BleepingComputer.com: virus/trojan? HELP!

Hi,

those are not the results I expected.

Please run OTL again and use the following settings:

• Check Scan All Users.
  
• For Processes choose none.
  
• For Modules choose none.
  
• For Services choose none.
  
• For Drivers choose none.
  
• For Standard Registry choose none.
  
• For Extra Registry choose none.
  
• For Files Created Within choose none.
  
• For Files Modified Within choose none.
  
• Under Custom Scans/Fixes paste:
  

  HKLM\Software\Microsoft\Sharedtools\MSconfig /s

  
  
• Finally hit Run Scan and wait for the log to open.
  
• Please post the content of the log into your next reply.

regards myrt

OTL logfile created on: 1/14/2010 10:40:05 AM - Run 1
OTL by OldTimer - Version 3.1.24.0 Folder = C:\Users\Brenda\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 49.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287.24 Gb Total Space | 223.65 Gb Free Space | 77.86% Space Free | Partition Type: NTFS
Drive D: | 10.85 Gb Total Space | 1.83 Gb Free Space | 16.87% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JAVA
Current User Name: Brenda
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Custom Scans ==========


< HKLM\Software\Microsoft\Sharedtools\MSconfig /s >
< End of report >

Hi,

sorry there was a typo in the script I gave you.

Please run OTL again and use the following settings:

• Check Scan All Users.
  
• For Processes choose none.
  
• For Modules choose none.
  
• For Services choose none.
  
• For Drivers choose none.
  
• For Standard Registry choose none.
  
• For Extra Registry choose none.
  
• For Files Created Within choose none.
  
• For Files Modified Within choose none.
  
• Under Custom Scans/Fixes paste:
  

  HKLM\Software\Microsoft\Shared tools\MSconfig /s

  
  
• Finally hit Run Scan and wait for the log to open.
  
• Please post the content of the log into your next reply.

That one should work.
regards myrti

OTL logfile created on: 1/14/2010 10:51:14 AM - Run 1
OTL by OldTimer - Version 3.1.24.0 Folder = C:\Users\Brenda\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 49.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287.24 Gb Total Space | 221.60 Gb Free Space | 77.15% Space Free | Partition Type: NTFS
Drive D: | 10.85 Gb Total Space | 1.83 Gb Free Space | 16.87% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JAVA
Current User Name: Brenda
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Custom Scans ==========


< HKLM\Software\Microsoft\Shared tools\MSconfig /s >
< End of report >


OTL logfile created on: 1/14/2010 10:51:14 AM - Run 1
OTL by OldTimer - Version 3.1.24.0 Folder = C:\Users\Brenda\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 49.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287.24 Gb Total Space | 221.60 Gb Free Space | 77.15% Space Free | Partition Type: NTFS
Drive D: | 10.85 Gb Total Space | 1.83 Gb Free Space | 16.87% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JAVA
Current User Name: Brenda
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Custom Scans ==========


< HKLM\Software\Microsoft\Shared tools\MSconfig /s >
< End of report >

Hi,

it seems as if there are no backups from MSConfig in the standard location, which would explain why MS is unable to restore them.

Could you please do a registry search for msconfig, if you wish to investigate this issue further:

Please download SystemLook from jpshortstuff and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Double-click the SystemLook and copy/paste the following into the box
  

   :regfind
  Msconfig

  
  
• Hit the Look button. Let it finish the scan
  
• A log will then pop-up to your Desktop.. Post the content of the log here in your next reply

regards myrti

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 11:21 on 14/01/2010 by Brenda (Administrator - Elevation successful)

========== regfind ==========

Searching for "Msconfig"
[HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\MsConfig]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-msconfig-exe.resources_31bf3856ad364e35_6.0.6000.16386_en-us_d20856a80dfab628]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.0.6000.16386_none_3462180b593270f3]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.0.6001.18000_none_3698da07561d81c7]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-msconfig_31bf3856ad364e35_6.0.6000.16386_none_63dd41b484cfe034]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\amd64_microsoft-windows-msconfig-exe.resources_31bf3856ad364e35_en-us_2dbda54ee27d054a]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_none_894084e32f76d417]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\amd64_microsoft-windows-msconfig_31bf3856ad364e35_none_faff8a274710009e]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_0028f81e\ComponentFamilies\amd64_microsoft-windows-msconfig-exe.resources_31bf3856ad364e35_en-us_2dbda54ee27d054a]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_0028f81e\ComponentFamilies\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_none_894084e32f76d417]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_0028f81e\ComponentFamilies\amd64_microsoft-windows-msconfig_31bf3856ad364e35_none_faff8a274710009e]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6002.18005_0028c5a9\ComponentFamilies\amd64_microsoft-windows-msconfig-exe.resources_31bf3856ad364e35_en-us_2dbda54ee27d054a]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6002.18005_0028c5a9\ComponentFamilies\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_none_894084e32f76d417]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6002.18005_0028c5a9\ComponentFamilies\amd64_microsoft-windows-msconfig_31bf3856ad364e35_none_faff8a274710009e]
[HKEY_LOCAL_MACHINE\COMPONENTS\Winners\amd64_microsoft-windows-msconfig-exe.resources_31bf3856ad364e35_en-us_2dbda54ee27d054a]
[HKEY_LOCAL_MACHINE\COMPONENTS\Winners\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_none_894084e32f76d417]
[HKEY_LOCAL_MACHINE\COMPONENTS\Winners\amd64_microsoft-windows-msconfig_31bf3856ad364e35_none_faff8a274710009e]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{81AF8873-6012-4999-AC64-153EA4F6451F}]
@="ILaunchMsConfigElevated"
[HKEY_USERS\S-1-5-21-604219708-840033-878688825-1000\Software\Microsoft\Shared Tools\MsConfig]

-=End Of File=-

Hi,

please show me the content of the following key: [HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\MsConfig] with the following script:

Please run OTL again and use the following settings:

• Check Scan All Users.
  
