Today [2]

[Lorien]

Sitting in a car with the laptop battery getting lower and lower! When you see me "pop" offline, you will know what has happened! lol

Don't they sell converter/adapters you can plug into the cigarette lighter to not only avoid the problem but even recharge the battery at the same time? While I have two batteries, I still need to shutdown to change them (on those rare times when I'm actually using the battery other than for simple battery maintenance).

 

[roy69]

Well done Smurfyy in getting a better resault on your exams.
Hope the new medication helps Lorien.
Today I have to pick up my step daughter and step grandson who are staying for a couple of days.
It is cold here but not alot of snow at the moment so the drive should be OK.
I will probably end up in the pub today.

 

[niemiro]

Actually, there is just enough to get home on by the looks of things. I do have an inverter and a charger, and another laptop (or should I say that I borrow my father's sometimes!) It was an unexpected detour in the car, hence being unprepared. Now I have two laptops, two chargers, two batteries, one inverter, and one socket. Should do me for a few hours! lol

 

[Smurfyy]

Thanks for the congrats Chase + Roy
Today I've come home early from school, just feel really ill...
It's just started to show - Heavy, hopefully It'll stay .

Also trying to remove a virus from my netbook, Olmarik trojan or something, it's being awkward, MBA can't find it, and NOD32 finds it, but can't remove it...
I'll try some more, then I'll start a thread about it...

 

[Lorien]

Also trying to remove a virus from my netbook, Olmarik trojan or something, it's being awkward, MBA can't find it, and NOD32 finds it, but can't remove it...
I'll try some more, then I'll start a thread about it...

See this article if it helps (and use the manual process, not their automated one): Remove Olmarik trojan, Win32/Olmarik removal.

To be honest, this looks like a nasty one and I'd post in the Security Forum to get help from Jacee. Put the name of the trojan in the thread title to better draw her attention.

Good luck!

 

[Smurfyy]

Thanks for the info, I think I have got rid of it, before I couldn't open MBA up, but now I can, just scanning my system over again, and NOD32 is showing that there was an attack from it... Hopefully it's gone.

 

[niemiro]

I may be wrong, but I think Olmarik infects wininit.exe and explorer.exe. It is a virulent and hard to shake Google redirect. You probably should get help with this one. Doing this off the top of my head - if I am wrong, please correct me!

 

[Smurfyy]

Hmm, if it comes back I will, for now it's not showing...
In NOD32 quarantine...

 

[niemiro]

Hmm, if it comes back I will, for now it's not showing...
In NOD32 quarantine...

My point was the normal antivirus often remove its own files, but can't handle the infected files.

 

[niemiro]

Look, do me a big favour, and upload wininit.exe, winlogon.exe, and explorer.exe to Virus Total, and post the logs here: VirusTotal - Free Online Virus, Malware and URL Scanner

Those three will cover a couple of different malware. If they come back as all clean, then I will be quiet.

Thanks!

Richard

 

[Lorien]

I may be wrong, but I think Olmarik infects wininit.exe and explorer.exe. It is a virulent and hard to shake Google redirect. You probably should get help with this one. Doing this off the top of my head - if I am wrong, please correct me!

From what I read, this one is very hard to get rid of. It adds processes, adds at least 6 keys to the registry, adds a DLL library, creates a redirect site, and adds files to \Windows and \TEMP. The files it adds include winlogin.exe (but not located in the same place but that's handled by the registry modifications which redirect to the new location). So Richard, even if you check the legitimate winlogin.exe and it comes up fine, what about the one in %TEMP%\? I think that's the one that's the problem. It also adds policies concerning System Restore (which possibly disable it or worse) and adds .bat and .dll files to %SYSTEM% which do who knows what.

Here's what it says:

The purpose of Win32/Olmarik trojan is installing malwares on an infected computer. Olmarik may secretly download and run the infections but it usually tricks people into downloading the malwares voluntarily.

Win32 Olmarik displays falsified security alerts. If clicked upon, the alerts demand downloading anti-spyware or anti-virus tools. Needless to say, reputable security software is not distributed this way. Olmarik trojan may also collect data and send it to scammers. Win32Olmarik may disable security programs in some cases.

Win32/Olmarik infection spreads via software exploits and infected websites

.

At the very least, you should try the special removal process I provided; however, even if you do that (and you really should), to be sure, I would still post in the Security Forum and let Jacee make certain you're really clean. From what you said, you didn't do anywhere near enough to truly get rid of this even though you may have recovered some lost functionality - you may have done enough to disable it, but I suspect pieces still remain and they should be removed and then Jacee will probably want a thorough scan with some special programs which I don't know enough about to suggest.

I hope this helps. It's your decision, but in my opinion (for what it's worth), you aren't fully clean of it and it appears to be one that's able to hide well from the standard removal programs. Just because your program says you were hit by this and now you're OK does not guarantee that's true. I could be wrong and maybe whatever you did was enough to permanently disable it (even if remnants remain that no longer work and serve no purpose and should be removed) - but it's better to be sure (as some parts of it may still be working and preparing to cause you harm). You don't want a program on your system that's like a magnet for other malware. I really hope you take this advice.

Good luck!

 

[Smurfyy]

Nice tool!
It's doing it now.

