Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With Downloader.zlob!gen.3/trojan


  • Please log in to reply
14 replies to this topic

#1 mrhippopotamus

mrhippopotamus

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 09 August 2008 - 08:39 PM

Hello,
I am using xp home sp2
msi rs480-ms motherboard
amd 3200+ w/ 1.5 gig ram
two 160 gig sata drives

The problem is that I was infected with what I believe is downloader.Zlob!gen.3 and downloader.trojan. I have avast!, have updated and scanned all drives, I have used ad-aware se, have updated and scanned all drives, have used SmitfraudFix ran steps 1 and 2, have ran vundofix results were negative, have spybot search and destroy have updated and done a partial scan. Have done a regedit for downloader.zlob!gen.3 and downloader.trojan and deleted all related entries.

I don't believe that these issues have been resolved because my computer will reboot after getting past my log in user screen (previously it booted past this screen directly to desktop), now once I click log in admin/user it just powers down and reboots. I can get into safe mode where the previous steps were done, but my real concern is now the cpu fan will stop once I boot into safe mode. My Pc shut down during a scan (spybot s&d) in safe mode and this is when I noticed the fan was not running, my system is normally quite so there was no audible fan sound to miss. Is it safe to run long enough to post a hj this log? Any ideas on these downloader items?


P.S. I started all of this by opening instead of deleting a file that I had already scanned with avast! I just hit the wrong button because I was not paying complete attention. All of this could have been avoided if i would have clicked the correct button to begin with.

Thanks in Advance for your time and help.
MrH

Edit: Moved topic from XP to the more appropriate forum. ~ Animal

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:54 AM

Posted 09 August 2008 - 11:22 PM

Hello I am hoping you can complete a Quick scan withthis..

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Reagardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 09 August 2008 - 11:46 PM

hello thank you for your help,
here is the log,
i did need to reboot after the scan

Malwarebytes' Anti-Malware 1.24
Database version: 1036
Windows 5.1.2600 Service Pack 2

11:42:35 PM 8/9/2008
mbam-log-8-9-2008 (23-42-35).txt

Scan type: Quick Scan
Objects scanned: 41235
Time elapsed: 3 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 12
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 27

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{b1e68d42-02c4-465b-8368-5ed9b732e22d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{6d0111e3-3060-4d23-b2bc-42ed86cbe9a3} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{72a128e0-2240-40c8-9e92-5387d64f839e} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xmllib.xmldp (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xmllib.xmldp.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bgrqfetx.bdbn (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bgrqfetx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\tfnslopk (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\xml2u32h.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\eekf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\0.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\4.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\VAV\vav.cpl (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
C:\Program Files\VAV\vav.ooo (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\lnvegaow.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Application Data\TmpRecentIcons\Vista Antivirus 2008.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.

#4 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 09 August 2008 - 11:54 PM

upon reboot i am able to actually log on to my pc. spybot is finishing its scan .... should i do anything ??? rerun mbam ... my desktop say that my computer has just recovered from a serious error and that active desktop has been turned off do i want to restore active desktop

#5 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 09 August 2008 - 11:55 PM

cpu fan is still not running it turns off as soon as the os boots (windows loading screen)

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:54 AM

Posted 10 August 2008 - 12:02 AM

Yes check for an update for MBam then scan again ,post another log.

Follow that with
Download Attribune's ATF Cleaner and then SUPERAntiSpyware, Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.

Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.


Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opers browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program
.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 10 August 2008 - 01:27 AM

here are the results:

Malwarebytes' Anti-Malware 1.24
Database version: 1036
Windows 5.1.2600 Service Pack 2

12:10:27 AM 8/10/2008
mbam-log-8-10-2008 (00-10-27).txt

Scan type: Quick Scan
Objects scanned: 42076
Time elapsed: 5 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 14
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (h:mm:ss tt) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)








and SUPER results:




SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/10/2008 at 01:14 AM

Application Version : 4.15.1000

Core Rules Database Version : 3531
Trace Rules Database Version: 1520

Scan type : Complete Scan
Total Scan Time : 00:53:58

Memory items scanned : 111
Memory threats detected : 0
Registry items scanned : 6978
Registry threats detected : 11
File items scanned : 119336
File threats detected : 4

Trojan.Unclassified/BGRQFETX
HKLM\Software\Classes\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}
HKCR\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}
HKCR\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}
HKCR\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}\InprocServer32
HKCR\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}\InprocServer32#ThreadingModel
HKCR\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}\ProgID
HKCR\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}\Programmable
HKCR\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}\TypeLib
HKCR\CLSID\{72B68A1C-58DD-41B5-B619-D78A182A77D9}\VersionIndependentProgID
C:\WINDOWS\BGRQFETX.DLL

Rootkit.Unclassified/SysDamp-Traces
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Reserved

Trojan.Unknown Origin
C:\WINDOWS\CHECK012906.INI

Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\JJJLM.INI
C:\WINDOWS\SYSTEM32\JJJLM.INI2

#8 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 10 August 2008 - 01:57 AM

looks like you had to leave for the evening, i understand, that scan took an hour, its now two in the morning here i posted the requested results. I did burn off some irreplaceable items so if that screws anything up it had to be done. I will be gone tommorrow to put a roof on a friends house and won't be back until the evening hopefuly we can meet up again later. Thanks again for all your help so far.

Edited by mrhippopotamus, 10 August 2008 - 02:26 AM.


#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:54 AM

Posted 10 August 2008 - 10:14 PM

Ok making progress.. Looks like you'll need to update and run the MBam again. Some times it takes several scans and tools. Tell me how the PC is now too.
Be careful up there.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 11 August 2008 - 09:52 AM

Thanks I Was careful but sure am sore!
Here are the latest scan results, Hope this means we got it!
The Pc no longer boots to my desktop but stops at a login account window, other than that i seem to be running normally, there was an issue with the desktop always being white but took care of that. Otherwise i can't say anything is acting funny.


Malwarebytes' Anti-Malware 1.24
Database version: 1040
Windows 5.1.2600 Service Pack 2

9:49:18 AM 8/11/2008
mbam-log-8-11-2008 (09-49-18).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|J:\|)
Objects scanned: 154203
Time elapsed: 1 hour(s), 2 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Edited by mrhippopotamus, 11 August 2008 - 09:56 AM.


#11 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 13 August 2008 - 04:03 PM

Sorry it took so long to get back, Have you had a chance to glance over the latest scan? Should I do anything else? Thanks again for your help boopme.

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:54 AM

Posted 13 August 2008 - 04:08 PM

Yes, actually ...you look good. No more signs or acting up ?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 13 August 2008 - 04:17 PM

it still stops booting at the account log in window instead of booting to my desktop, and the cpu fan stops after os starts to boot, after memory scan and drive detection. So i think the my previous settings were changed (like my desktop background settings) and i just need to remember what they were to boot to my desktop. As for the Fan, it may be the fan its self not sure though. Other wise in great shape! Thanks

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:54 AM

Posted 13 August 2008 - 05:59 PM

Hi, yes I think those 2 items are no longer malware. The boot sequence may have been altered by the malware or not,but the fan is another problem. Ask in the XP foum about these. They can tell you how to restore the settings. When done at least with the boot issue you will want to set a new restore point so you don't accidentally restore the PC to the infected state.. You can ask me for that here later.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 mrhippopotamus

mrhippopotamus
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 14 August 2008 - 02:41 PM

I haven't got around to the boot item but the fan turned out to be a bios setting...




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users