Author Topic: virus? malware? os? computer stupid? (Read 13014 times)

taydan030109 · « **on:** April 08, 2009, 06:32:47 PM »

Ok, Not sure if i am in the right space.... but i am having major issues with this *censored* laptop ( ACER ASPIRE 5315-2582) and windows vista.........
One, I had a trial period for avast, it up dated gave me a major headache, finally after searching this site got rid of it, then one day i opened the internet and it updated me to internet explorer 8 from 7... ever since then i have prob after prob, windows defender will not start scan or update, windows sercuirty will not allow it to open, windows update will not download and or install the 3 major updates needed, i cant sign into windows live messenger seek any help at all on any microsoft website, threw inernet page cant be displayed and when i click see more, it comes back cant connect to sercure server... i have tried to uninstall windows live messenger and its not in my add/remove programs.. also there is Avira antivirus personal icon in my control panel which i can not delete... and my list seems to continue, everyday there is a new prob. i have tried ccleaner, smitfraudfix, combofix avg free editon and other Sites like this for help AND NOTHING!!!!!!!!!!!!!

BC_Programmer · « **Reply #1 on:** April 08, 2009, 07:36:58 PM »

try running through this guide

http://www.computerhope.com/forum/index.php/topic,46313.0.html

post the three logs here.

taydan030109 · « **Reply #2 on:** April 09, 2009, 02:24:17 PM »

here are the logs you wanted!!
I hope something can be done!!

[attachment deleted by admin]

BC_Programmer · « **Reply #3 on:** April 09, 2009, 05:43:39 PM »

First, it looks like you have two Anti-Viruses, AVG and Avira; you should uninstall one.

Nothing jumps out at me in the hijackthis log, except

O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - http://imikimi.com/download/imikimi_plugin_0.5.1.cab

Aside from that nothing really jumps out at me; did you get SUPER antispyware to remove what it detected?

I might be missing something though; I'm sure a malware expert will be here shortly.

taydan030109 · « **Reply #4 on:** April 09, 2009, 07:31:55 PM »

i do have avg that is currently running, but the other one, i have uninstalled BUT the icon is still showing in my control panel, my only options when clicked on it is move or create short cut, no uninstall/install or delete, its not in my add/remove programs at all......ANYWHERE
The imikimi is a online picture thing.... it had to install something into my browser, but again i cant find it no where anywhere else on my comp.........
So am i back to waiting again??? or can you help?

taydan030109 · « **Reply #5 on:** April 09, 2009, 07:34:38 PM »

and yes i do have SUPERantispyware, but all i did was run it.. i did do NOTHING to change anything, i followed the instructions you sent me in the link which was posted......

evilfantasy · « **Reply #6 on:** April 09, 2009, 09:07:45 PM »

Right click HijackThis and choose 'Run as Administrator'

Next select Do a system scan only.

Place a check mark next to the following entries: (if there)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

.
Important: Close all open windows except for HijackThis and then click Fix checked.

Do not restart if HijackThis asks you to.

Once completed, exit HijackThis.

----------

Go to Start > Run and type Notepad.exe then click OK.

Copy and paste the following text within the code box into the new Notepad file.

Code: [Select]

@ECHO OFF
sc stop "AntiVirScheduler"
sc delete "AntiVirScheduler"
sc stop "AntiVirService"
sc delete "AntiVirService"
exit

In Notepad select File and Save as
Choose the Save to location to be the Desktop and for the File name: type in fixme.bat making sure that the Save as type field says All files.

Next double click fixservice.bat to run it.
A black box should open and close after a short time, this is normal.
Do not continue until the black box has closed
Delete fixservice.bat from the Desktop.

----------

Everything in the MBAM log says No action taken.

Please run MBAM again and have it fix everything found then post the new log.

taydan030109 · « **Reply #7 on:** April 09, 2009, 09:45:40 PM »

i did everything you said! and ya still i have all the same probs.
wats going on with this thing??...lol..... also i attached the new log.

