Author Topic: Virus? (Read 11253 times)

ArtVandalay7 · « **on:** April 01, 2009, 08:18:45 AM »

I suspect I may have a virus but need some help please. The screen now flickers twice each time on startup and I now have problems with the computer freezing up unexpectedly. I have McAfee running, also have run adaware and spybot, malwarebytes, secunia. Running these apps has also caused freezeups though and I have had to run them in safe mode although none of them have found anything when I do so. Also checked for Conficker in safe mode and was negative. Help please, any suggestions/thoughts? Thanks for any help!

squall_01 · « **Reply #1 on:** April 01, 2009, 10:24:32 AM »

That dont mean that you dont have it, but it seems that you did without doubt got hit. If you have a san disc put avast on it then run it in the infected machine.

ArtVandalay7 · « **Reply #2 on:** April 01, 2009, 10:57:27 AM »

thanks for the reply...sorry, but what's a san disc? I do have a 2gb memory stick...I ran avast in safe mode and it didn't find anything...

squall_01 · « **Reply #3 on:** April 01, 2009, 10:58:50 AM »

san disk is a usb flash drive. Not sure what your doing with memory?

ArtVandalay7 · « **Reply #4 on:** April 01, 2009, 11:03:15 AM »

I have a 2gb flash drive, not memory stick. Run it off the flash drive then?

squall_01 · « **Reply #5 on:** April 01, 2009, 11:06:11 AM »

there you go alot of people confuse that. But there two seperate things if it has like the auto run feature in it. Other wise you'll have conflicts, the only reason why I am saing to do this is cause one scanner cant get what another can. Too prevent futher issues as well.

ArtVandalay7 · « **Reply #6 on:** April 01, 2009, 11:12:48 AM »

I think it's just a plain old 2gb flash drive, nothing fancy. So I should download Avast onto it and then run the application from the flash drive, scanning the laptop hard drive?

squall_01 · « **Reply #7 on:** April 01, 2009, 11:17:10 AM »

If that all it is, I would attempt to find another way, if someone comes and helps with this since it does have the lanuchpad then, cause you'll just end up having the installer file to avast on there and when you run it, the possible confliction with avg is rather high.

ArtVandalay7 · « **Reply #8 on:** April 01, 2009, 11:39:41 AM »

Sorry, not sure if I understand. I have McAfee antivirus, not AVG. My flash drive is a 1 gb Simpletech. How should I proceed?

macdad- · « **Reply #9 on:** April 01, 2009, 11:42:46 AM »

You dont need more than one Anti-Virus Software running, this is bad, can cause freeze ups and such.

Advice:Unistall Ad-aware, and leave MBAM(MalwareBytes) and either leave McAffe or Secunia installed on your computer

squall_01 · « **Reply #10 on:** April 01, 2009, 11:44:20 AM »

Sorry, working with several post. You dont have the advantage to run programs from your flash drive from what I know, in other words you be getting the install file to put avast on there rather then the program just install and be able to run with out conflict with mcafee. Its not possible to have two anti-virus cause of this and even if it was still wouldnt be considered. Some one else will hopefully be along to hope address the situation.

squall_01 · « **Reply #11 on:** April 01, 2009, 11:44:56 AM »

Quote from: macdad- on April 01, 2009, 11:42:46 AM

You dont need more than one Anti-Virus Software running, this is bad, can cause freeze ups and such.

Advice:Unistall Ad-aware, and leave MBAM(MalwareBytes) and either leave McAffe or Secunia installed on your computer

Thanks, Man. Did what I could on my behalf.

macdad- · « **Reply #12 on:** April 01, 2009, 11:46:24 AM »

No problem

And besides with all of those running at once, it probably takes a big toll on his CPU

ArtVandalay7 · « **Reply #13 on:** April 01, 2009, 11:49:50 AM »

Ok, done. I started with just McAfee on the computer which I am now back to but added these others in the last 24hours trying to find the virus...

squall_01 · « **Reply #14 on:** April 01, 2009, 11:52:01 AM »

That is a good point as well but asumed that it was like 3 ghz or somthing. Well you shouled be able to take it from here then. Just was attempting an easier way if you get it.

ArtVandalay7 · « **Reply #15 on:** April 01, 2009, 11:59:00 AM »

Again, thanks to everyone for taking the time to try to help. Mcafee on, uninstalled adaware and securia. Is there another way to eliminate this virus since my 2gb flash drive won't be of help?

macdad- · « **Reply #16 on:** April 01, 2009, 12:00:24 PM »

you could try HijackThis, then post the logs from it.

ArtVandalay7 · « **Reply #17 on:** April 01, 2009, 12:07:30 PM »

Ok, thanks. Can I post the results here?

macdad- · « **Reply #18 on:** April 01, 2009, 12:08:30 PM »

Sure, just post as an attachment

ArtVandalay7 · « **Reply #19 on:** April 01, 2009, 12:10:00 PM »

Ok, thanks again.

[attachment deleted by admin]

ArtVandalay7 · « **Reply #20 on:** April 01, 2009, 01:12:49 PM »

Did I attach the right file? Thanks!

squall_01 · « **Reply #21 on:** April 01, 2009, 01:16:00 PM »

yeah, he probably had looked at it.

ArtVandalay7 · « **Reply #22 on:** April 01, 2009, 02:07:35 PM »

Ok, hopefully it has a clue as to what's on my computer and how to get it off...

squall_01 · « **Reply #23 on:** April 01, 2009, 02:16:01 PM »

hopefully, for you

macdad- · « **Reply #24 on:** April 01, 2009, 04:38:43 PM »

ok now, im looking at it and gonna run through it.

macdad- · « **Reply #25 on:** April 01, 2009, 04:42:45 PM »

Ok, I found a Gopher in the log and you will want to fix the following item(If on the list):
O13 - Gopher Prefix:

Hope this helps
,Nick(macdad-)

ArtVandalay7 · « **Reply #26 on:** April 01, 2009, 05:30:54 PM »

Ok, I fixed it in the program...I'll try a reboot and see if it flashes at startup like before...thanks again for taking the time to help--it's very much appreciated!!!

ArtVandalay7 · « **Reply #27 on:** April 01, 2009, 05:43:34 PM »

I restarted but it still flashes to black X 2 on startup...think there's still a problem...

macdad- · « **Reply #28 on:** April 01, 2009, 06:49:57 PM »

Is it just flashing black twice on startup? Because that is normal for Vista.

ArtVandalay7 · « **Reply #29 on:** April 01, 2009, 06:52:44 PM »

It is Vista, but I don't remember that happening before I think the computer got infected with the virus...is that gopher a product of a virus infection and should getting rid of it definitively solve the problem do you think? I'm going to try another malware scan and see if that freezes up the computer again...

evilfantasy · « **Reply #30 on:** April 01, 2009, 10:12:58 PM »

O13 - Gopher Prefix: is normal on Vista computers. Removing it is up to you.

Use the Kaspersky Lab Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.

Click on SCAN NOW
Click Accept.
The program will then begin downloading the latest definition files.
Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
The scan will take a while, so be patient and let it finish.

When the scan is done, in the Scan is complete window, any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As

Next, in the Save as prompt, Save in area, select: Desktop.
In the File name area use KScan, or something similar.
In Save as type: click the drop arrow and select: Text file [*.txt]
Then, click: Save

Copy and paste the Kaspersky Online Scanner Report in your next reply.

Note for Internet Explorer 7 and 8 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

If needed, this animation will guide you through the process.

ArtVandalay7 · « **Reply #31 on:** April 02, 2009, 07:14:10 AM »

Thanks! I ran the Kaspersky scan but it didn't find anything (nothing in the scan report)...Computer just froze up again and required 2 attempts to reboot to get it back on...

macdad- · « **Reply #32 on:** April 02, 2009, 11:16:46 AM »

Thanks Evil, i was kinda running into corners

evilfantasy · « **Reply #33 on:** April 02, 2009, 11:23:33 AM »

Quote from: macdad- on April 02, 2009, 11:16:46 AM

Thanks Evil, i was kinda running into corners

No problem.

It;'s likely not a malware issue.

ArtVandalay7 · « **Reply #34 on:** April 02, 2009, 01:10:19 PM »

scan result attached. FWIW, the problem seems to have occurred after one of the online adbots started to detect viruses on my computer and I had to close the browser to get rid of it...

[attachment deleted by admin]

evilfantasy · « **Reply #35 on:** April 02, 2009, 01:24:52 PM »

Quote

online adbots

Well you appear to have luckily escaped.

WOT will help you avoid that from happening again.

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

----------

Use the Secunia Software Inspector to check for out of date software.

Click Start Now
Check the box next to Enable thorough system inspection.
Click Start
Allow the scan to finish and scroll down to see if any updates are needed.
Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

BC_Programmer · « **Reply #36 on:** April 02, 2009, 02:08:00 PM »

oooh! And AdBlockPlus, that's a great add-in!

ArtVandalay7 · « **Reply #37 on:** April 02, 2009, 02:45:59 PM »

I was using adaware and spybot in addition to McAfee before I think I may have picked up a virus, etc. Do you think I escaped? These occasional freezeups didn't happen before and I didn't think the screen flashed so dramatically at each startup but maybe I'm mistaken. If so, whew and I'll add those programs instead of the aforementioned ones I used before...

evilfantasy · « **Reply #38 on:** April 02, 2009, 02:48:38 PM »

Ad-aware and Spybot are not as powerful as MalwareBytes and SUPERAntiSpyware.

Also use this.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

ArtVandalay7 · « **Reply #39 on:** April 02, 2009, 03:12:16 PM »

gotcha, will do. What do you think, since the Kaspersky scan was clean, does that mean that I'm virus-free?

evilfantasy · « **Reply #40 on:** April 02, 2009, 03:18:02 PM »

You appear to have luckily escaped.

ArtVandalay7 · « **Reply #41 on:** April 03, 2009, 06:09:48 AM »

I don't know, the computer is still freezing up and requiring 2 hard reboots to get it going again when it does...seems like something is still not right...

evilfantasy · « **Reply #42 on:** April 03, 2009, 10:39:54 AM »

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

ArtVandalay7 · « **Reply #43 on:** April 03, 2009, 01:32:06 PM »

here's the combofix output...thanks

[attachment deleted by admin]

evilfantasy · « **Reply #44 on:** April 03, 2009, 01:47:37 PM »

Please go to Start > Run and copy/paste the following, then press Enter:

C:\QooBox\Add-Remove Programs.txt

A text file should open. Please post the contents of that file in your next reply.

squall_01 · « **Reply #45 on:** April 04, 2009, 05:30:09 PM »

I'm glad that I got you guys to jump in. Seems that things had gotin really nasty any how.

ArtVandalay7 · « **Reply #46 on:** April 05, 2009, 09:21:45 PM »

not sure what that last post is referring to...anyway, here is the qoobox output data. Again, thanks for any help, it's much appreciated!

[attachment deleted by admin]

evilfantasy · « **Reply #47 on:** April 05, 2009, 09:31:32 PM »

Everything looks Ok. How is the computer running now?

ArtVandalay7 · « **Reply #48 on:** April 05, 2009, 10:22:34 PM »

Thanks evil. It runs mostly ok I think; however, still with some slowdowns/freezeups that didn't seem to occur beforehand...anyway, if it doesn't seem to be virus-related that's reassuring that things won't get worse at least...

evilfantasy · « **Reply #49 on:** April 05, 2009, 11:10:52 PM »

Try some cleanup and then see how it is.

Click START then RUN
Now type Combofix /u in the runbox
Make sure there's a space between Combofix and /u
Then hit Enter.

.
.
The above procedure will:

Delete: ComboFix and its associated files and folders.
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Set a new, clean Restore Point.

.
----------

Download OTMoveIt3 by OldTimer OTMoveIt3.exe and place it on your desktop. (unless you already have it installed)

1. Double click OTMoveIt3.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt3

----------

I would also recommend that you Defrag the computer. There may be a lot of fragmented sections on the drive after cleaning the malware.

You can use the built in Windows Defrag or a faster FREE program. Defraggler is very effective and easy to use. Be sure to clean out temp files and restart the computer just before using this.

----------

Use the Secunia Software Inspector to check for out of date software.

Click Start Now
Check the box next to Enable thorough system inspection.
Click Start
Allow the scan to finish and scroll down to see if any updates are needed.
Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

squall_01 · « **Reply #50 on:** April 06, 2009, 11:02:37 AM »

I ment that it got out of hand and I wouldnt have been much help. I see that it is resolveing rather fast though.

ArtVandalay7 · « **Reply #51 on:** April 08, 2009, 04:36:36 PM »

I'll get started on that tonight...hey evil thanks again for the help, great advice!!!

Computer Hope Forum

News:

Author Topic: Virus? (Read 11253 times)

ArtVandalay7

squall_01

ArtVandalay7

squall_01

ArtVandalay7

squall_01

ArtVandalay7

squall_01

ArtVandalay7

macdad-

squall_01

squall_01

macdad-

ArtVandalay7

squall_01

ArtVandalay7

macdad-

ArtVandalay7

macdad-

ArtVandalay7

ArtVandalay7

squall_01

ArtVandalay7

squall_01

macdad-

macdad-

ArtVandalay7

ArtVandalay7

macdad-

ArtVandalay7

evilfantasy

ArtVandalay7

macdad-

evilfantasy

ArtVandalay7

evilfantasy

BC_Programmer

ArtVandalay7

evilfantasy

ArtVandalay7

evilfantasy

ArtVandalay7

evilfantasy

ArtVandalay7

evilfantasy

squall_01

ArtVandalay7

evilfantasy

ArtVandalay7

evilfantasy

squall_01

ArtVandalay7