Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cannot access antivirus programs


  • Please log in to reply
11 replies to this topic

#1 cbrooks302

cbrooks302

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 18 November 2008 - 09:42 AM

Windows xp. cable modem.
I cannot get an updated antivirus program to run on my computer. My original program, CA Security Center stopped updating a month ago.
Have tried downloading others but can only get older versions, if anything, such as Vipre. It also cannot update. Both say there is no connection to internet. When I try to bring up antivirus web pages, I get- "internet explorer cannot display webpage" or it brings me somewhere else. Online scan pages all come up with errors so they cannot run.
I was able to download/ run Mcafee's stinger, which let me get Malwarebytes anti-malware, which did remove a few things.
trojan.dnschanger- several instances. every couple of days, it gets more. Have run spybot several times as well each time it finds and fixes
zlob.
I have also run Ccleaner and have system restore turned off.
I have also deleted a few entries with Hijackthis and still keep getting errors with internet explorer version 7. When IE brings me to a wrong websight, I start getting popups even though they are blocked.
Can somebody please point me in the right direction?
My sons laptop, windows vista, wireless, has all the same problems.

BC AdBot (Login to Remove)

 


#2 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:10:57 PM

Posted 18 November 2008 - 01:20 PM

DNSChanger can be very stubborn...

Let's start with Malwarebytes. Please update and rerun Malwarebytes. Post a fresh log.
Next, check your wireless router. Unplug it from your outside connection and change the administrator password. Also check to make sure your DNS settings are set to automatic.

Thanks,
rigel

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#3 cbrooks302

cbrooks302
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 18 November 2008 - 04:52 PM

Malwarebytes has found 6 more entries of dns changer. Other things done. DNS settings were and are on automatic.
Here is Mbam log-
11/18/2008 4:47:18 PM
mbam-log-2008-11-18 (16-47-18).txt

Scan type: Full Scan (C:\|)
Objects scanned: 143166
Time elapsed: 2 hour(s), 30 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.128 85.255.112.149 1.2.3.4 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3ba0b0cc-e0ca-4f51-8ac1-cf96bbfb50c4}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.128 85.255.112.149 1.2.3.4 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.128 85.255.112.149 1.2.3.4 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3ba0b0cc-e0ca-4f51-8ac1-cf96bbfb50c4}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.128 85.255.112.149 1.2.3.4 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.128 85.255.112.149 1.2.3.4 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{3ba0b0cc-e0ca-4f51-8ac1-cf96bbfb50c4}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.128 85.255.112.149 1.2.3.4 -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#4 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:10:57 PM

Posted 18 November 2008 - 08:07 PM

Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#5 cbrooks302

cbrooks302
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 18 November 2008 - 08:53 PM

Here are the results from smitfraudfix.
Thank you
Cbrooks

SmitFraudFix v2.375

Scan done at 20:42:41.37, Tue 11/18/2008
Run from C:\Program Files\America Online 9.0a\download\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\svcprs32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\INITIO\Button Manager v1.874\inihid.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\ArcSoft\TotalMedia Backup & Record\uBBMonitor.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\America Online 9.0a\shellmon.exe
C:\Program Files\Common Files\AOL\1135907049\ee\aolsoftware.exe
C:\Program Files\America Online 9.0a\download\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

hosts


C:\


C:\WINDOWS


C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\WINDOWS\system32\LogFiles


C:\Documents and Settings\Owner


C:\DOCUME~1\Owner\LOCALS~1\Temp


C:\Documents and Settings\Owner\Application Data


Start Menu


C:\DOCUME~1\Owner\FAVORI~1


Desktop


C:\Program Files


Corrupted keys


Desktop Components



o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_Dlls"=dword:00000001


Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


RK



DNS



Scanning for wininet.dll infection


End

#6 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:10:57 PM

Posted 18 November 2008 - 09:00 PM

Disconnect your computer from the internet by unplugging your network cable from your router.
Double-click SmitfraudFix.exe
Select #5 Search and clean DNS Hijack
Please reboot your computer, reconnect your router, and then post the report found at the root of the system drive, usually at C:\rapport.txt

I recommend changing the password of your router. This type of infection is designed to take over - we are taking back.

