woofdawg23

Man I really need help removing this! My friend came over friday or somthing, and got me this virus! Here's some info about the virus.

File Locations:

16329684.exe - C:\Documents and Settings\All Users.WINDOWS\Application Data\16329684
svchust.exe - location is system32
isvchost.exe - location is system32
sv1.exe - location is system32
sv3.exe - location is system32
msa.exe - location is unknown
c.exe - location is unknown

File Behaviors:

16329684.exe - not sure
svchust.exe - unkown
isvchost.exe - If not ended on startup, will disable the opening of all .exe files, but if deleted, restores itself if computer is restarted
sv1.exe - unknown, but if deleted, restores itself if computer is restarted
sv3.exe - unknown, but if deleted, restores itself if computer is restarted
msa.exe - Starts on startup, and if closed through task mgr, starts up in background again, but if deleted, restores itself if computer is restarted
c.exe - Starts on startup, and if closed through task mgr, starts up in background again, but if deleted, restores itself if computer is restarted




Symptoms/Behaviors:

Creates porn links on my desktop sometimes

Infects your google page and any other search engines and gives a fake alert message saying somthing like "Your system is infected, click here to fix"

Whenever you try using any anti-malaware, examples, malawarebytes anti-malaware, SuperAntiSpyware, and spybot search and destroy, it installs, then whenwhen try a scan, it closes, and when you try re-opening the program, it says "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access this item."

Changes your background somtimes and says in red text Virus Detected or somthing similar to this.

Disables the access to any anti-virus websites, examples: mcafee, norton, nod32, malawarebytes, etc.

Redirects your google results

SOmebody please help me remove?

woofdawg23

bumpbbbbbbbb

forhockey

Hi woofdawg23,

If you still require assistance and are not seeking help elsewhere, then please carry out my instructions.

Please subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Add Subscription.

** Note: Please stick with me until I declare that your system is free from malware. Even though your system may not have any symptoms of malware, it may still be infected. **

--------------------------------------------------------------

Download and run Win32kDiag:

1. Download Win32kDiag from any of the following locations and save it to your Desktop.
   • Download Win32kDiag (Win32kDiag.exe) - #1
   • Download Win32kDiag (Win32kDiag.exe) - #2
   • Download Win32kDiag (Win32kDiag.exe) - #3
2. Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
3. When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.
4. Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic.

Next

Please download Sysprot Antirootkit from >>>HERE<<<

Unzip it into a folder on your desktop.

• Double click Sysprot.exe to start the program.
  
• Click on the Log tab.
• In the Write to log box select ALL ITEMS
• Look near the bottom left, and Check Hidden Objects Only
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to.
  
• Open the text file and copy/paste the log here.

forhockey

If you still require assistance, then please PM a moderator to have this thread reopened.