .doubleclick.net [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .atdmt.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .imrworldwide.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .imrworldwide.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .247realmedia.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .oasn04.247realmedia.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   www.googleadservices.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .serving-sys.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .serving-sys.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .steelhousemedia.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .steelhousemedia.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   www.stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   www.googleadservices.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .tribalfusion.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .specificclick.net [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .specificclick.net [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .interclick.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .interclick.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .interclick.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ]
   .doubleclick.net [ C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Cookies ]

And the one for Malwarebytes is

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5178

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11/23/2010 8:55:21 PM
mbam-log-2010-11-23 (20-55-21).txt

Scan type: Quick scan
Objects scanned: 142464
Time elapsed: 5 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sezfile\shell\open\command\(default) (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (sezfile) Good: (exefile) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\Owner\Local Settings\Application Data\opRSK (Malware.Trace) -> Quarantined and deleted successfully.

The log for hijackthis is

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:27:30 PM, on 11/23/2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\sniper.exe\sniper.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" Quote from: Quantos on November 23, 2010, 11:03:55 AM

and post the requested logs in a new thread of that forum.
Nobody ever listens to me.oh yea after i did all this stuff my computer seems to be working normally again! please let me know what else i need to do and if i need to delete all the stuff that i installed. A greatly appreciate your help thanks


Discussion

No Comment Found