• For Processes choose none.
  
• For Modules choose none.
  
• For Services choose none.
  
• For Drivers choose none.
  
• For Standard Registry choose none.
  
• For Extra Registry choose none.
  
• For Files Created Within choose none.
  
• For Files Modified Within choose none.
  
• Under Custom Scans/Fixes paste:
  

  HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\MsConfig /s

  
  
• Finally hit Run Scan and wait for the log to open.
  
• Please post the content of the log into your next reply.

regards myrti

OTL logfile created on: 1/14/2010 11:46:01 AM - Run 2
OTL by OldTimer - Version 3.1.24.0 Folder = C:\Users\Brenda\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 48.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287.24 Gb Total Space | 221.57 Gb Free Space | 77.14% Space Free | Partition Type: NTFS
Drive D: | 10.85 Gb Total Space | 1.83 Gb Free Space | 16.87% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JAVA
Current User Name: Brenda
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\MsConfig /s >
"NoRebootUI" = 0
< End of report >

Hi,

it looks as if there are no backups stored for MSConfig on that machine at all, which could explain why things go bad when you try to restore them.
It is possible that some tools, eg Registry Cleaners or your anti virus program, cleaned of the disabled settings, which leaves Windows believing that it is not the default boot even though there is nothing to restore.

If you don't think that this can cause problems for your friend, I would leave it at that. If you wish to resolve this issue I would suggest that you try the windows forums, since it has me stumped. People there may be more familiar with this type of problems.

Please upgrade your software:

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  
• Look for "Java Runtime Environment (JRE)" JRE 6 Update 18.
  
• Click the Download button to the right.
  
• Select your Platform: "Windows".
  
• Select your Language: "Multi-language".
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
• Click Continue and the page will refresh.
  
• Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  
• Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.

-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

A critical update for Adobe Reader was issued yesterday, please update it as well.

regards myrti

Myrti,

The only two entries in the unintall list are

Java™ 6 Update 5
Java™ 6 Update 11

Do I uninstall these 2?

Also when downloading there is this option

Select your Platform: "Windows". -- there is a windows and a windowsX64 which do I choose.

Thanks

Hi,

yes, please uninstall those two java versions. Every java-update is completely autonomic and needs non of the previous versions to run. However java only recently began removing older versions before installing the latest version, so that a lot of old unused updates remain installed.

Please install the 64bit version (windowsx64) of java.

regards myrti

Ok the last steps have been completed

Hi,

then the last steps left to do is to remove the software we installed on the system to clean it:

Read those last few lines, in order to keep your pc safe and clean:
Please do the following to clean up your PC:

• Delete the tools used during the disinfection:
  • Download OTC from the following mirrors and save it to your desktop:
    • Mirror
    
    
  • Double click on
    
  • Push the large "Cleanup" button.
    
  • Allow your system to reboot.
  
  
• If OTC faild to remove all programs from your Desktop, please delete the rest manually.
  
• Disable and Enable System Restore.
  You can find instructions on how to disable and reenable system restore here:
  Windows ME System Restore Guide
  Windows XP System Restore Guide
  Windows Vista System Restore Guide
  
  Note: You should only do this once, not on a regular basis!
  You will not be able to restore computer to any earlier than today!

Please read these advices, in order to prevent reinfecting your PC:

• Install and update the following programs regularly:
  • an outbound firewall
    A comprehensive tutorial and a list of possible firewalls can be found here.
    
  • an AntiVirus Software
    It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    
  • an Anti-Spyware program
    Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
    SUPERAntiSpyware is another good scanner with high detection and removal rates.
    Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    
  • Spyware Blaster
    A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
    
  • MVPs hosts file
    A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file
  
  
• Keep Windows (and your other Microsoft software) up to date!
  I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holeswill allow an attacker unrestricted access to your computer.
  Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!
  
• Keep your other software up to date as well
  Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.
  
• Stay up to date!
  The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variantsevery single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing .

Some more links you might find of interest:

• Miekies' prevention suggestions
  
• So How did I get infected?
  
• Microsoft - 'Securityat home'
  
• Calendar of Updates: See which updates have been released.
  
• How to backup your Data with Cobian Backup:because you never know, when your harddisk might fail
  
• Commonly UsedFreeware Replacements: a nice list of freeware programs in all categories, that are regarded as useful by the users of this forum.
  
• osalt: Find (free) open source alternatives to known commercial software.

Have a nice day
myrti

Thanks myrti, will there be any conflicts with noron360, spybot, and superantispyware all loading at startup? Thanks

Hi,

there shouldn't be any problems. The important thing is that you don't have two anti virus programs with real time protection running. Spybot has a protection running, that is only monitoring the registry and SASW basically only protects itself, so there shouldn't be any conflicts.

Basically you will usually only run risks when you use two anti virus programs. Running additional anti spyware programs suchs as Spybot, Superantispyware or Malwarebytes should not pose a problem.

regards myrti