Welcome Guest ( Log In | Click here to Register a free account now! )
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.
To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.
![]() ![]() |
Jul 3 2009, 02:25 AM
Post
#1
|
|
|
New Member ![]() Group: Members Posts: 6 Joined: 2-July 09 Member No.: 347,738 |
|
|
|
|
Jul 4 2009, 08:41 PM
Post
#2
|
|
![]() Computer Masochist ![]() ![]() ![]() ![]() ![]() ![]() Group: Moderator Posts: 23,580 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618 |
qoobox is the quarantine folder for Combofix
The process of cleaning your computer may require you to temporarily disable some security programs. If you are using SpyBot Search and Destroy, please refer to Note 2 at the bottom of this page. Please download Malwarebytes Anti-Malware and save it to your desktop. alternate download link 2
-- If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. Note 2: -- MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes (like Spybot's Teatimer), they may interfere with the fix or alert you after scanning with MBAM. Please disable such programs until disinfection is complete or permit them to allow the changes. To disable these programs, please view this topic: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs ---------------------------------------------------------- Some types of malware will disable Malwarebytes Anti-Malware and other security tools. If MBAM will not install, try renaming it first.
Be sure to update MBAM through the program's interface (preferable method) or manually download the definition updates and just double-click on mbam-rules.exe to install. Then perform a Quick Scan in normal mode and check all items found for removal. Don't forgot to reboot afterwards. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs tab and copy/paste the contents of the report in your next reply. Note: MBAM uses Inno Setup instead of the Windows Installer Service to install the program. If installation fails in normal mode, try installing in safe mode. Doing this is usually not advised as MBAM is designed to be at full power when running in normal mode and loses some effectiveness for detection & removal when used in safe mode. For optimal removal, normal mode is recommended so it does not limit the abilities of MBAM. Therefore, after completing a scan it is recommended to uninstall MBAM, then reinstall it in normal mode and perform another Quick Scan. This post has been edited by garmanma: Jul 4 2009, 08:43 PM -------------------- Mark
why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter |
|
|
|
Jul 5 2009, 02:13 PM
Post
#3
|
|
|
New Member ![]() Group: Members Posts: 6 Joined: 2-July 09 Member No.: 347,738 |
Hi - Thank you so much for your assistance
I tried to Download MBAN as you requested - but hit the runtime error 372 - I tried in safe mode as well...same thing - tried direct - same thing - I am also having alot of difficulty with links on webpages and hypertext and html - heres something kinda interesting whenever a registration page tries to ensure that I am human by giving the weird picture with alpha/numeric - i do not get the picture - also low memory and have not been able to get in wmp - thanks again - you are the expert so I will do anything you ask - thanks again Niko |
|
|
|
Jul 5 2009, 07:20 PM
Post
#4
|
|
![]() Computer Masochist ![]() ![]() ![]() ![]() ![]() ![]() Group: Moderator Posts: 23,580 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618 |
Some types of malware will disable Malwarebytes Anti-Malware and other security tools. If MBAM will not install, try renaming it first.
Be sure to update MBAM through the program's interface (preferable method) or manually download the definition updates and just double-click on mbam-rules.exe to install. Then perform a Quick Scan in normal mode and check all items found for removal. Don't forgot to reboot afterwards. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs tab and copy/paste the contents of the report in your next reply. Note: MBAM uses Inno Setup instead of the Windows Installer Service to install the program. If installation fails in normal mode, try installing in safe mode. Doing this is usually not advised as MBAM is designed to be at full power when running in normal mode and loses some effectiveness for detection & removal when used in safe mode. For optimal removal, normal mode is recommended so it does not limit the abilities of MBAM. Therefore, after completing a scan it is recommended to uninstall MBAM, then reinstall it in normal mode and perform another Quick Scan. -------------------- Mark
why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter |
|
|
|
Jul 6 2009, 02:04 AM
Post
#5
|
|
|
New Member ![]() Group: Members Posts: 6 Joined: 2-July 09 Member No.: 347,738 |
Didn't work - the 1st and 2nd suggestions looked like they might work - went through installation till the 1/2 way point on the download meter then got hit with the 372 - by the time I got to the program file and remaned and re-ext. it was pissed and didn't even bother going through the fakeness it just hit me with 372 as soon as I double clicked !!!
I kinda got pissed and deleted the icons thinkin ohh yeah that will solve but of course things are just staying the same....appreciate the help thanks again...niko |
|
|
|
Jul 6 2009, 04:44 PM
Post
#6
|
|
![]() Computer Masochist ![]() ![]() ![]() ![]() ![]() ![]() Group: Moderator Posts: 23,580 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618 |
Let's see if we can get SAS to work
SAS,may take a long time to scan Please download and scan with SUPERAntiSpyware Free
Scan with SUPERAntiSpyware as follows:
-------------------- Mark
why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter |
|
|
|
Jul 8 2009, 02:10 PM
Post
#7
|
|
|
New Member ![]() Group: Members Posts: 6 Joined: 2-July 09 Member No.: 347,738 |
Nope it didn't work . never getting to 2nd level of authorization to download - I actually never get a link that works I have to save to to desktop then I can open it. If its a secure website I don't think I can access it....appreciate all your help so far....I think your getting warmer
|
|
|
|
Jul 8 2009, 06:35 PM
Post
#8
|
|
![]() Computer Masochist ![]() ![]() ![]() ![]() ![]() ![]() Group: Moderator Posts: 23,580 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618 |
Try this
Right-click on the Task Bar and open Task Manager In the Applications window, end all running tasks Start a new task and type explorer.exe This should bring up the Desktop Then try a fresh install of mbam and see if it will run -------------------- Mark
why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter |
|
|
|
Jul 9 2009, 01:47 AM
Post
#9
|
|
|
New Member ![]() Group: Members Posts: 6 Joined: 2-July 09 Member No.: 347,738 |
372....
