Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't access Spybot and other problems


  • This topic is locked This topic is locked
9 replies to this topic

#1 ArcticJoe

ArcticJoe

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 29 March 2009 - 11:15 AM

Hi everyone! Looks like a great forum you've got here. I'll tell you about my problem and hope one of you can solve it for me.

HP dv9408nr laptop running Vista (I really want XP back)

My machine was getting slower and I knew it was infected. I finally decided to do something about it and that's when all this got started. A fellow on a snowmobile forum i hang out with seems very knowledgeable in the computer department which I am not. (talk to me like a child). Anyway, he gave me his suggestion for a security/antivirus setup. It is as follows:

Avast home fee edition (registered)
Ad Aware
Spybot
Ccleaner
Malwarebytes
Free use of system mechanic once a year (done)

I had a paid version of Webroot Spysweeper installed prior to this. I have since removed it per his advice.

So, everything was going great until I tried to download spybot (from file hippo where i got everything else). It let me download the setup engine but wouldnt finish the install. I would get to the part saying downloading files to your computer. The file indicated would be updallocator.php . It sits that way for awhile and then a message pops up saying connection to the server was reset. When I try to go to WWW.safer-networking.org or any of their forums through search engine results the same message pops up. I'm definitely being blocked from getting anywhere near spybot. Now, my buddy eventually told me to uncheck the update during installation box. This let me finish installing spybot. He also provided a link to a website to update spybot once installed. I did that. Now when I try update through spybot I get an error message saying "error retrieving update file". I have scanned with all the above mentioned scanners front to back, top to bottom, in different orders, with restarts in between, etc.... They all come up clean now but still no access to spybots website or updates. I also ran spybot as administrator and Immunized so that everything shows up in the protected column.

Another thing to note is that just before I decided to research and repair my problems I did click on a link to a false youtube video that showed up in a message from a friend on Facebook. I replied to her telling her the link didn't work and she said she didn't sent the message, it was a virus, it wrecked her computer, and that she wished me well. Damn.

I know one of you fine computer experts can help me out of this mess right? My computer seems to be running fine and some of the glitchy things it was doing went away while some new ones also showed up. It takes awhile for a browser window to open, the screen goes black for longer periods of time when vista asks permission to do things, etc...

What should I do people? What info do you need? I'll do anything you ask so long as it isn't for a naked picture. ha ha ha ha :thumbsup:

BC AdBot (Login to Remove)

 


#2 Guest_superbird_*

Guest_superbird_*

  • Guests
  • OFFLINE
  •  

Posted 29 March 2009 - 11:20 AM

Hi,

Welcome here on the forums. :thumbsup:

Could you please do a new, full scan, with MalwareBytes' Anti-Malware?
(Don't forget to update MBAM first)
Post that logfile in your next reply. :flowers:

#3 ArcticJoe

ArcticJoe
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  

Posted 29 March 2009 - 01:21 PM

Thanks for the fast reply and the interest in my problem. I updated malwarebytes and ran a full scan. Came up clean as a whistle. Below is the log. What should be my next step?

Malwarebytes' Anti-Malware 1.35
Database version: 1916
Windows 6.0.6001 Service Pack 1

3/29/2009 1:19:41 PM
mbam-log-2009-03-29 (13-19-41).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 225492
Time elapsed: 1 hour(s), 18 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#4 Guest_superbird_*

Guest_superbird_*

  • Guests
  • OFFLINE
  •  

Posted 29 March 2009 - 01:24 PM

Hi,

Please use the Internet Explorer browser (or FireFox with IETab), and do an online scan with Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
  • Once the files are downloaded click on Next
  • Click on Scan Settings and configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:Scan Archives
      Scan Mail Bases
  • Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
Posted Image
Posted Image
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.

#5 ArcticJoe

ArcticJoe
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 29 March 2009 - 08:51 PM

I ran the kaspersky online scanner just as directed in the above reply. It came up clean as well after about a 3 hour scan. I did save and post the log below. FYI, I also ran a spybot search which came up clean as well. So today, I've run a scan from malwarebytes, avast, spybot, and kaspersky. All clean. Next step? Thanks so much for the help too. It amazes me when a total stranger will devote time to someone they've never met.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, March 29, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, March 29, 2009 20:59:12
Records in database: 1985226
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 160693
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 03:06:09

No malware has been detected. The scan area is clean.

The selected area was scanned.

#6 Guest_superbird_*

Guest_superbird_*

  • Guests
  • OFFLINE
  •  

Posted 30 March 2009 - 12:29 AM

Hi,

Which problems do you still have? :thumbsup:

#7 ArcticJoe

ArcticJoe
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  

Posted 30 March 2009 - 06:53 PM

Superbird, I still can't access www.safer-networking.org or www.forums.spybot.info Nor will spybot update itself, I have to get the updates manually. Also, my wifes old ass laptop we haven't used in a year also says cannot connect to server when trying to access either site. This alone doen't bother me much, but it does make me wonder what else is going on in my machine. Any other info I can post that will be of help, please let me know. I can run Hijack this and we can get the post moved over there if it would help you.

Thanks

#8 Guest_superbird_*

Guest_superbird_*

  • Guests
  • OFFLINE
  •  

Posted 31 March 2009 - 06:43 AM

Hi,

Yes, I'm going to redirect you to the HijackThissection of this forum. This, because it's a deeper infection, we cannot handle here.
Read this page and follow it's steps: http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

Give them a link to this topic, so they can see what already has been done.

Good luck. :thumbsup:

#9 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,806 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:11 AM

Posted 04 April 2009 - 10:46 AM

Hello ArcticJoe,

Since your DDS log was gibberish, I have deleted the new topic in the HiJack This forum. Please try this instead of DDS: Download RSIT by random/random and save it to your Desktop.
Note: You will need to run this tool while connected to the Internet so it can download HijackThis if it is not located on your system. If you get a warning from your firewall or other security programs regarding Rist attempting to contact the Internet, please allow the connection.
  • Close all applications and windows so that you have nothing open and are at your Desktop.
  • Double-click on RSIT.exe to start the program.
  • If using Windows Vista, be sure to Run As Administrator.
  • Click Continue after reading the disclaimer screen.
  • Leave the drop down box set to default: "List/folders created or modified in the last 1 month (30 days).
  • When the scan is complete, a text file named log.txt will automatically open in Notepad.
  • Please start a new topic and post your log in the HijackThis Logs and Malware Removal forum, NOT here.
  • Be sure to mention that you tried to follow the Prep Guide but were unable to get DDS to run.
If RSIT did not work, then reply back here and we will try something else.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#10 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,806 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN

Posted 04 April 2009 - 07:29 PM

Ah, good. I see you were successful in running RSIT.

Now that you have a log posted here: http://www.bleepingcomputer.com/forums/t/216752/unknown-infection-hijack-and-rist-logs-included/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom :thumbsup:

Edited by Orange Blossom, 04 April 2009 - 07:33 PM.
Fix code tags. ~ OB

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users