Windows Media issues help!

[Techwomen]

Okay I ran all the scans that does not recover my media files. I still need a repair on those.

Thanks

 

[XweAponX]

If Malwarebytes finds it and it keeps coming back, then it is a ROOTKIT.

Did you run the Eset Sirefef Removal Tool?

How do I remove Sirefef (ZeroAccess) trojan? - ESET Knowledgebase

RUN that!

Then download this:

Malwarebytes : Malwarebytes Anti-Rootkit

The EXE extracts it, save it to your Desktop, run the EXE and extract it to the desktop, open the MBAR folder and run MBAR.exe.

Try TDSSKILLER

TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US

Download link is after the 1st paragraph, just run the EXE file.

Finally, run GMER

GMER - Rootkit Detector and Remover

Download link is below the huge Image.

Run ALL of these, and let me know if it finds anything. A reboot may be required after each one. Let me know what EACH Program finds.

Because you still have a rootkit or Virii.

Also, do what I asked, copy your Video Files to a CD or Flash drive and try to run them on another PC or Laptop.

It's important that you take all of these steps.

 

[Wynona]

Okay it says UAC is disabled I am trying to figure out what that means.

User Account Control, I think. Most folks disable it because it's a pain in the tush. I haven't disabled mine, but I don't normally play videos on my computer either.

If you go into the Control Panel, and if "View by Category" is showing, click the down arrow and choose either Large Icons (for us older blinder folks) or Small Icons. Click on "User Accounts" and under "Make Changes to Your Account" the bottom item is "Change User Account Control Settings. Use the Slider to choose how lax or stringent you want security.

I don't see what UAC has to do with it, but as I said, I don't do videos . . .

HTH

 

[Wynona]

Aha! And now I see what UAC has do do with stuff now . . .

Proceed ahead with the good info you're getting from the pros here. I'm just adding my thoughts.

What it looks like to me is that you probably got a "driveby" that turned off UAC. I'm not inclined to think you turned it off on purpose, since you didn't know what it was. As I said in the post above, you can choose how lax or stringent your security is; if it were me at this point, I'd put my slider on the most stringent: Always notify me when something tries to make changes to my computer.

Every time I install something, UAC asks if I really want to do that.

The second setting is the default, but you may want to use the most stringent until you get things fixed.

 

[XweAponX]

That might be it, but the virus issue is still there until she does what I asked.

 

[Wynona]

That might be it, but the virus issue is still there until she does what I asked.

Absolutely, and that's why I told her:

"Proceed ahead with the good info you're getting from the pros here. I'm just adding my thoughts."

 

[XweAponX]

I always shut off my UAC, just as much as sliding the slider down to the bottom does. I can totally disable it, but then SmartScreen Filter no longer works.

If she wants she can send me a short example of one of the home moovies, and I'll check it for corruption, I promise not to look at it, just see if it plays.

 

[Techwomen]

I did run that tool below and a Trojan came up and fallowed the rules and it said it was gone but it popped up again. So I will do the rest above like you said and see if we cannot get rid of it.

How do I remove Sirefef (ZeroAccess) trojan? - ESET Knowledgebase

 

[Techwomen]

I also figured out about the UAC and already took action and it did not do a thing for my media files. So we will see if indeed it is the virus.

 

[Techwomen]

Okay I ran the Malware rookit and it said no malware found and yet AVG keeps pulling up the Trojan . So will try the other tools above.

 

[Techwomen]

Okay nothing found on TDSkiller. I am starting to think it may be AVG

 

[Wynona]

I also figured out about the UAC and already took action and it did not do a thing for my media files. So we will see if indeed it is the virus.

I didn't think UAC would do anything to resolve the situation, but instead, if it's set to the highest level, it should alert you to anything else trying to get into your computer. Just another level of security to employ, as it were.

 

[Techwomen]

Actually it was set to high. So I find it a bit strange how my computer is acting. I ran all the stuff and my computer began to freeze. I am going to uninstall AVG and go to the AVG site and down load a new AVG and see if that is the issue. I need my laptop for homework. I am not sure why my media files are not working correctly.

 

[XweAponX]

Well, you DID have Sirefef, you ran the removal tool and it found it. But another thing Sirefef does is it will wreck your Windows Firewall.

You have to repair your Firewall, open your Network center, and check your firewall, if it is not running, try to start it. If it will not run, try this.

Diagnose and fix Windows Firewall service problems automatically

And, I have to tell you a Sirefef infection is NOT easily cleaned, the main parts of it were taken out by the tool, but the SOURCE of it may still me in there, and it will re-infect you.

Check for something called the Tarma Installer, it will be in your User folder under Appdata/LocalLow, you have to enable viewing of hidden system files and folders to get to it.

Also, AVG is not sufficient to remove Sirefef leftovers, delete it, and download Eset NOD32.

Also, there is a HIGH probability that your Windows Defender program has been hijacked by Sirefef, You will know this if you tri to install Eset and you are blocked by Defender from installing it.

If this is happening, you have to boot to Safe Mode and RENAME the Windows Defender folder, to Windows Defender Old or something. Then you have to rename the MSASCui.exe file to MSASCui.rubbish or anything you want.

Sirefef is just about the worst virus you can ever get, if you have installed OpenCandy, Tarma, Delta toolbar, or anything similar, you have installed it yourself. I think this is your main problem, you still have components of Sirefef in your system, the removal tool is just to stop it from running, you have to remove the programs that had this dandy program attached to it.

Running toolbars is simply not a good idea anyway, I use Yamicsoft Windows 8 Manager and in the Network/Internet Explorer Section, you have to BLOCK all known toolbars. Even if you use Firefox or Chrome and not IE, you are not immune to these hideous pieces of crap.

AVG especially the free version is NOT going to help you in any way, it is simply not good enough to get rid of this, it's too powerful.

 

[Techwomen]

Firewall is fine. Also I uninstalled it with AVG removal tool and reinstalled AVG 14 it is finding threats.

 

[Techwomen]

What do you mean in the below statement?

AVG is not sufficient to remove Sirefef leftovers, delete it, and download Eset NOD32.

 

[Techwomen]

Also not sure where to find this folder Appdata/LocalLow

 

[HippsieGypsie]

Hi. The others aren't on. Not familiar with this virus, but let's see if I can help.

I think xWeUponx wants you to download this:

http://go.eset.com/us/search-brand/?CMP=KNC-msn-ag

Obviously he must know this will remove the virus, but this is a pay-for program. Let's see if we can find another way.

Look in Users/"You"/Roaming/Appdata/LocalLow. May I ask why you need that?

 

[HippsieGypsie]

Another thing. A nasty virus will inbed itself in the Registry. It's very difficult to get rid of.

 

[Wynona]

Also not sure where to find this folder Appdata/LocalLow

And now, back to the Control Panel . . .

Look for "Folder Options" and click on it. In the Folder Options window, click on the View tab. The first radio button says Don't show hidden files, folders, or drives. The second radio button says Show hidden files, folders, or drives. Be sure that one has the black center (filled in). Close the window and then close the Control Panel.

Now, open "Computer" by pressing the Windows key and typing in computer. Once the computer button shows on the left, hit Enter and you'll see Windows (C: ), and a listing of all the other "drives" on your machine. (I had to put a space between the : and ) because the silly thing gives a smiley if I don't.)

Click on Windows (C: )
Click on Users
Click on your name (Mine would be Wynona)
Click on AppData

Now, you'll see Local, LocalLow, Roaming

You should be able to follow the yellow brick road given by XweAponX from here.