Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need Some Help Something Really Wrong With Computer


  • Please log in to reply
21 replies to this topic

#1 tiredofmalware

tiredofmalware

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 29 May 2008 - 09:29 PM

Hello Everyone,

I have a dell computer with Windows XP. I used this site last year for a malware problem and everyopne was very helpful. This time my computer will not run any applications. It boots up and everything looks fine. However the virus scanner mcafee says it's turned off. If I try to run it the computer just clocks. If I try to get on the internet the computer just clocks. If I open word or excel the they open but If I try to spell check or change a font nothing happens. It appears to me the the computer has a virus.

I am not even sure where to begin.

any help would be greatly appreciated.

Thanks

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:46 AM

Posted 29 May 2008 - 09:48 PM

Some malware infections target .exe files and without repairing that file association your .exe files will lose functionality.

The first thing to try is to check your file association for .exe files. Open the "File Types" dialog box in Windows Explorer or My Computer. Go to Tools > Folder Options > File Types tab. Scroll down to where .EXE would be in the alphabetical order and make certain .EXE is not there. If it is, then edit it there by changing the association to Application. Select the New button, type in EXE for the extension and select the Advanced button. From the list pick "Application."

If that does not resolve the problem, then see:
"Unable to Start a Program with an .exe File Extension"
"Fix or Restore Broken .EXE .LNK .COM Association Caused by Virus"

Note: Some of these steps involve making changes in the registry. Always back up your registry before making any changes. If you are not familiar with working in the registry, then you should NOT attempt to make any changes on your own. Improper changes to the registry could adversely affect your computer and render it inoperable.

Please print out and follow the instructions for using SDFix in BC's self-help tutorial "How to use SDFix".
-- When using this tool, you must use the Administrator's account or an account with "Administrative rights"
-- Disconnect from the Internet and temporarily disable your anti-virus and any anti-malware real time protection before performing a scan.

When done, the SDFix report log will open in notepad and automatically be saved in the SDFix folder as Report.txt. Please copy and paste the contents of Report.txt in your next reply. Be sure to renable you anti-virus and and other security programs before connecting to the Internet.

Some types of malware will disable SDFix and other security tools. If SDFix will not run, change the .exe extension to .bat, .com, .pif, or .scr and then double-click to run.

If you cannot see the file extension, then it's hidden and you will have to Reconfigure Windows XP to show it. Double-click on My Computer, go to Tools > Folder Options and click on the View tab. Under Advanced settings > Files and Folders > check "Show hidden files and Folders" and uncheck "Hide file extensions for known file types", then click Apply > OK.

Edited by quietman7, 29 May 2008 - 09:49 PM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 29 May 2008 - 10:20 PM

OK even if I try to open my computer it clocks as if it can't find the computer HD. How can I search for EXE files?

#4 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 29 May 2008 - 10:30 PM

ok I did get it to work but when it started to search it locked up and shut down the search. Now all icons are missing. CTRL, ALT,DLETE does not work. Could not even turn off computer just unplugged it and plugged it back in.

#5 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 29 May 2008 - 10:41 PM

OK I did get into my computer and went to tolls>folder options>files types. There is no .exe file in there.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:46 AM

Posted 30 May 2008 - 06:25 AM

Did you try any of the other suggestions in the links I provided?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 04 June 2008 - 03:37 PM

Actually I fxed buy running a windows system restore back to April. However, the problem returned and I have a question. The problem was centered around Mcafee antivurs installed through AOL. The antivurs program was the culprit. Once I used the system restore and restared the computer it was fine. The computer still had mCafee but it was running fine. However, several days later Mcafee said it was installing the program (even though it was already on my computer) This was all done without me touching the computer. After that time the computer would not work properly again. (Same problem - program would not open-could not access the internet etc). My wife did a system restore andunistalled the Mcafee and now the computer is working fine. Now I have no antivirus software. Any suggestions on what the problem may have been? What do you suggest I do for an antivirus program?

#8 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 06 June 2008 - 03:57 PM

I forgot to mention that I did follow the first step and did not see .EXE. What should I do next?

#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:46 AM

Posted 06 June 2008 - 09:49 PM

What do you suggest I do for an antivirus program?

Free Antivirus programs: (choose and install only one)
avast! 4 Home Edition (comes with built-in anti-rootkit and anti-spyware protection)
Avira AntiVir Personal - Free Antivirus (provides some rootkit detection and removal))

Perform a full system scan in "Safe Mode".