Okay;
Wininit.exe ; It says it's "Goodware"
Winlogon.exe ; Says it's "Goodware"
Explorer.exe ; Says it's "Goodware"

I think I done it right...

 

[niemiro]

Are there any logs? I am not too interested in goodware. Do any of the scanners detect anything. However, goodware probably means that they don't, as it is also based around MD5. I think you are alright in that respect, but I just thought you should check.

 

[niemiro]

I may be wrong, but I think Olmarik infects wininit.exe and explorer.exe. It is a virulent and hard to shake Google redirect. You probably should get help with this one. Doing this off the top of my head - if I am wrong, please correct me!

From what I read, this one is very hard to get rid of. It adds processes, adds at least 6 keys to the registry, adds a DLL library, creates a redirect site, and adds files to \Windows and \TEMP. The files it adds include wininit.exe (but not located in the same place but that's handled by the registry modifications which redirect to the new location).

Here's what it says:

The purpose of Win32/Olmarik trojan is installing malwares on an infected computer. Olmarik may secretly download and run the infections but it usually tricks people into downloading the malwares voluntarily.

Win32 Olmarik displays falsified security alerts. If clicked upon, the alerts demand downloading anti-spyware or anti-virus tools. Needless to say, reputable security software is not distributed this way. Olmarik trojan may also collect data and send it to scammers. Win32Olmarik may disable security programs in some cases.

Win32/Olmarik infection spreads via software exploits and infected websites

.

At the very least, you should try the special removal process I provided; however, even if you do that (and you really should), to be sure, I would still post in the Security Forum and let Jacee make certain you're really clean. From what you said, you didn't do anywhere near enough to truly get rid of this even though you may have recovered some lost functionality - you may have done enough to disable it, but I suspect pieces still remain and they should be removed and then Jacee will probably want a thorough scan with some special programs which I don't know enough about to suggest.

I hope this helps. It's your decision, but in my opinion (for what it's worth), you aren't fully clean of it and it appears to be one that's able to hide well from the standard removal programs. Just because your program says you were hit by this and now you're OK does not guarantee that's true. I could be wrong and maybe whatever you did was enough to permanently disable it (even if remnants remain that no longer work and serve no purpose and should be removed) - but it's better to be sure (as some parts of it may still be working and preparing to cause you harm). You don't want a program on your system that's like a magnet for other malware. I really hope you take this advice.

Good luck!

You certainly are correct. Sometimes these malware delete the dll cache version, put a new copy in dll cache, and let Windows blindly copy it into System32. However, Vista doesn't have the dll cache. Just showing you another way they do it!

 

[Smurfyy]

It's got the result column with just - in it, when I click "Show all" on the "Additional details" bar, it shows dates and related files...
Um, Malware Bytes has shown no infections.
Would it help if I post the links for the results, since you know what you're looking for, and I have no clue?
Lol, thanks for the help so far guys, appreciate it.

 

[Lorien]

I edited my original post a bit - especially the first part about what it does and what it effects. I was wrong about the file, it's winlogin.exe not wininit.exe. And I'll bet there's currently a problem with System Restore (maybe it won't restore or deleted restore points or something like that) because it messed with the policies for System Restore in the registry. I'm not sure what all the other changes do since I can't see the .bat file or .dll file in %SYSTEM% and don't know for sure how it's activating the false winlogin.exe process or redirecting to the buyanydream.biz website (but it could be happening unless the procedures to stop that (by deleting entries per the above removal instructions) are completed).

 

[Lorien]

Well, the time has finally come. THIS is post number 1500 - so the Gold Member badge is only an hour or so away depending on when the system is scheduled to update (I understand it does so about hourly). I've been waiting for this for a long time and I'm thrilled to have finally gotten here. As it is the only posting badge, it represents the pinnacle of achievement in that area (as Guru does for rep). I have no intentions of stopping now that I've passed this milestone, but I'm elated that I reached this point.

Having joined 8/31/10, it did take a bit longer to get here than I originally anticipated because of the slowdown in volume/activity - but I made it and I'm very, very happy. I plan to celebrate it somehow tonight - not quite sure how yet but it will be something special and different. And I want to take this opportunity to thank everyone who helped me get here - by assisting me with threads where I was having troubles or with a simple message of encouragement or by posting something interesting or exciting or making me curious so I posted back or sending me a message suggesting a course of action in a thread that I could then post or simply being my friend and urging me to participate as much as possible. It is all appreciated and I am very grateful.

This is another day to remember here in VF!

 

[Smurfyy]

Congrats!!
I have also managed to delete that virus. I followed the link you posted on the previous page and it seems to have worked! Thank you!

 

[Shadowjk]

Today i came back too VF I have been away in China for 2 weeks and have just come back I hope to help more now I am back

Josh

 

[Lorien]

Congrats!!
I have also managed to delete that virus. I followed the link you posted on the previous page and it seems to have worked! Thank you!

Thanks! And I'm really happy to hear that you followed that removal procedure to get rid of everything it added. I'm happy I was able to help - it was my pleasure. I would still run it by Jacee just to be sure - she's the real expert at this kind of thing and helped me when I somehow got infected (luckily it wasn't serious but she showed me a number of tehniques during the process that I now understand and can use myself - though I would never think to take on a situation like yours beyond what I already did as I am nowhere near that skilled).

Take care, my friend!