7 replies to this topic

[jklotz]

HELP, I have been infected!! Started with the Windows 7 Security 2012. I could not do anything on the machine - particularly getting on the internet - without a pop-up coming up saying that I needed to activate Windows 7 Security. This has gone away and I believe that I am infected with ping.exe. Symptoms include being redirected to web pages/sites that I did not specifically go to, clicking on a link when doing a Google search and being redirected to another site instead of the link I clicked on and ping.exe continually shows up in services and the resource monitor. I can suspend the service but it will restart itself.

I have downloaded Combofix and rkill and tried to run both in safe mode. rkil will complete, but does not list any applications that it has stopped. Combofix reports that Trend Micro antivirus and antispyware are running. This is a corporate machine for work. I cannot unload Trend as I do not have a password for it. I used msconfig and unchecked the boxes for Trend under services and the 1 entry under startup, but Combofix still reports that it is running. Is it safe to proceed with Trend still running? Just downloaded gmer, DDS and aswMBR, but have not done anything with them as I cannot seem to get Trend Micro stopped.

Any suggestions would be greatly appreciated!!!!!

Thanks Jeff

[Broni]

Welcome aboard

When you started new topic there was a message:
Before creating any topic in malware removal forum make sure you read THIS first!!!
That would be this: http://www.smartestc...ease-read-this/

Never run Combofix on your own.

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
  
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
  
• Please refrain from running tools or applying updates other than those I suggest.
  
• Never run more than one scan at a time.
  
• Keep updating me regarding your computer behavior, good, or bad.
  
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
  
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
  
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

[jklotz]

Broni,

I read the "Read this first" topic and that is when I downloaded Combofix and tried to run it as per the instructions. This issue I am having is that this is a corporate laptop and Trend Micro antivirus and antispyware are installed. I cannot unload or stop them because it is password protected by corporate IT and I do not have the passwords. Is this something that can be worked around or should I leave it up to the corporate IT group to fix?

Jeff

[Broni]

There is NOTHING in those instructions about Combofix.
Please re-read.

[jklotz]

you are right, my bad. Got that post mixed up with another one I had found. I will follow the instructions for Malwarebytes, gmer, aswMBR and DDS. When finished and I reply, should I post all of the log file results in the 1 reply, attach them as files or reply with separate posts for each of the log files?

[Broni]

All logs have to be pasted. They should fit in one reply.

[jklotz]

Thanks Broni. Found out from the support folks at work this afternoon that they have sent me a disk to wipe the machine and re-image. Should arrive tomorrow morning, so I will go that route to start with since it should insure that I get a clean machine with all of the corporate software intact. If that does not work, I will be back. Like the site and forums - a wealth of knowledge!

[Broni]

Good luck then :)