Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Got seriously attacked - just about every bug Ive seen on here


  • Please log in to reply
25 replies to this topic

#1 srt4geezer

srt4geezer

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 05 May 2009 - 03:59 PM

Not sure what to do. Of course I tried AVG but it is ineffective. Won't update now. Malwarebytes is dead. I tried following the steps recommended in a few other similar threads but to no avail. Had to load & now use firefox to even get on the internet.

Running XP on my laptop.

Edited by srt4geezer, 05 May 2009 - 04:00 PM.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:48 PM

Posted 05 May 2009 - 04:22 PM

Some types of malware will disable MBAM and other security tools. If MBAM will not install, try renaming it.

Before saving any of your security programs, rename them first. For example, before you save Malwarebytes', rename it to something like MBblah.exe and then click on Save and save it to your desktop. Same thing after you install it. Before running it, rename the main executable file first
***
Right-click on the mbam-setup.exe file and change the .exe extension to .bat, .com, .pif, or .scr and then double-click on it to run.

If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files, right-click on mbam.exe and change the .exe as noted above. Then double-click on it to run..


***
Another work around is by not using the mouse to install it, Just use the arrow keys, tab, and enter keys.
***
Open up command prompt, type in following commands:
XP >> click the Start menu at the lower-left of your computer's desktop and select "Run". Type cmd into the Run box and click "OK".
Vista >> click the Start menu at the lower-left of your computer's desktop and Type cmd in the search box.

regsvr32 mbamext.dll
regsvr32 ssubtmr6.dll
regsvr32 vbalsgrid6.ocx
regsvr32 zlib.dll

****

If you cannot use the Internet,you will need access to another computer that has a connection.
From there save mbam-setup.exe to a flash,usb,jump drive or CD. Now transfer it to the infected machine, then install and run the program.
If you cannot transfer to or install on the infected machine, try running the setup (installation) file directly from the flash drive or CD by double-clicking on mbam-setup.exe so it will install on the hard drive.

Manually Downloading Updates:
Manually download them from HERE and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.

***
Try this random renamer for MBAM
http://kixhelp.com/wr/files/mb/randmbam.exe
****
Try using a System Retore Point prior to the date of infection. You may be able to update and run MBam. Note this did not remove the malware.
Windows XP System Restore Guide
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 05 May 2009 - 06:12 PM

OK, got it to open. Thank you. renaming worked. Scanning now. Selected quick scan.

#4 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 05 May 2009 - 06:30 PM

Hey, only 51. Lol

Here is the log:

5/5/2009 4:30:20 PM
mbam-log-2009-05-05 (16-30-10).txt

Scan type: Quick Scan
Objects scanned: 83952
Time elapsed: 10 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 16
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 2
Files Infected: 27

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Cognac (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\webmedia.chl (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup (Trojan.Zlob) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6113c6eb-4d63-4c3a-b20c-3621180c4756}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{6113c6eb-4d63-4c3a-b20c-3621180c4756}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{6113c6eb-4d63-4c3a-b20c-3621180c4756}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> No action taken.

Folders Infected:
C:\Program Files\WebMediaViewer (Trojan.Zlob) -> No action taken.
C:\Program Files\Antivirus 2009 (Rogue.Antivirus2008) -> No action taken.

Files Infected:
C:\Program Files\WebMediaViewer\browseu.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\Online Spyware Test.lnk (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\Run Virus Scan.lnk (Trojan.Zlob) -> No action taken.
C:\WINDOWS\system32\lD8r5RK2.exe.a_a (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng2.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng3.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng4.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng5.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng6.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng7.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng8.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng9.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngA.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngB.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngC.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngD.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngE.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngF.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\jason.andrews\My Documents\My Music\My Music.url (Trojan.Zlob) -> No action taken.
C:\Documents and Settings\jason.andrews\My Documents\My Pictures\My Pictures.url (Trojan.Zlob) -> No action taken.
C:\Documents and Settings\jason.andrews\My Documents\My Videos\My Video.url (Trojan.Zlob) -> No action taken.
C:\Documents and Settings\jason.andrews\My Documents\My Documents.url (Trojan.Zlob) -> No action taken.
C:\WINDOWS\Temp\tempo-926640.tmp (Trojan.DNSChanger) -> No action taken.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\~tmph.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Run Virus Scan.url (Trojan.Zlob) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Run Virus Scan.url (Trojan.Zlob) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Online Spyware Test.url (Trojan.Zlob) -> No action taken.

