Problems after downloading AVG

[Horrawr]

I downloaded the latest version of AVG directly from the main site, and apparently it came loaded with different viruses and trojans. I downloaded different programs such as Superantispyware, Malwarebytes Anti Malware, and Quick Virus Remover, and they've all picked up and apparently destroyed something. Although this is the case, the problems I've been having included my antivirus (Norton Antivirus) refusing to run and any connectivity for any source of protection program isn't happening, causing them to not be able to update. I've taken the steps that were explained in this thread http://extremetechsupport.com/forum/malware-removal-av-firewalls-etc/7384-rootkit-removal.html however I believe they can't really help me since this virus/trojan/whatever is blocking these security programs. I've asked for help in different places and have received none whatsoever, so i'd appreciate it if someone could help me out here.

[RandyL]

Hi Horrawr;

 

The AVG downloads from AVG are clean. You would not have got infected from there. If you got AVG from P2P or torrents then that could be a problem.

 

Follow the guide exactly as listed. You already said you installed Malwarebytes and Superantispyware and ran them. It seems you can't connect to their sites to update them however.

 

Download and burn to disk or a thumbdrive the updates on another computer. You can then install the updates to your computer.

 

Malwarebytes Updates.

Superantispyware Updates.

 

If need be you can run the scans in safemode.

 

Pay close attention to all the instructions including temporarily disabling any AV and clearing your System Restore points. Note also to reboot as instructed. Follow the guide to it's end before doing anything else with your computer.

 

If anything is found let us know what it is.

 

Also what other symptoms are you experiencing?

 

Let us know how it goes please.

[Guest Wolfeymole]

Let me get this right, you downloaded AVG and ran it alongside Norton, would that be correct or have I misread?

 

If this is correct allow me to explain that you cannot run two anti virus applications at one time.

 

Uninstall AVG and update Norton and then consider what we recommend here.

 

http://extremetechsupport.com/forum/malware-removal-av-firewalls-etc/3597-free-pc-help-recommended-security-products.html

 

Note that Norton is not amongst them.

[Horrawr]

That's correct, didn't really think about that when I got AVG. The thing is, the viruses were only detected by Windows after AVG was installed, and I downloaded it straight from the main site. More sites are also being blocked, such as email sites, and at times, the BSoD decides to show itself. I'll get those updates and tell you how it goes. And on startup, Norton won't run, saying it can't load various .dlls Edited July 16, 2009 by Horrawr

[Guest Wolfeymole]

To be perfectly frank here Horra I'd uninstall Norton also and use a better anti virus.

 

If you want to then choose one from the list I provided and download it, do not run it yet.

 

Uninstall AVG if not done so and also Norton.

 

Norton Removal Tool here.

 

Download and run the Norton Removal Tool

 

Search for all remnants of AVG and delete them.

 

Then install the new AV.

[Horrawr]

I'll do that, pretty sure I've already gotten rid of AVG already. I've gotten the updates, but apparently they're not working. After installing the MBAM updates, it won't run, saying the database is outdated, and the updates aren't showing for SAS. The core and trace numbers are still the same as they were before. Edited July 16, 2009 by Horrawr

[Guest Wolfeymole]

Your obviously riddled with trash here Horra so I'll ask if you have your XP disk to hand.

[Horrawr]

The SAS Update just worked, can't say the same for MBAM. The computer came with XP, so I doubt I'll find/have the CD lying around.

[Guest Wolfeymole]

SAS and MWB are only good for getting shut of surface stuff, we need to concentrate on the virus side.

 

What make is your box as you may have an option to take it back to factory condition.

[Horrawr]

This is an eMachines T3985.

[Guest Wolfeymole]

eMachines jeez, cheapo tackle with naff support.

 

Sorry to say mate.

 

To get some recovery disks look here.

 

https://secure.tx.acer.com/RCDB/Main.aspx?brand=emachines

[Horrawr]

Damned thing won't register. Guess I'll have to call support and see if they could help with the CDs.

[Guest Wolfeymole]

Please let us know what happens as your information will be invaluable for future members with this issue.

[Horrawr]

Alright, the MBAM guys got back to me, and I think their solution might solve my problem since it's something I haven't tried. They've identified the threat as the CLB Rootkit infection aka WinNT-Alureon and suggested I try the program RootRepeal. After fiddling with the settings for a bit since it wouldn't work immediately, I've found the .sys file that's been supposedly causing the problems. If it works right, I should be able to run the programs right, update, and do a full scan. I'll drop another message if it works.