Is it possible to bring my system back to a point where there is nothing left but the base windows/explorer. at this point I don't care about saving files / documents / anything...I just want to be able to click a link and go, watch "anything" in WMP, start a word. doc. and print it. I REALLY appreciate that you are trying toget back to aplace whereI can hold to what I have and just get this malware crap out of the system, I just do now how I can help when I can even copy and paste. Are there any tools that are already in the system to locate this? Or can we go by your experience if you know what this "might be" or where it "might be" I have no problem going with your instincts and will GLADLY remove what ever you tell me to. I'm sorry I 'm just so frustrated with this situation. Because I can't even click and drag I can[t get rid of all the bleep thats now on my desktop. I guess i'm looking for some magic command I can run in the command fuction that will just wipe out everything and bring me back to square one....I'm sure it doesn[t the fact that I have no discs what so ever, erd,windows...nothing. please let me know what you suggestplease believe that my rant is in no way directed at you...i'm just so over it. thanks again |
|
|
|
Jul 9 2009, 04:36 PM
Post
#10
|
|
![]() Computer Masochist ![]() ![]() ![]() ![]() ![]() ![]() Group: Moderator Posts: 23,580 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618 |
What is the make and model of the computer?
Did it come with any type of recovery disks? Some types of malware can result in a system so badly damaged that a Repair Install will NOT help!. Reinstalling Windows without first wiping the entire hard drive with a repartition and/or format will not remove the infection. The reinstall will only overwrite the Windows files. Any malware on the system will still be there afterwards. Starting over by wiping your drive, reformatting, and performing a clean install of the OS or doing a factory restore removes everything and is the safest action. In case you need help with this, please review:These links include step-by-step instructions with screenshots:
Note: If your using an IBM, HP, Compaq or Dell machine, you may not have an original XP CD Disk. By policy Microsoft no longer allows OEM manufactures to include the original Windows XP CD-ROM on computers sold with Windows preinstalled. Instead, most computers manufactured and sold by OEM vendors come with a vendor-specific Recovery Disk or Recovery Partition for performing a clean "factory restore" that will reformat your hard drive, remove all data and restore the computer to the state it was in when you first purchased it. If you need additional assistance with reformatting, you can start a new topic in the Windows XP Home and Professional forum. This post has been edited by garmanma: Jul 9 2009, 04:36 PM -------------------- Mark
why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter |
|
|
|
Jul 10 2009, 06:58 PM
Post
#11
|
|
|
New Member ![]() Group: Members Posts: 6 Joined: 2-July 09 Member No.: 347,738 |
I'm kindo of excited I found this log labelled hijack this -- but i don;t know how to get it to you OMG ok is this what you need ...please say yes
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:23:28, on 7/5/2009 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINNT\system32\stisvc.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\ctfmon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\FinitySoft Memory Manger\MemoryManager.exe C:\Program Files\Speeditup Free\SpeedItUp.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:81 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ovwzabgn] ctfmon.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - HKCU\..\Run: [BySoft FreeRAM] C:\Program Files\FinitySoft Memory Manger\MemoryManager.exe O4 - HKCU\..\Run: [SpeedItUpEX] C:\Program Files\Speeditup Free\SpeedItUp.exe -MINI O4 - HKUS\S-1-5-21-1801674531-2111687655-854245398-500\..\Run: [ctfmon.exe] ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1801674531-2111687655-854245398-500\..\Run: [BySoft FreeRAM] C:\Program Files\FinitySoft Memory Manger\MemoryManager.exe (User '?') O4 - HKUS\S-1-5-21-1801674531-2111687655-854245398-500\..\Run: [SpeedItUpEX] C:\Program Files\Speeditup Free\SpeedItUp.exe -MINI (User '?') O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user') O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file) O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O15 - Trusted Zone: *.amateurcollegemen.com O15 - Trusted Zone: *.corbinfisher.com O16 - DPF: Yahoo! Freecell Solitaire - O16 - DPF: Yahoo! Gin - O16 - DPF: Yahoo! Spades - O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...20Installer.cab O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1245461988122 O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.5.0) - O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) - O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - O23 - Service: Lavasoft Ad-Aware Service (aawservice) - - (no file) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe -- End of file - 5554 bytes |
|
|
|
Jul 10 2009, 07:38 PM
Post
#12
|
|
![]() Computer Masochist ![]() ![]() ![]() ![]() ![]() ![]() Group: Moderator Posts: 23,580 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618 |
The members in this forum are not qualified to work on and give advice on HJT logs
You will need to repost the log in this forum: http://www.bleepingcomputer.com/forums/forum22.html I believe that is the direction we were heading, anyways The HJT team members there are extremely busy and have a backlog at the moment Please be patient and good luck This post has been edited by garmanma: Jul 10 2009, 07:44 PM -------------------- Mark
why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter |
|
|
|
![]() ![]() |
| Lo-Fi Version | Time is now: 20th November 2009 - 11:03 PM |