#5 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 05 May 2009 - 07:02 PM

OK, ran the remove action:


5/5/2009 4:50:14 PM
mbam-log-2009-05-05 (16-50-14).txt

Scan type: Quick Scan
Objects scanned: 83952
Time elapsed: 10 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 16
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 2
Files Infected: 27

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Cognac (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\webmedia.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6113c6eb-4d63-4c3a-b20c-3621180c4756}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{6113c6eb-4d63-4c3a-b20c-3621180c4756}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{6113c6eb-4d63-4c3a-b20c-3621180c4756}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.230,85.255.112.114 -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\WebMediaViewer (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Program Files\Antivirus 2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\WebMediaViewer\browseu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Program Files\WebMediaViewer\Online Spyware Test.lnk (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Program Files\WebMediaViewer\Run Virus Scan.lnk (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lD8r5RK2.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bng9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngA.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngB.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngC.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngD.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngE.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\bngF.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\My Documents\My Music\My Music.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\My Documents\My Pictures\My Pictures.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\My Documents\My Videos\My Video.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\My Documents\My Documents.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\tempo-926640.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Documents and Settings\jason.andrews\Local Settings\Temp\~tmph.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Run Virus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Run Virus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.

#6 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 05 May 2009 - 07:18 PM

Rebooted & scanned again:

Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 3

5/5/2009 5:16:55 PM
mbam-log-2009-05-05 (17-16-55).txt

Scan type: Quick Scan
Objects scanned: 83896
Time elapsed: 9 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



There is a purchase option. Is the free version of AVG good once you clean the PC up or should I go with malwarebytes service?

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:48 PM

Posted 05 May 2009 - 11:13 PM

Hello, You did well here .I would like you to run these as I feel you will find a little more.
AVG and mlaware bytes are different tools MBAm is not an AV but is definately worth having. I for one prefer AVIra as an AV,but that is your choice.
You acn find both here.. http://www.bleepingcomputer.com/forums/topic3616.html

Run ATF and SAS:
From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining
.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program
.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 05 May 2009 - 11:53 PM

Downloaded ATF & Super from your links to my desktop. Super is first on your list, it encounters an error as soon as I select run to launch install. I'm not going to do ATF til u tell me an idea about super.
Here's the error: SUPERAntiSpyware Free Edition has encountered a problem and needs to close. We are sorry for the inconvenience.

FYI, AVG free installs and updates, but won't run because it says it has a licensing problem. It's 0 for 2 on the free stuff.

Edited by srt4geezer, 05 May 2009 - 11:54 PM.


#9 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 06 May 2009 - 05:57 PM

Bump

I have a bunch of scetchy processes running when I look in tasc manager. Can't copy/paste. How do I post a list of them short of writing them all down?

Edited by srt4geezer, 06 May 2009 - 05:59 PM.


#10 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:48 PM

Posted 07 May 2009 - 02:48 PM

Hi, sorry major electrical issues here...
Inserting An Image Within A Post

Is the PC running well other than this?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#11 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 07 May 2009 - 10:49 PM

A bit better, like when I first got infected. It is still redirecting searches in either google or yahoo. Have not tried running explorer. That seems to really set it off so i'm running firefox.
Here are my processes screen shots:

Posted Image

List too long for single screen
Posted Image

#12 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 08 May 2009 - 11:21 AM

Bump

#13 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:48 PM

Posted 08 May 2009 - 02:19 PM

Ok run the ATF
We need to kill a lot of those processes. I am looking at what to leave.. There are way too many running.

You still can not update MBAm and scan?

can we run Part 1 of S!Ri's SmitfraudFix
Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#14 srt4geezer

srt4geezer
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 08 May 2009 - 02:56 PM

MBam is fine. Scans are now clean, but stuff is hiding from it.

When I get home I will download SmitfraudFix. Then I will run step 1 & report back.

#15 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:48 PM

Posted 08 May 2009 - 03:18 PM

Ok ,just checking since MBAM is at 2098 and your last one shoen was 1945..
You can End most the proceses in Task manager except..SYSTEM
Explorer.exe, svchost.exe, and System Idle Process are needed for the computer to run right. In most cases, you can simply restart these within the computer. Explorer.exe can be started from the task manager's 'New Task..." option without restarting or doing much of anything.
If you don't know what it is, leave it.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users