Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I tried downloading what I thought was Spybot S&D and I got 138 viruses


  • This topic is locked This topic is locked
9 replies to this topic

#1 chugg

chugg

  • Members
  • 593 posts
  • OFFLINE
  •  
  • Local time:05:57 AM

Posted 07 December 2013 - 08:06 PM

My computer has been so slow that I cant even open web pages at times.  I went to the tutorial for speeding up computers and spybot search and destroy was recommended.  I googled it and clicked on the link to download and ended up with 138 viruses that I removed with Malware Bytes.  I ended up clicking on a malware link that represented itself as spybot s&d.  Does anyone have a good link for this?  Im afraid to search for this myself after this incident.  Thanks!



BC AdBot (Login to Remove)

 


#2 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:07:57 PM

Posted 07 December 2013 - 09:03 PM

Hi -
MBAM and your Antivirus (please list it) will generally out-perform Spybot S&D at the moment.
The program has been "down rated" for the last year or 2 now.

It still exists in the older versions of the help sections -

 

HERE is a safe download of the latest version from File Hippo if you do want it -

 

Thank You -



#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:57 AM

Posted 07 December 2013 - 09:14 PM


Spybot 2 Dowmload links:
Spybot 2.2 Free Edition
Mirror selection Spybot 2

We provide our own mirror sites so that you will not have to put up with annoying advertisements and pop-ups that you often encounter on free download sites.

Safer-Networking Ltd. #1: Spybot 2 own mirror 1
Safer-Networking Ltd. #1: Spybot 2 own mirror 2
Safer-Networking Ltd. #1: Spybot 2 own mirror 3

Spybot S&D 1.6 Dowmload links:
Spybot Search & Destroy 1.6.2
Mirror Selection Spybot 1.6

We provide our own mirror sites so that you will not have to put up with annoying advertisements and pop-ups that you often encounter on free download sites.

Safer-Networking Ltd. #1: Spybot's Own Mirror
Safer-Networking Ltd. #2: Spybot's Own Mirror
Safer-Networking Ltd. #3: Spybot's Own Mirror

FYI: mvps.org is no longer recommending Spybot S&D (or Ad-Aware) due to poor testing results. See here - (scroll down and read under Freeware Antispyware Products). Further, most people don't understand how to use Spybot's TeaTimer and that feature can cause more problems than it's worth. TeaTimer monitors changes to certain critical keys in Windows registry but does not indicate if the change is normal or a modification made by a malware infection. The user must have an understanding of the registry and how TeaTimer works in order to make informed decisions to allow or deny the detected changes. If you don't have understanding how a particular security tool works, then you probably should not be using it. Additionally, TeaTimer may conflict with other security tools which do a much better job of protecting your computer and in some cases it will even prevent disinfection of malware by those tools.

More effective alternatives are Malwarebytes Anti-Malware and SUPERAntiSpyware Free.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 chugg

chugg
  • Topic Starter

  • Members
  • 593 posts
  • OFFLINE
  •  
  • Local time:05:57 AM

Posted 08 December 2013 - 02:36 PM

I am using Comodo firewall and anti virus.  My computer is slow as hell for some reason. 



#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:57 AM

Posted 08 December 2013 - 04:18 PM

Please download and use the following tools (in the order listed) which will search for and remove many potentially unwanted programs (PUPs), adware, toolbars, browser hijackers, extensions, add-ons and other junkware as well as related registry entries (values, keys) and remnants.

RKill created by Grinler (aka Lawrence Abrams), the site owner of BleepingComputer.
AdwCleaner created by Xplode.
Junkware Removal Tool created by thisisu.

1. Double-click on RKill to launch the tool. A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

Important: Do not reboot your computer until you complete the next step.

2. Double-click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
-- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on each one and uncheck any items you want to keep (except you cannot uncheck Chrome and Firefox preferences lines).


Close all open programs and shut down any protection/security software to avoid potential conflicts.