Please also rerun Malwarebytes and post a new log.

Thanks!

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#7 cbrooks302

cbrooks302
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 19 November 2008 - 07:58 AM

Thank you,
Here are the results of the scans,
Also by reseting the router, My antivirus program just updated itself. First time in a month.

SmitFraudFix v2.375

Scan done at 7:24:05.07, Wed 11/19/2008
Run from C:\Documents and Settings\Owner\My Documents\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

DNS Before Fix

HKLM\SYSTEM\CS3\Services\Tcpip\..\{3BA0B0CC-E0CA-4F51-8AC1-CF96BBFB50C4}: DhcpNameServer=85.255.112.128 85.255.112.149 1.2.3.4
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=85.255.112.128 85.255.112.149 1.2.3.4

DNS After Fix

HKLM\SYSTEM\CS3\Services\Tcpip\..\{3BA0B0CC-E0CA-4F51-8AC1-CF96BBFB50C4}: DhcpNameServer=85.255.112.128 85.255.112.149 1.2.3.4
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=85.255.112.128 85.255.112.149 1.2.3.4
----------------------------------------
Malwarebytes' Anti-Malware 1.30
Database version: 1409
Windows 5.1.2600 Service Pack 3

11/19/2008 7:39:51 AM
mbam-log-2008-11-19 (07-39-51).txt

Scan type: Quick Scan
Objects scanned: 67943
Time elapsed: 13 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.128 85.255.112.149 1.2.3.4 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{3ba0b0cc-e0ca-4f51-8ac1-cf96bbfb50c4}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.128 85.255.112.149 1.2.3.4 -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#8 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:10:57 PM

Posted 19 November 2008 - 08:25 AM

Good morning.

On more thing to try. If we don't have positive results, we need to refer you to the HJT forum.

Click Start - Run. The run dialog box will open.
Type "cmd" <= without the quotes
A DOS window will open.
Type "ipconfig /flushdns" <= without the quotes.
Restart your computer.

Rerun Malwarebytes and post a new log.

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#9 cbrooks302

cbrooks302
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 19 November 2008 - 10:57 PM

Thank you, Rigel. Looks pretty good now. Malwarebytes came up with nothing this time. Vipre removed 99 low level threats this afternoon. None were dnschanger.
I suppose I should start a new thread with this- my second computer (also running xp) only boots in safe mode. When it tries to start normally, it comes up "hard error" and tries to restart over and over.

Malwarebytes' Anti-Malware 1.30
Database version: 1412
Windows 5.1.2600 Service Pack 3

11/19/2008 10:45:51 PM
mbam-log-2008-11-19 (22-45-51).txt

Scan type: Quick Scan
Objects scanned: 67390
Time elapsed: 11 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#10 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:10:57 PM

Posted 20 November 2008 - 07:58 PM

Welcome back! First let's talk computer #1

If there are no more problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok"
  • Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" Tab.
  • Click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Computer #2
What do you mean by hard error? I have seen reboots caused by hard drive failures, power supplies set to the wrong voltage, and corrupt drivers. You may want to look at this topic: Hard Drive Installation and Diagnostic Tools

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#11 cbrooks302

cbrooks302
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 22 November 2008 - 06:44 PM

the error as it reads comes on right after the screen turns blue-

stop: c000218; unknown hard error
unknown hard error

it boots to safe mode without a problem, but I don't know what to look for after that.
I am going to try and make a bootable disk and try that.

#12 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:10:57 PM

Posted 22 November 2008 - 09:36 PM

Stop message 0xC0000218 Descriptive text: UNKNOWN_HARD_ERROR It's worth a shot. You can also post that error code to the forum that fits your Operating System.

Take care...

rigel

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users