Hi,
I have been searching a lot on the internet for a solution to remove “Personal Shield Pro” virus and at different occassions have been able to delete files and remove them from registry from the solutions provided, but in the end whenever i restart within one hour the virus is always back.
I have tried earlier fixes of stopping it from loading by rkill and then using malware bytes to clean it in safe mode but it always returns back. Have been reading this forum and also installed avast in the system, but didnt restart it yet. Right now the Malware byte also shows the PC as clean. but to be on safe side i needed more help.
I saw similar problem with other ppl and for the purpose I installed and scanned with OTL, right now I am attaching Hijackthis and OTL logs to know if it is clean or what measures should i take.
Would appreciate any help.
Note: The system is EeePC1000H and there is no CDROM in it.
For sure attach the logs and I will have a look see
malwarebytes is designed to work best when run in normal mode…
Logfile of Trend Micro HijackThis v2.0.4
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com http://search.live.com/sphome.aspx WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)@btrez.dll ,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)@btrez.dll ,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
–
to avoid multiple posts with copy and paste if the log is big
lower left corner > addtional options > attach
Ah OK Hijackthis - to be honest - is worthless against this sort of malware. If you have an OTL log could you attach that please
The OTS log text is attached.
I did update Malware bytes but didnt scan it in normal mode, only in safe mode.
The size is just a little bit big, I’m splitting it in 2
Hi you have saved it in unicode - could you resave as ANSI and then it will attach as one and I will be able to read it
http://i1224.photobucket.com/albums/ee362/Essexboy3/Untitled.gif
system
July 5, 2011, 10:52pm
10
Hi,
Actually the pc shut down due to low battery, and i had to restart it. So thought of scanning it once again with OTS, but it will freeze while scanning drivers (some file named ozwscus…). Tried it twice and the same thing happened, so I am attaching the same log that I gave before in ANSI coding.
system
July 6, 2011, 5:49am
11
Hi,
Did you get the chance to review the log
Pondus
July 6, 2011, 6:15am
12
Essexboy will be back later today…
system
July 6, 2011, 2:41pm
13
Fix This in Hijack
F2 - REG:system.ini: UserInit=userinit.exe,c:\program files\microsoft\watermark.exe,
/////////////////////////////////////////////////////////////
O4 - HKLM..\Run: [niwout] C:\WINDOWS\system32\sogafouwou.exe
//////////////////////////////////////////////////////////
watermark.exe, sogafouwou.exe, gobazou.exe - Check in VT http://www.virustotal.com , and enter the result on the forum,it’s probably viruses.
http://www.freedrweb.com/cureit/?lng=en - Download and scan
Hi you are running three malware drivers including your safe boot. So I do not know if OTS will be strong enough to kill this but lets go for it
As the fix is so large the forum software will not allow me to paste it
Download the attached fix.txt to your desktop
Start OTS. Click the Run Fix
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here
I will review the information when it comes back in.
Depending on what the fix contains, this process may take some time and your desktop icons might disappear or other uncommon behavior may occur.
This is no sign of malfunction, do not panic!
OK having problems attaching the fix.txt
system
August 6, 2011, 9:52am
16
It cost a whole day to wipe away personal shield pro, I’ve found this removal video, you may check out,make sure every step you done is right: http://www.youtube.com/watch?v=FWqbZAvh6HE
DavidR
August 6, 2011, 11:31am
17
Sorry but this poor quality, too fast (to be really helpful) video (horrendous music) seems more to be an advert for tee support a paid support site.
As soon as there is a variant, e.g. they change the folder/file names, etc. this video is worthless. Which is why detailed analysis of the system by a specialist should win out over this.
You don’t happen to have anything to do with tee support do you ?
Not to mention this topic is a month old, which is one of the reasons for questioning the purpose of the post. As you can imagine I’m a trusting sort and take everything at face value.
system
August 6, 2011, 11:59am
18
@eepchelp
The recommendation that you install this program.
MCShield
It will prevent infection by computer via USB flash drive, mobile phone or any memory card.
You have the infection via USB drive.
works for me…