Bafstone[dot]com Antivirus Pro Malware
Hi guys,
Please help me here. I spent a whole day trying to remove a malware from my computer. I'll describe what happened. It's long, but that's because it's been a long day. Usually I like getting things fixed, but I give up. Please see if you have any insights to help. I'd sure appreciate it.
I was listening to a music playlist on imeem[dot]com with firefox, then my computer became really slow and the music became glitchy. Suddenly a download box popped up. It's downloading 315.pdf from bafstone[dot]com (It didn't show the full path to the pdf file).
I didn't have chance to cancel the download because it's pretty fast and already downloaded and preparing to open. I waited to see what it was. After all, I'm quite intrigued, since it's only a pdf file and not application.
But it was no pdf file at all. It opened up a command prompt. The next thing I know, my computer turned to a blue screen. In the next instant my computer restarted.
After it restarted, an Antivirus Pro software popped up and scanned my comoputer. I know this software was a scam because I don't recognize "antivirus pro". This software offerred me a fix to all the infections its found if I were to purchase it. I might have agreed to the purchase, but that darn software froze. Can't click on any options, and can't even quit it. I also noticed that my firefox browser wont start.
I hit ctrl alt delete and msconfig and found tons of suspicious stuff. b92xa474l.exe, Id12.exe, mrofinu72.exe, and a bunch of others. I tired removing them, but it won't let me delete. Tried to end the process tree of some of them, and it worked, I was able to delete them.
I got malwarebytes on a stick and installed it. However, it won't let me delete the infected items nor run an update. It also shows that regedit was disabled and malwarebytes had to enable it several times throughout the cleaning process. What really killed malwarebytes was that at the end, when it tries to delete the infected files and send the log back to its server, it crashes. I did print a log file of all the infected files.
I tried to restart in safe mode by checking the option in msconfig. But safemode won't start, it kept on throwing me back to the selection screen. Finally I selected a normal start up, but now even that won't work.
I used knoppix linux on a disk and started in linux. Manually deleted all the files in the malwarebytes log file. Also changed boot.ini to cancel the safemode option.
This time, I was able to log into windows. However the problem with firefox not starting remains. IE also crashes when I try to load a webpage, even though it can start with about:blank. Almost anything else that tries to access the internet, such as malwarebyte update, outpost firewall, crashes. I also noticed that lavasoft adaware got disabled in the services.msc. I enabled it and tried to do a update on the definitions file, but just like malwarebytes, it crashes.
Winsock fix doesn't solve the problem. Only two software I know can access the web. Ping, and an old mozilla browser I have.
I'm so frustrated, I looked up whois on the domain bafstone[dot]com and found this.
It was registered by a guy in the US 7/1/09. The server is hosted in Germany.
I don't want to point fingers at the registrant of this website, but it's quite suspicious.
Can someone please give me some inputs on what to do? I really want to get my browsers to work again. I hope someone knowledgeable with computers can read the above description and be able to see what's going on here. Also, I want to report bafstone[dot]com to some authority so that other people won't have to go through what I did.
I spent my whole day frustrated because of this malware. It's so late now and I have to wake up early tommorrow. Sigh... If anyone can help out here, Id appreciate it so much.
-Leef