Then please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Acan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 08 June 2008 - 10:35 PM

SDFIX Report -----------------------------------------------------------------------------------------------------------------------------------------

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 21:47:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe:*:Enabled:McAfee Network Agent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :



Files with Hidden Attributes :

Sat 15 Dec 2007 31 A..H. --- "C:\WINDOWS\uccspecc.sys"
Fri 7 May 2004 54,384 A..H. --- "C:\Program Files\America Online 9.0\aolphx.exe"
Fri 7 May 2004 156,784 A..H. --- "C:\Program Files\America Online 9.0\aoltray.exe"
Fri 7 May 2004 31,344 A..H. --- "C:\Program Files\America Online 9.0\RBM.exe"
Tue 12 Jul 2005 54,872 A..H. --- "C:\Program Files\America Online 9.0a\AOLphx.exe"
Tue 12 Jul 2005 31,832 A..H. --- "C:\Program Files\America Online 9.0a\rbm.exe"
Wed 29 Aug 2007 1,603,097 A.SH. --- "C:\WINDOWS\system32\hhkmp.tmp"
Mon 17 Sep 2007 2,022,678 A.SH. --- "C:\WINDOWS\system32\hhkmp.bak1"
Tue 18 Sep 2007 2,011,633 A.SH. --- "C:\WINDOWS\system32\hhkmp.bak2"
Fri 24 Aug 2007 1,606,463 A.SH. --- "C:\WINDOWS\system32\jjllm.tmp"
Fri 25 Aug 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 8 Jun 2008 20,487 A.SHR --- "C:\Program Files\McAfee\MQC\MRU.bak"
Sun 8 Jun 2008 265 A.SHR --- "C:\Program Files\McAfee\MQC\qcconf.bak"
Mon 11 Jun 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 25 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BITA9.tmp"
Wed 29 Aug 2007 358 ...HR --- "C:\WINDOWS\system32\drivers\etc\Hosts.bak"
Thu 17 Jan 2008 19,968 ...H. --- "C:\Documents and Settings\Holly Potts\Application Data\Microsoft\Word\~WRL0004.tmp"
Tue 1 Apr 2008 38,912 ...H. --- "C:\Documents and Settings\Holly Potts\Application Data\Microsoft\Word\~WRL1434.tmp"
Tue 1 Apr 2008 51,200 ...H. --- "C:\Documents and Settings\Holly Potts\Application Data\Microsoft\Word\~WRL2824.tmp"

Finished!


Malwarebyles Log Attached ------------------------------------------------------------------------------------------------------------------------


Malwarebytes' Anti-Malware 1.15
Database version: 841

10:53:04 PM 6/8/2008
mbam-log-6-8-2008 (22-53-04).txt

Scan type: Quick Scan
Objects scanned: 47339
Time elapsed: 19 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:46 AM

Posted 09 June 2008 - 07:35 AM

It appears you have been using Coupons.com. Please read A Closer Look at Coupons.com

Also let us know how your computer is running now.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 09 June 2008 - 05:48 PM

My wife says she does not use or never used coupons .com.

The computer seems to be running fine excpet I lost connectivity of my external hard drive. It using USB 2.0 and I tried all of the USB ports on the computer. It will not show the HD. I also tried a external USB expander it will not recognize that either.

#13 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 09 June 2008 - 07:20 PM

I did try connected the external USB hard to my laptop and it works fine. Therefore, It must be a problem with the USB ports on the home computer. Could a virus somehow disable the USB ports on my Dell computer? If so how can i fix them?

#14 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:08:46 AM

Posted 09 June 2008 - 07:56 PM

Go to device manager

start>run> devmgmt.msc

what does it show for your usb, enhanced, root hubs
Chewy

No. Try not. Do... or do not. There is no try.

#15 tiredofmalware

tiredofmalware
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:07:46 AM

Posted 10 June 2008 - 05:52 PM

It shows I have 6 USB Root Hubs, 4 Rev 5 or Later USB Host Companion Controllers and 2 VIA USB Enhanced Controllers. I do have a USB port Expander connected to the computer but my HD does not show up when its connected to the expander or directly the theb USB ports in the back or front of the computer. Yet when I plug it into the USB port on any other computer it works fine.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users