BleepingComputer.com: Computer acting funny

I am posting about a computer at my office, which is primarily used for email only. I have not been able to get my Avira AV to work in about a week. It will not scan or update. After two uninstalls and two clean installs I still cant get it to work. I downloaded Hijack this but when I click on it, Windows says I can not access the proper path or some thing like that... I had Avira on schedule to run every night and have never had a ny problems with it. I went to the avira site and they asked for a hijackthis log, but when I ran it it didnt save a log.. I don't know where to go from here, please let me know...thanks

JP

Is this XP or another??

boopme, on 05 September 2011 - 02:59 PM, said:

yes windows xp

Hell...Use this fix, when you see a box that states “Windows cannot not access the specified device, path, or file. You may have inappropriate permissions to access the item”.

Download This File
Save it next to mbam.exe (this file is located in the Malwarebytes Anti-malware home folder). Once done, drag and drop mbam.exe into Inherit.exe. Click OK and attempt to run Malwarebytes Anti-malware once again.



Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware and save it to your desktop.

Download Link 1
Download Link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware



Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:

• Flush DNS
  
• Report IE Proxy Settings
  
• Reset IE Proxy Settings
  
• Report FF Proxy Settings
  
• Reset FF Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List Winsock Entries
  
• List last 10 Event Viewer log
  
• List Installed Programs
  
• List Users, Partitions and Memory size.
  
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.



I should be back in an hour

Ok, I will do all you asked... Thanks in advance...

JS3

Ok, I attempted to run mbam.exe after installation and it gave me the "Windows cannot not access the specified device, path, or file. You may have inappropriate permissions to access the item” error. So I attempted to re run after dragging mbam.exe INTO Inherit.exe and it only scanned for 2 seconds and then it disappeared on each of three attempts.

This post has been edited by JayStation3: 05 September 2011 - 05:44 PM

Ok. try this sway

Reboot into Safe Mode with Networking
How to enter safe mode(XP/Vista)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode with Networking using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.


>>>> Download this file and doubleclick on it to run it. Allow the information to be merged with the registry.

RKill....

Download and Run RKill

Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

Link 1
Link 2
Link 3
Link 4



• Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  
  
• Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  
  
• A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  
  
• If nothing happens or if the tool does not run, please let me know in your next reply

Do not reboot your computer after running rkill as the malware programs will start again. Or if rebooting is required run it again.


If you continue having problems running rkill.com, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.


OR only if Needed
This infection changes settings on your computer so that when you launch an executable, a file ending with .exe, it will instead launch the infection rather than the desired program. To fix this we must first download a Registry file that will fix these changes. From a clean computer, please download the following file and save it to a removable media such as a CD/DVD, external Drive, or USB flash drive.

FixNCR.reg

insert the removable device into the infected computer and open the folder the drive letter associated with it. You should now see the FixNCR.reg file that you had downloaded onto it. Double-click on the FixNCR.reg file to fix the Registry on your infected computer.

Ok,

After restarting the computer in safe mode, I ran Rkill and it gave me this log:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 09/05/2011 at 19:13:54.
Operating System: Microsoft Windows XP

Processes terminated by Rkill or while it was running:

Rkill completed on 09/05/2011 at 19:14:00.

After that I tried to run the mbam.exe again and the same error msg came up, so I merged it with the inherit.exe file again and this time it ran for about 8 seconds each of three attempts.

Assuming I have som ekind of Virus that changes the reg. I DL'd the fixNCR.reg to a flashdrive and applied the fixNCR.reg file and tried everything again...and still the same results... What next?

I need this computer for data entry at my office, so is it okay to reboot it into normal mode so that my admin can get back to work until we figure some thing else out?

Yes that's OK,but after this as you cant do anythung for the 10 minutes it'll take.
First rest the machine ti a date prior to when this all started.
Windows XP System Restore Guide

Then try running MBAM again in Normal

If it still wont run please do this Onlinr scan

This willl not remove yet as in case there is a certain malware here,removing it with this would shut the machine down.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista/Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here to run the scan.
  

  Quote

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth Technology


• Now click on:
  
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  
• When completed the Online Scan will begin automatically.
  
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  
• Now click on:
  
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

NOTE: In some instances if no malware is found there will be no log produced.

Okay, I can't get the scanner to run. It keeps bringing up a pop up with an X in it... I disabled popup blocker and turned off my flash killer... nothing worked... any ideas?

nm, it was just taking forever to load...

This post has been edited by JayStation3: 05 September 2011 - 08:51 PM

Ok, I ran the scanner and I had 6 infections. Here is the log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# ybrowser.exe=11.9.0.30
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=d2362aa952b7fd4b8af07694a93ac3c3
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-09-06 02:21:35
# local_time=2011-09-05 09:21:35 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1024 16777215 100 0 0 0 0 0
# compatibility_mode=1797 16775142 100 90 0 50864250 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=22398
# found=6
# cleaned=0
# scan_time=1194
C:\Documents and Settings\user\Desktop\Lavasoft_Ad-Aware_2007_Pro_v7[1].0.1.3___Lifetime_license\Crack\ProcessWatch.exe probably a variant of Win32/TrojanDropper.Delf.NKEQRT trojan (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\sched.exe Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\update.exe Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\Common Files\Motive\McciCMService.exe Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\Java\jre6\bin\jqs.exe Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
----------------------------------------------------------------------------------------------------------------------

Waiting on next instrustions, how ever I am leaving my office right now, so I wont be able to work on this until tomorrow. I get in at noon. Thanks for all your help so far and I look forward to hearing from you tomorrow...

Thanks again

JS3

OK, these can go...
I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check and check Remove found threats
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

Please ask any needed questions,post logs and Let us know how the PC is running now.

This post has been edited by boopme: 05 September 2011 - 10:05 PM

Ok, thanks... When I tried to run the on-line scanner, it says:

Error 101:ESET Scanner has been run on this computer in the past. Only the files needed will be downloaded to update to the most recent version.

But it only gives me the button to go back, it doesnt give me an option to download anything new or ever run the scanner from there... am I missing some thing?

JS3

Uninstall it and try again.
http://www.uninstalltips.com/eset-online-scanner-removal-how-to-uninstall-eset-online-scanner-from-windows-vista/

Ok, I uninstalled and reinstalled and it scanned, but now, its very loud and it freezes forever... it takes forever to respond to any commands. I opened task manager to see what was running and taking up so much CPU usage (which was at 100%) and could not see anything out of the ordinary. I have been unable to run the mbam.exe cause the computer keeps freezing... any ideas?

When I rean the scan - it found 6 threats, removed one...just FYI incase the info helps with a solution...

JS3