I think I have some viruses on my computer. Please help so I can remove them.

Viruses and worms
1

Hello.
So I decided to scan my computer with MalwareBytes to see if I have any viruses. This is the log:

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.01.08.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jack :: ACER5750G [administrator]

09/01/2013 18:14:05
MBAM-log-2013-01-09 (18-34-17).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 309131
Time elapsed: 12 minute(s), 22 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\WINDOWS\SYSTEM32\IJL11PRO.DLL (Worm.Sohanad) → Data: 1 → No action taken.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 5
C:\Windows\AutoKMS.exe (Riskware.Keygen) → No action taken.
C:\Windows\KMSEmulator.exe (RiskWare.Tool.CK) → No action taken.
C:\Windows\System32\ijl11pro.DLL (Worm.Sohanad) → No action taken.
C:\Windows\SysWOW64\ijl11pro.DLL (Worm.Sohanad) → No action taken.
C:\Users\Jack\Local Settings\TempDIR\BetterInstaller.exe (PUP.BundleInstaller.Somoto) → No action taken.

(end)

Please tell me what to do to remove them.
Thanks
Jack

2

As Pondus just explained in your first post

Quote Pondus

your log say “no action taken”

you need to click the “remove selected” button after scan to quarantine infections

if you want a check inside, follow the sticky guide on top in virus an worms section, attach the logs requested and help will arrive

3

I have clicked remove selected. Now what? Is that it?
Thanks

4

the first or second sticky note?

5

I would update MBAM and re-run a scan but you also should follow the instructions in the post before your last where I quoted Pondus and his instructions on supplying the logs requested in the topic at the top of the viruses and worms section.

second http://forum.avast.com/index.php?topic=53253.0

6

I would also suggest a quick run of CKScanner…

Download CKScanner by askey127 from Here & save it to your Desktop.
[*] Right-click and Run as Administrator CKScanner.exe then click Search For Files
[*] When the cursor hourglass disappears, click Save List To File
[*] A message box will verify the file saved
[*] Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply

7

Do I have to do all of those scans?

8

Only the first 4 ( you already have MBAM, re-run a scan ) plus the extra one that jeffce asked you to run

9

I’m re-scanning with MalwareBytes now. I will put the log up once ready.

10

MalwareBytes just finished. Here is the log. It detected two files which I know that if I delete them my Microsoft Office 2010 won’t work properly and will say its not activated. Should I delete them anyway? And what scan do I run next?
Thanks
Jack

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.01.09.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jack :: ACER5750G [administrator]

09/01/2013 20:05:51
MBAM-log-2013-01-09 (20-11-37).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 309292
Time elapsed: 5 minute(s), 33 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Windows\AutoKMS.exe (Riskware.Keygen) → No action taken.
C:\Windows\KMSEmulator.exe (RiskWare.Tool.CK) → No action taken.

(end)

11

Why are you not letting MBAM remove the infections ??? please let it do it’s job and include the logs from the other tools in your next post.

12

Are they infections or false positives? Because I think I have removed them before with another scanner once but I found that Microsoft Office 2010 was giving me alerts that it wasn’t activated. Should I delete them?

13

Yes let MBAM clean the infections.

14

Please run CKScanner with the instructions I provided earlier. :slight_smile:

15

here is the log
it is attached because it was too long to copy and paste. and i will do the other scans tomorrow because its too late tonight.
thanks
Jack

16

Hi,

CKScanner has detected illegal software on your system. Besides being illegal, it’s the number one way of infecting your system as all cracked/keygen software is infected. This forum, as well as all the other malware removal forums, do not support the use of illegal software except for their removal. If I were to continue helping you with illegal software installed, it could be construed in the eyes of the law as aiding and abetting a crime.

If you do not agree to this then this thread will be closed and no further help will be offered because I will never be able to tell you your malware logs are clean. If you wish to continue, please uninstall all unauthorized software and then run a new scan with CKScanner. Post the new log when complete if you would like to proceed.

17

Sorry, I didn’t manage to go on the forums yesterday. I will be putting up the other logs soon.
Jack

18

No problem. :slight_smile:

19

Hello.
So I have launched AdwScanner and here is the log. I noticed that when I rebooted it removed all those junky toolbars but it also removed my extensions that I had installed myself on Chrome. So I re-installed them and now I am going to do the second scan. Here is the log for AdwScanner anyway.

20

Here are the OTL Scan log files.
Thanks
Jack