Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Guess it will be up to me, husband only knows how to turn computer off/on...*sigh*


  • Please log in to reply
23 replies to this topic

#1 viking22

viking22

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 16 February 2010 - 03:05 PM

I have a 5 year old Dell, with windows XP. I use McAfee and SpySweeper that are packaged with my MSN Premium fios. My husband knows nothing about computers, other than to turn it off/on, so this will be up to me. I hope.......will your help.

Found a Artemis Trojan last week by chance when I scanned with my McAfee. Didn't think much of it, I thought it put it in quarantine, and went to bed.

Next day the pop-ups started, then progressed quickly to: no system restore, can't do windows updates, can't open McAfee, SpySweeper, or internet explorer (I can click the icons, but nothing happens), actually can't open much of anything in regular mode, only in safe mode. I have been running my McAfee and SpySweeper in safe mode (and disabled the internet).

Anyway, McAfee keeps finding 2 files, but it will not give me an option to quantine them or delete them. It only says "scan at restart". (Which I have done over and over again) It says they are both DNSChanger files... What are these???

WINDOWS\system32\LUKOPIJO.dll
WINDOWS\system32\BEKODUYA.dll

My Spysweeper keeps finding a Virtumondo virus/trojan(?).

In my start-up in MSCONFIG I noticed there is a suspicious file name bizijeju.dll. What could that be?

I connected to the internet in safe mode to download the Malwarebytes, got that message that a lot of people get....."CreateProcess failed: code 2. the system cannot find the file specfied." I tred to rename the file MBAM-setup.exe file to tool.exe before downloading, and still get the same message when I tried to install.

What next? If you give me good enough guidance I can try to get through anything......
Help!
I'm typing this on my laptop

Viking22

BC AdBot (Login to Remove)

 


#2 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 16 February 2010 - 03:21 PM

Get the following free programs and use them.

Rkill:
http://www.technibble.com/rkill-repair-tool-of-the-week/

Autoruns:
http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx

After you use those, try again on Malwarebytes' Anti-Malware, renaming the file before saving it; save to desktop.
Make sure you have the latest updates before scanning.

SUPERAntiSpyware:
http://www.superantispyware.com/index.html
Make sure you have the latest updates before scanning.

If SUPERAnti-Spyware, Malwarebtes' Antimalware, find/fix infections,
you may want to delete your restore points (to ensure there are no infected restore points).
To delete all restore points, go to Control Panel, System, System Restore tab, put a checkmark in "Turn Off System Restore" and hit Apply.

(After you get all of this fixed, you will probably want to turn System Restore back on. To turn System Restore back on, go to Control Panel, System, System Restore tab, click to take the checkmark out of "Turn Off System Restore" and hit Apply. Then hit OK to close. )

Anytime an infection is found/fixed, I would advise to scan again, to ensure ALL scans come up "clean" (zero infections).

If you don't already have/use CCleaner, it is a good program, and it's free. Take the tour, see what the program does, look at the screen shots. It not only cleans your computer, it also has a Registry tool that will check for/fix registry errors, and it also has an "uninstall programs" tool and a "startup" tool (you can remove items from Startup).
The website for CCleaner is: http://www.ccleaner.com/

Please report back with results.
If we don't change the direction we are going,
We are likely to end up where we are headed.

#3 viking22

viking22
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 16 February 2010 - 03:38 PM

Sasha,

I already turned the system restore off. What good was it when I couldn't use it anyway? Must be infected.


Question about these...
Rkill:
http://www.technibble.com/rkill-repair-tool-of-the-week/

Autoruns:
http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx

Should I download them in the safemode of my infected desktop (because I can't use the regular boot up), or use my laptop then transfer with a USB memory stick?

(I will try this evening...)

#4 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 16 February 2010 - 04:31 PM

Either way will work (downloading Rkill and Autoruns) in Safe Mode, or using a USB jump drive to transfer the files.

Side Note: Infections can also enter your computer through infected USB jump drives, cd's/dvd's etc. (Not a bad idea to scan USB jump drives, external hard drives, etc.)

Better to be rid of useless/possibly infected restore points that only take up space on your hard drive.

Good luck this evening, and please report back with results :thumbsup:
If we don't change the direction we are going,
We are likely to end up where we are headed.

