Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Fake Errors?


  • This topic is locked This topic is locked
24 replies to this topic

#1 tia08

tia08

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 05:31 AM

Posted Image

that is what pops up.
but when i scan my computer with AVG 8 it says no infections.

please help asap.

BC AdBot (Login to Remove)

 


#2 tia08

tia08
  • Topic Starter

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 07:38 AM

Can anyone online please help me ?
I need help ASAP. I think i am gonna cry.

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:38 PM

Posted 02 July 2008 - 07:47 AM

What OS (Win 2K, XPsp1, XPsp2, Vista) are you using? Have you tried doing your AVG scans in "Safe Mode"?

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Instructions with screenshots if needed.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 tia08

tia08
  • Topic Starter

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 07:56 AM

I'm using Vista.
I am right now scanning with malwarebytes & it's been running full scan so should i just let it scan until its done?
I started this a while ago.

So it should be done soon.

BTW. I'll be online until i solve this issue , can you please stay online to help me?

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:38 PM

Posted 02 July 2008 - 08:01 AM

MBAM does not take long unless your doing a Full scan (as you mentioned). If it hangs up, try doing a Quick scan.

I, like most members here are volunteers who assist at this site as time permits. I'm at work right now but do try to check in periodically.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 tia08

tia08
  • Topic Starter

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 08:17 AM

Malwarebytes been running for 1 hour 5 minutes 25 seconds +

I will keep you updated.

#7 tia08

tia08
  • Topic Starter

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 12:04 PM

Quick Scan with malwarebytes
BTW. I rebooted it as stated there was an error message that popped up.
Posted Image





Malwarebytes' Anti-Malware 1.19
Database version: 913
Windows 6.0.6001 Service Pack 1

2:45:59 AM 7/3/2008
mbam-log-7-3-2008 (02-45-57).txt

Scan type: Quick Scan
Objects scanned: 36114
Time elapsed: 30 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 6
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1eb4bf0f-852f-4b75-b8fb-21edaf9dc3c8} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DelayLoad (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b87e458c (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{1eb4bf0f-852f-4b75-b8fb-21edaf9dc3c8} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\System32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\System32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\DRTO\AppData\Local\Temp\atmadm2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\System32\fccaWNdE.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\DRTO\AppData\Local\Temp\hgGxVOij.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\DRTO\AppData\Local\Temp\pmnmmMEU.dll (Trojan.Agent) -> Delete on reboot.
C:\Users\DRTO\AppData\Local\Temp\hyikvqrw.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\System32\ddcYpoLC.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Edited by tia08, 02 July 2008 - 12:07 PM.


#8 tia08

tia08
  • Topic Starter

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 12:26 PM

Is there anything else I can/need to do?
Please? I need major help.

#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:38 PM

Posted 02 July 2008 - 12:42 PM

Did you reboot the computer after using MBAM? If it encounters a file that is difficult to remove, you need to restart the computer so the malware can be fully removed. Failure to do so will prevent MBAM from removing all the malware. Your log indicates some files will be deleted on reboot. If you have not rebooted, make sure you do this. When done, rescan again with MBAM, click the Logs tab and copy/paste the contents of the new report in your next reply.

It's not unusual to receive such an error after using tools to remove malware infection.

A "Cannot find...", "Could not run...", "Error loading... or "specific module could not be found" message is usually related to malware that was set to run at startup but has been deleted. Windows is trying to load this file but cannot locate it since the file was mostly likely removed during an anti-virus or anti-malware scan. However, an associated orphaned registry entry remains and is telling Windows to load the file when you boot up. Since the file no longer exists, Windows will display an error message. You need to remove this registry entry so Windows stops searching for the file when it loads.

To resolve this, download Autoruns, search for the related entry and then delete it.
  • Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there. (click here if you're not sure how to do this.)
  • Open the folder and double-click on autoruns.exe to launch it.
  • Please be patient as it scans and populates the entries.
  • When done scanning, it will say Ready at the bottom.
  • Scroll through the list and look for a startup entry related to the file(s) in the error message.
  • Right-click on the entry and choose delete.
  • Reboot your computer and see if the startup error returns.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 tia08

tia08
  • Topic Starter

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 12:55 PM

So you want me to rescan it with the same program? "Quick Scan right?"

If so i'll do so as soon as you answer.

BTW. if you mean deleting a registry.
Can i do that in ccleaner?

#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:38 PM

Posted 02 July 2008 - 01:13 PM

Yes do a Quick Scan and use Autoruns to look for the entry related to that file.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 tia08

tia08
  • Topic Starter

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 01:23 PM

* Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there. (click here if you're not sure how to do this.)


Do you mean go to computer compaq and in that folder make a new folder called AutoRuns?
Can't I just extract it to my desktop?











HERE IS THE MBAM LOG












Malwarebytes' Anti-Malware 1.19
Database version: 913
Windows 6.0.6001 Service Pack 1

4:21:26 AM 7/3/2008
mbam-log-7-3-2008 (04-21-26).txt

Scan type: Quick Scan
Objects scanned: 35509
Time elapsed: 9 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Edited by tia08, 02 July 2008 - 01:23 PM.


#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:38 PM

Posted 02 July 2008 - 01:42 PM

That log looks much better.

You can extract Autoruns to the desktop where it will create its own folder. I usually ask folks to create a new folder so they can permanently keep Autoruns there for future use and keep the desktop tidy.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 tia08

tia08
  • Topic Starter

  • Members
  • 191 posts
  • OFFLINE
  •  
  • Local time:11:38 AM

Posted 02 July 2008 - 01:51 PM

Okay thanks.
Do I need to do anything else?
How do I make sure my computer is clean and okay?

#15 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,469 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:38 PM

Posted 02 July 2008 - 02:06 PM

How is your computer running now? Any more reports/signs of infection?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users