3. Double-click on JRT.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log file named JRT.txt will automatically open and be saved to your Desktop.
  • Copy and paste the contents of JRT.txt in your next reply.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 chugg

chugg
  • Topic Starter

  • Members
  • 593 posts
  • OFFLINE
  •  
  • Local time:05:57 AM

Posted 18 December 2013 - 01:13 AM

Quietman,  I am very sorry that it took me so long to do this but I will save you the explanation.  I appreciate your help in this.  After this, my computer is still taking an extremely long time to re start.   It used to be really fast about 4 months ago.  Also, 2 times today I re started my computer and it got stuck on the "windows is shutting down screen".  I had to power it off.     The requested log files follow.  

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Microsoft Windows XP x86
Ran by User on Wed 12/18/2013 at  1:03:40.92
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BA50DCF7-91E0-44D6-91EC-E8E3C2ADD8EF}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
 
 
~~~ FireFox
 
Successfully deleted the following from C:\Documents and Settings\User\Application Data\mozilla\firefox\profiles\oelxnw06.default\prefs.js
 
user_pref("SothinkWebVideoDownloaderWebVideoDownloader.DownloadedArray_12.url", "hxxp://88.208.52.109/key=F1LJv9EyMIU,end=1344158273/data=1139425459/buffer=450K/speed=83200/re
user_pref("SothinkWebVideoDownloaderWebVideoDownloader.HistoryArray_777.url", "hxxp://213.174.156.10/key=V9tArUEdBQM,,end=1346464290/buffer=1M/speed=144384/reftag=27982/1/bg/5
user_pref("WebVideoDownloaderDownloaded.DownloadedArray_12.url", "hxxp://88.208.52.109/key=F1LJv9EyMIU,end=1344158273/data=1139425459/buffer=450K/speed=83200/reftag=392380/s/x
user_pref("WebVideoDownloaderHistory.HistoryArray_787.url", "hxxp://213.174.156.10/key=V9tArUEdBQM,,end=1346464290/buffer=1M/speed=144384/reftag=27982/1/bg/5/1130485.mp4?start
 
 
 
~~~ Chrome
 
Successfully deleted: [Folder] C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ihdkejbciahopmbagpnjmmkkdpfpaaak
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 12/18/2013 at  1:09:35.04
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Rkill 2.6.3 by Lawrence Abrams (Grinler)
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
 
Program started at: 12/18/2013 12:49:50 AM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * No malware processes found to kill.
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * Windows Firewall Disabled
 
   [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
   "EnableFirewall" = dword:00000000
 
 * ALERT: ZEROACCESS rootkit symptoms found!
 
     * C:\Documents and Settings\User\Local Settings\Application Data\{e8374187-5bdc-a53d-9d00-a9bfad20e478}\ [ZA Dir]
     * C:\Documents and Settings\User\Local Settings\Application Data\{e8374187-5bdc-a53d-9d00-a9bfad20e478}\@ [ZA File]
     * C:\Documents and Settings\User\Local Settings\Application Data\{e8374187-5bdc-a53d-9d00-a9bfad20e478}\L\ [ZA Dir]
     * C:\Documents and Settings\User\Local Settings\Application Data\{e8374187-5bdc-a53d-9d00-a9bfad20e478}\U\ [ZA Dir]
 
 * Reparse Point/Junctions Found (Most likely legitimate)!
 
     * C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a => C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 [Dir]
     * C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35 => C:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5 [Dir]
 
Checking Windows Service Integrity: 
 
 * No issues found.
 
Searching for Missing Digital Signatures: 
 
 * No issues found.
 
Checking HOSTS File: 
 
 * HOSTS file entries found: 
 
  127.0.0.1       localhost
 
Program finished at: 12/18/2013 12:51:25 AM
Execution time: 0 hours(s), 1 minute(s), and 35 seconds(s)
 
 
# AdwCleaner v3.015 - Report created 18/12/2013 at 00:55:47
# Updated 10/12/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : User - USER-3D7C2733C7
# Running from : C:\Documents and Settings\User\Desktop\spy\AdwCleaner.exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
Folder Deleted : C:\Program Files\Free Offers from Freeze.com
Folder Deleted : C:\Program Files\FREEzeFrog
Folder Deleted : C:\Documents and Settings\User\Local Settings\Application Data\Searchprotect
Folder Deleted : C:\Documents and Settings\User\Application Data\FREEzeFrog
File Deleted : C:\END
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.xpt
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.xpt
File Deleted : C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\oelxnw06.default\searchplugins\conduit-search.xml
File Deleted : C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\oelxnw06.default\user.js
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Deleted : HKLM\SOFTWARE\Classes\AppID\DealScout.DLL
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_10F70000
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\Software\FREEzeFrog
Key Deleted : HKLM\Software\InfoAtoms
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\Software\Tarma Installer
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FREEzeFrogSA
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Homepage Protection Service
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\IspAssistant-Mp3Tube
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\QuestScan
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v8.0.6001.18702
 
 
-\\ Mozilla Firefox v25.0.1 (en-US)
 
[ File : C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\oelxnw06.default\prefs.js ]
 
Line Deleted : user_pref("SothinkWebVideoDownloaderWebVideoDownloader.HistoryArray_2663.name", "KariSweet_300x315");
Line Deleted : user_pref("SothinkWebVideoDownloaderWebVideoDownloader.HistoryArray_2663.url", "hxxp://assets1.exgfnetwork.com/banners/testing/xpassion/Ads/KariSweets/KariSweet_300x315.f4v");
Line Deleted : user_pref("aol_toolbar.surf.date", "203");
Line Deleted : user_pref("aol_toolbar.surf.lastDate", "16");
Line Deleted : user_pref("aol_toolbar.surf.lastMonth", "2");
Line Deleted : user_pref("aol_toolbar.surf.lastYear", "2012");
Line Deleted : user_pref("aol_toolbar.surf.month", "504");
Line Deleted : user_pref("aol_toolbar.surf.prevMonth", "304");
Line Deleted : user_pref("aol_toolbar.surf.total", "2733");
Line Deleted : user_pref("aol_toolbar.surf.week", "257");
Line Deleted : user_pref("aol_toolbar.surf.year", "1561");
Line Deleted : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=2&UP=SPABB31BE7-8779-40AD-867A-920DAD99B455");
Line Deleted : user_pref("browser.search.defaultenginename", "Conduit Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=20111206171709593&tb_oid=06-12-2011&tb_mrud=06-12-2[...]
Line Deleted : user_pref("browser.search.selectedEngine", "Conduit Search");
Line Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPABB31BE7-8779-40AD-867A-920DAD99B455&SSPV=");
Line Deleted : user_pref("keyword.URL", "hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&tb_uuid=20111206171709593&tb_oid=06-12-2011&tb_mrud=06-12-2011&query=");
 
-\\ Google Chrome v
 
[ File : C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]
 
 
*************************
 
AdwCleaner[R0].txt - [4772 octets] - [18/12/2013 00:53:06]
AdwCleaner[S0].txt - [4789 octets] - [18/12/2013 00:55:47]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4849 octets] ##########
 

Edited by chugg, 18 December 2013 - 02:48 AM.


#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:57 AM

Posted 18 December 2013 - 09:04 AM

You possibly have a serious malware infection - * ALERT: ZEROACCESS rootkit symptoms found!
Disinfection will probably require the use of more powerful tools than we recommend in this forum. Before that can be done you will need to create and post a DDS log for further investigation.

Please follow the instructions in the Malware Removal and Log Section Preparation Guide starting at Step 6.
  • If you cannot complete a step, then skip it and continue with the next.
  • In Step 6 there are instructions for downloading and running DDS which will create two logs. (Note: Windows 8.1 Users will not be able run DDS and create a log)
When you have done that, post your logs in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team.

Start a new topic, give it a relevant title and post your log(s) along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. If you cannot produce any of the required logs, then still start the new topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happened when you tried to create them. A member of the Malware Removal Team will walk you through, step by step, on how to clean your computer.

After doing this, please reply back in this thread with a link to the new topic so we can closed this one.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 chugg

chugg
  • Topic Starter

  • Members
  • 593 posts
  • OFFLINE
  •  
  • Local time:05:57 AM

Posted 18 December 2013 - 05:33 PM

Damn Im on it thanks! Quietman.  I will report back. 



#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:57 AM

Posted 18 December 2013 - 05:36 PM

Ok.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 35,117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:02:57 AM

Posted 23 December 2013 - 03:32 PM

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/518022/i-have-a-virus-computer-shuts-down-very-slow/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic. Good luck with your log.

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users