#5 viking22

viking22
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 16 February 2010 - 06:08 PM

I see there are 4 rkills. rkill.exe, rkill.com, rkill.scr and rkill.pif. Do I do all of them at the same time? or one at a time.

#6 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 16 February 2010 - 08:45 PM

They are all the same program.
The reason there are different ones, is because different viruses/trojans/etc will sometimes prevent your computer from being able to use certain programs that fix/detect them.
Try the first one, if you are unable to use that one on the infected computer, move on down the list, trying them in succession.
If we don't change the direction we are going,
We are likely to end up where we are headed.

#7 viking22

viking22
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 17 February 2010 - 01:17 PM

Just a quick update.

I'm having my daughter copy our photos to USB memory sticks before I go ahead. Hopefully, I can try the Rkill tonight and Autoruns tonight.

In the mean time, I'm still running my McAfee and SpySweeper again and again in Safemode (with no internet connection). McAfee no longer mentions my first two infected files, (don't know what happened to them), but did pick up 3 more that it DID put in Quarantine:
WINDOWS\system32\LODIVOYO.dll
WINDOWS\system32\NUSUZEFA.dll
WINDOWS\system32\ZUZIBERI.dll

My SpySweeper stopped is no longer picking up the Virtumondo and putting it into quarantine. (Isn't that Vundo?)

The startup tab in the MSCONFIG is no longer showing the WINDOWS\system32\BIZIJEJU.dll file, but is showing WINDOWS\system32\YABOHOYU.dll file.

So, to update, the SpySweeper and McAfee and running clean for at least a couple of runs now in Safemode (but we both know that isn't the case). I'll post again when I get to run the Rkill and Autoruns. Just wanted you to know that I'm at least still doing something......so bear with me...

Barb

#8 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 17 February 2010 - 08:55 PM

I know all too well how time-consuming and aggravating it is to fix these things.
Will wait to hear back from you, and wishing you the best :thumbsup:
If we don't change the direction we are going,
We are likely to end up where we are headed.

#9 viking22

viking22
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 17 February 2010 - 09:05 PM

Did the rkill, couldn't do the Autorun. (I couldn't upzip it.)

Here is the Malwarebytes log. I ran it in safe mode, I will try to run in regular mode. I don't know if I'll get ti that tonight.

Malwarebytes' Anti-Malware 1.44
Database version: 3753
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

2/17/2010 8:48:01 PM
mbam-log-2010-02-17 (20-48-01).txt

Scan type: Full Scan (C:\|)
Objects scanned: 250513
Time elapsed: 59 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 3
Registry Keys Infected: 3
Registry Values Infected: 3
Registry Data Items Infected: 6
Folders Infected: 1
Files Infected: 15

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\hulujige.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\nevorefa.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\yabohoyu.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{38967bb2-a1cc-430a-a5f1-dbf085ef2776} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0011f2c (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dulihetas (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{38967bb2-a1cc-430a-a5f1-dbf085ef2776} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\jelimusif (Trojan.Vundo.H) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: hulujige.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\yabohoyu.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\yabohoyu.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Your PC Protector (Rogue.YourPCProtector) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\botajida.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fovazepo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hulujige.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\kopurege.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\monajole.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nevorefa.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\segudedu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vaketapa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vewalimu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wesokaru.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yabohoyu.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\yeyozoda.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Program Files\Common\helper.sig (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\~.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\results.txt (Malware.Trace) -> Quarantined and deleted successfully.


I will run again, then what next? The SuperAntiSpyware?

#10 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 17 February 2010 - 09:33 PM

Regarding not being able to unzip Autoruns........
I don't know if you can't unzip it because you don't have an unzipping utility (such as WinZip or WinRar), or because something is preventing you from unzipping it. But there's a way around that......
If you go to the Autoruns web page,
http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx
and scroll all the way down to the bottom,
there is a notation that says,
"Run Autoruns now from Live.Sysinternals.com" (and it has a live link to click on, to run Autoruns. If you hover your mouse over it, and look down at your status bar at the bottom of your browser, it should show you that the link goes to Autoruns.exe).


If you haven't done so already, make sure you RESTART your computer, so that Malwarebytes' will delete the bad things found that are marked "Delete on reboot".

Yes, run SUPERAntiSpyware. It's ok to run that in Safe Mode. You may need to use Rkill again, if there are any bad things remaining, it will stop the processes of the bad things so you can scan.

I would recommend scanning again, to confirm the scans will come up "clean" (zero infections found).

:thumbsup:
If we don't change the direction we are going,
We are likely to end up where we are headed.

#11 viking22

viking22
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 17 February 2010 - 09:43 PM

Running the Malwarebytes again in regular mode. So far it found 7 more...... But before I logged off of safe mode, I connected to the internet to update my McAfee. Probably a stupid thing to do. Anyway, it is disconnented from the net now, (as I am typing from my laptop).

I will do the SuperSpyware probably tomorrow (hopefully).

Do you think I should still do the Autoruns? I'm not quite sure what it does.

#12 viking22

viking22
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 17 February 2010 - 09:48 PM

Am I supposed to uninstall Malwarebytes before installing SuperSpyware?

#13 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 17 February 2010 - 09:58 PM

Autoruns "shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys." and "To disable an auto-start entry uncheck its check box. To delete an auto-start configuration entry use the Delete menu item or toolbar button.
Select entries in the User menu to view auto-starting images for different user accounts." (I copied/pasted that from the Autoruns web page: http://technet.microsoft.com/en-us/sysinte.../bb963902.aspx)

If you are able to scan, (SUPERAntiSpyware, Malwarebytes'), great.
If bad things are preventing you from being able to scan, Rkill will kill the processes so you can scan/fix.

If you don't need to take anything out of Startup, you don't HAVE to use Autoruns.
It's a really neat program though (see the screen shots on the Autoruns web page).

Good thing I hit "preview post", just saw your add'l comment...........nope, you do NOT have to uninstall Malwarebytes' before installing SUPERAntiSpyware. They both do the same thing, but sometimes one program will find/fix bad things the other one doesn't find. It is ok to have both programs installed on the computer at the same time. Once you get everything fixed, you do not have to have either of them run on boot, or be running all the time. It IS a good idea to keep them updated, and scan every few days just to be safe, cause it's takes considerably less time to take preventative measures, than it does to fix bad things when they've gotten out of hand.
If we don't change the direction we are going,
We are likely to end up where we are headed.

#14 viking22

viking22
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 19 February 2010 - 08:24 AM

Sorry....it took me awhile.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/18/2010 at 07:14 PM

Application Version : 4.34.1000

Core Rules Database Version : 4596
Trace Rules Database Version: 0

Scan type : Complete Scan
Total Scan Time : 01:24:43

Memory items scanned : 260
Memory threats detected : 0
Registry items scanned : 5750
Registry threats detected : 0
File items scanned : 24236
File threats detected : 89

Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@apmebf[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@mediaresponder[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@revsci[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ad.wsod[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.gmodules[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@linksynergy[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@invitemedia[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.bleepingcomputer[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@stopzilla[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@microsoftsto.112.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@collective-media[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@www.stopzilla[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@mediatraffic[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.sun[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.cnn[1].txt
C:\Documents and Settings\Default User\Cookies\system@2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@adserver.adtechus[1].txt
C:\Documents and Settings\Owner\Cookies\owner@adserver.adtechus[2].txt
C:\Documents and Settings\Owner\Cookies\owner@adserver.adtechus[3].txt
C:\Documents and Settings\Owner\Cookies\owner@media6degrees[3].txt
C:\Documents and Settings\Owner\Cookies\owner@media6degrees[4].txt
C:\Documents and Settings\Owner\Cookies\owner@fastclick[2].txt
C:\Documents and Settings\Owner\Cookies\owner@media6degrees[1].txt
C:\Documents and Settings\Owner\Cookies\owner@fastclick[3].txt
C:\Documents and Settings\Owner\Cookies\owner@media6degrees[2].txt
C:\Documents and Settings\Owner\Cookies\owner@msnportal.112.2o7[3].txt
C:\Documents and Settings\Owner\Cookies\owner@kontera[1].txt
C:\Documents and Settings\Owner\Cookies\owner@msnportal.112.2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@entrepreneur[1].txt
C:\Documents and Settings\Owner\Cookies\owner@insightexpressai[2].txt
C:\Documents and Settings\Owner\Cookies\owner@kanoodle[2].txt
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt
C:\Documents and Settings\Owner\Cookies\owner@a1.interclick[1].txt
C:\Documents and Settings\Owner\Cookies\owner@a1.interclick[2].txt
C:\Documents and Settings\Owner\Cookies\owner@intermundomedia[2].txt
C:\Documents and Settings\Owner\Cookies\owner@intermundomedia[3].txt
C:\Documents and Settings\Owner\Cookies\owner@popcapgames.122.2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.adultswim[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.audxch[2].txt
C:\Documents and Settings\Owner\Cookies\owner@atlas.entrepreneur[1].txt
C:\Documents and Settings\Owner\Cookies\owner@adultswim[1].txt
C:\Documents and Settings\Owner\Cookies\owner@atdmt[1].txt
C:\Documents and Settings\Owner\Cookies\owner@crackle[2].txt
C:\Documents and Settings\Owner\Cookies\owner@msnbc.112.2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.ad4game[2].txt
C:\Documents and Settings\Owner\Cookies\owner@entrepreneur.122.2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.ad4game[3].txt
C:\Documents and Settings\Owner\Cookies\owner@ad.wsod[2].txt
C:\Documents and Settings\Owner\Cookies\owner@specificmedia[1].txt
C:\Documents and Settings\Owner\Cookies\owner@specificmedia[5].txt
C:\Documents and Settings\Owner\Cookies\owner@adbrite[2].txt
C:\Documents and Settings\Owner\Cookies\owner@specificmedia[2].txt
C:\Documents and Settings\Owner\Cookies\owner@teennick[2].txt
C:\Documents and Settings\Owner\Cookies\owner@specificmedia[3].txt
C:\Documents and Settings\Owner\Cookies\owner@adbrite[4].txt
C:\Documents and Settings\Owner\Cookies\owner@adbrite[1].txt
C:\Documents and Settings\Owner\Cookies\owner@adxpose[1].txt
C:\Documents and Settings\Owner\Cookies\owner@invitemedia[1].txt
C:\Documents and Settings\Owner\Cookies\owner@invitemedia[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.associatedcontent[1].txt
C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.undertone[2].txt
C:\Documents and Settings\Owner\Cookies\owner@invitemedia[3].txt
C:\Documents and Settings\Owner\Cookies\owner@zedo[2].txt
C:\Documents and Settings\Owner\Cookies\owner@quizilla.teennick[2].txt
C:\Documents and Settings\Owner\Cookies\owner@microsoftsto.112.2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@msnportal.112.2o7[2].txt
C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@atdmt[2].txt
C:\WINDOWS\Temp\Cookies\owner@ad.yieldmanager[1].txt
C:\WINDOWS\Temp\Cookies\owner@mediaplex[2].txt
C:\WINDOWS\Temp\Cookies\owner@doubleclick[1].txt
C:\WINDOWS\Temp\Cookies\owner@www.googleadservices[1].txt
C:\WINDOWS\Temp\Cookies\owner@interclick[2].txt
C:\WINDOWS\Temp\Cookies\owner@atdmt[2].txt
C:\WINDOWS\Temp\Cookies\owner@media.adrevolver[1].txt
C:\WINDOWS\Temp\Cookies\owner@ads.monster[1].txt
C:\WINDOWS\Temp\Cookies\owner@specificclick[1].txt
C:\WINDOWS\Temp\Cookies\owner@adrevolver[2].txt
C:\WINDOWS\Temp\Cookies\owner@ads.revsci[1].txt
C:\WINDOWS\Temp\Cookies\owner@advertising[1].txt
C:\WINDOWS\Temp\Cookies\owner@247realmedia[2].txt
C:\WINDOWS\Temp\Cookies\owner@precisionclick[2].txt
C:\WINDOWS\Temp\Cookies\owner@apmebf[1].txt


I ran this in safe mode. Then I booted up in regular mode.

Weird....... Suspicious, really, I should say..... Computer says that my McAfee Security Center needed to be updated. (okay). But then, computer says I need a Windows Update? Hmmm..... Also, I get a message that my, oh boy.... um...oh crap, I can't recall at this time exactly. I little yellow triangle appears in the lower right hand corner and says something about too much memory and some programs may run slower....

In the mean time, I am again running the SuperSpyware again, and will run the Malwarbytes too. Until I hear back....................

#15 viking22

viking22
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:New York
  • Local time:12:10 AM

Posted 19 February 2010 - 09:12 AM

It had to do with virtual memory....... if that helps




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users