[KajiVenator]

My computer has it (I believe). I keep getting all these pop-ups regarding it and I did get the porn links on my desktop.

Try to run MBAM and it will scan but after the scan finishes and it tells me to click OK and Show Results, it closes without creating a log file.

Help!

And quickly! D:

Edited by KajiVenator, 20 September 2010 - 07:15 AM.

[Advertisements]

Great... my comp shut down because system files were corrupted and now I can't get back to my desktop. I'm on my phone right now but CAN I GET SOME HELP?

[KajiVenator]

Great... my comp shut down because system files were corrupted and now I can't get back to my desktop. I'm on my phone right now but CAN I GET SOME HELP?

[KajiVenator]

In the admin account of my comp, I was able to get mbam to work fully. Log below.

Spoiler

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

9/18/2010 5:50:24 PM
mbam-log-2010-09-18 (17-50-24).txt

Scan type: Quick scan
Objects scanned: 130637
Time elapsed: 10 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\PRAGMA (Rootkit.TDSS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus (Rogue.AntiVirus) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\etapon (Trojan.Agent.U) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Windows\PRAGMAtiluidnohe (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
C:\Windows\PRAGMAtiluidnohe\PRAGMAc.dll (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Windows\PRAGMAtiluidnohe\PRAGMAcfg.ini (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Windows\PRAGMAtiluidnohe\PRAGMAd.sys (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Windows\PRAGMAtiluidnohe\PRAGMAsrcr.dat (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Users\The Wirth Way\AppData\Local\Temp\PRAGMA9d07.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Users\The Wirth Way\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antivirus.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.
C:\Users\The Wirth Way\AppData\Local\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\The Wirth Way\AppData\Local\iqusixaxeteted.dll (Trojan.Agent.U) -> Delete on reboot.

Did another scan and got

Spoiler

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

9/18/2010 9:40:32 PM
mbam-log-2010-09-18 (21-40-32).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 279108
Time elapsed: 2 hour(s), 35 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I still get the warnings that my comp is at risk and the virus disabled my use of my usb keyboard (not my mouse) and the use of tskmgr.exe on non-admin accounts.

Help?

Edited by KajiVenator, 18 September 2010 - 10:59 PM.

[KajiVenator]

The beginning of day 2 with the trojan. Sorry for the quadruple post. I just want use of my keyboard back D: