Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Windows Won't Update, and all sorts of other fun!

  • Please log in to reply
1 reply to this topic

#1 Johnny Threat

Johnny Threat

  • Members
  • 1 posts
  • Gender:Male
  • Location:Baltimore, MD
  • Local time:05:41 PM

Posted 21 March 2012 - 02:11 PM

About 2 weeks ago, I was watching a video on youtube, and began to hear audio that wasn't coming from the video. It was a lysol ad, or some such nonsense. I closed the internet, still played. I logged off, still played. I ended up restarting my computer, and did not hear any ads after that. I ran a norton full scan on my system, since I assumed it was adware. A google search indicated that I was probably right, and had fallen victim to ghost audio adware. After my search, I returned to see my computer had frozen during the scan. I said F*** it, and decided to deal with it in the morning. I rebooted, tried the scan, and it froze again. Then when I got off of work, I scanned in safe mode, and found only tracking cookies. Scanned in normal mode, again cookies. Later that night, I discovered I was being redirected to a turbotax ad on google, on 3 of the top 4 links. The next day, all was back to relatively normal, so I decided to ignore it...yeah, I know, brilliant. About a week passed, and I noticed that windows update wasn't updating. I tried manually updating, still no dice. A quick google search indicated that this was likely due to a rootkit. It was at this point (Monday) that I decided to do something about it. I downloaded Malwarebytes, which was as user friendly as possible, which is great for someone like me, and let it do a full scan. It found 26 objects (I believe), and needed me to restart the computer to remove them all. So I did, and there in the quarantine list were all the threats it removed. Later that night, I tried to update, but still had no luck. So, I'm coming to you guys, to see if you have any idea what is wrong with my computer, and how to fix it.

Here is the log from malwarebytes:

Malwarebytes Anti-Malware

Database version: v2012.03.19.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Lynn :: PC [administrator]

3/19/2012 8:41:32 PM
mbam-log-2012-03-19 (20-41-32).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 436394
Time elapsed: 1 hour(s), 24 minute(s), 15 second(s)

Memory Processes Detected: 2
C:\ProgramData\binlabel.exe (Trojan.Agent.UAGen) -> 3580 -> Delete on reboot.
C:\Windows\svchost.exe (Trojan.Agent) -> 4416 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 8
HKCR\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100EB1FD-D03E-47FD-81F3-EE91287F9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.

Registry Values Detected: 8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|binlabel (Trojan.Agent.UAGen) -> Data: C:\ProgramData\binlabel.exe -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|binlabel (Trojan.Agent.UAGen) -> Data: C:\ProgramData\binlabel.exe -> Quarantined and deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|binlabel (Trojan.Agent.UAGen) -> Data: C:\ProgramData\binlabel.exe -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ircom (Trojan.Agent.UAGen) -> Data: C:\Windows\system32\config\systemprofile\AppData\Roaming\ircom.exe -> Quarantined and deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ircom (Trojan.Agent.UAGen) -> Data: C:\Windows\system32\config\systemprofile\AppData\Roaming\ircom.exe -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ircom (Trojan.Agent.UAGen) -> Data: C:\Users\Lynn\AppData\Roaming\ircom.exe -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform|SRS_IT_E8790574B5765B5131A897 (Malware.Trace) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|dplaysvr (Trojan.QHost.BG) -> Data: C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 8
C:\ProgramData\binlabel.exe (Trojan.Agent.UAGen) -> Delete on reboot.
C:\Windows\System32\config\systemprofile\AppData\Roaming\ircom.exe (Trojan.Agent.UAGen) -> Delete on reboot.
C:\Users\Lynn\AppData\Roaming\ircom.exe (Trojan.Agent.UAGen) -> Quarantined and deleted successfully.
C:\Users\Lynn\AppData\Local\Temp\diskbit.exe (Trojan.Agent.UAGen) -> Quarantined and deleted successfully.
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ircom.exe (Trojan.Agent.UAGen) -> Delete on reboot.
C:\Windows\Temp\diskbit.exe (Trojan.Agent.UAGen) -> Quarantined and deleted successfully.
C:\Windows\Temp\rgpwfpjwyqf.exe (Trojan.Agent.UAGen) -> Quarantined and deleted successfully.
C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.


BC AdBot (Login to Remove)


#2 Broni


    The Coolest BC Computer

  • BC Advisor
  • 42,754 posts
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:41 PM

Posted 21 March 2012 - 02:13 PM

Welcome aboard Posted Image

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices (do NOT change any settings here)
  • List Users, Partitions and Memory size
Click Go and post the result.


Download Malwarebytes' Anti-Malware (aka MBAM): https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt


Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users