[attachment deleted by admin]

evilfantasy · « **Reply #8 on:** April 09, 2009, 09:48:06 PM »

That's the SUPERAntiSpyware Scan Log. I need you to run a new MalwareBytes scan and post that log.

taydan030109 · « **Reply #9 on:** April 09, 2009, 10:56:00 PM »

this scan is takeing a very long time... so far just over an hour.. is this normal?

evilfantasy · « **Reply #10 on:** April 10, 2009, 12:35:39 AM »

No it's not since the last one only took around 5 minutes. You are running Malwarebytes' Anti-Malware right?

taydan030109 · « **Reply #11 on:** April 10, 2009, 11:42:28 AM »

yes i am! it ran alllllll night, into this afternoon........ its showing over 100 000 files being scanned, i stopped it.

evilfantasy · « **Reply #12 on:** April 10, 2009, 12:16:40 PM »

Restart the computer and run it again. The quick scan should only take about 5 minutes.

taydan030109 · « **Reply #13 on:** April 10, 2009, 12:42:34 PM »

here is the last scan, Qucik scan............
far as i know, it shows NOTHING

[attachment deleted by admin]

evilfantasy · « **Reply #14 on:** April 10, 2009, 12:46:04 PM »

OK that's good.

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

taydan030109 · « **Reply #15 on:** April 10, 2009, 01:34:14 PM »

here is the scan from combofix

[attachment deleted by admin]

evilfantasy · « **Reply #16 on:** April 10, 2009, 01:37:12 PM »

Download DDS by sUBs and save it to your Desktop. Alternate DDS download link

Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

* XP users Double click on dds to run it.
* If your antivirus or forewall try to block DDS then please allow it to run.
* When finished DDS will open two (2) logs:

1) DDS.txt
2) Attach.txt

* Save both logs to your desktop.
* Please include the entire contents of both logs in your next reply.

Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copy and pasting it into the reply.

taydan030109 · « **Reply #17 on:** April 10, 2009, 01:53:17 PM »

attached logs

[attachment deleted by admin]

evilfantasy · « **Reply #18 on:** April 10, 2009, 02:04:42 PM »

Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]

KillAll::

DDS::
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

Folder::
c:\programdata\ParetoLogic
c:\program files\common files\ParetoLogic
c:\progra~2\ParetoLogic
c:\program files\RegCure

File::
c:\windows\Tasks\ParetoLogic Registration.job
c:\users\corey\AppData\Local\Temp\catchme.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!

ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

----------

Your Java is out of date.

Older versions have vulnerabilities that malicious sites can use to infect your system.

First install the new Sun Java Runtime Environment

Be sure to close all browser windows before beginning the install.

Remove the old version(s)

Download JavaRa

Unzip the file and open the JavaRa.exe
Click Remove Older Versions
JavaRa will search for and remove any outdated version of Java and remove any that are found.
Click Additional Tasks
Place a check next to Remove Useless JRE Files and click Go
Exit JavaRa
Delete the JavaRa files from the Desktop

.
Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.

Go to Add or Remove programs and uninstall:

-Java(TM) 6 Update 7

taydan030109 · « **Reply #19 on:** April 10, 2009, 03:25:41 PM »

another log for you!

taydan030109 · « **Reply #20 on:** April 10, 2009, 03:26:50 PM »

here

[attachment deleted by admin]

evilfantasy · « **Reply #21 on:** April 10, 2009, 03:38:27 PM »

OK how is the computer running now?

taydan030109 · « **Reply #22 on:** April 10, 2009, 03:47:46 PM »

everything is still the same as my very first post

evilfantasy · « **Reply #23 on:** April 10, 2009, 03:53:37 PM »

Download DrWeb CureIt & save it to your desktop. Scan with DrWeb-CureIt as follows:

Double-click on drweb-cureit.exe and then click Start
An information notice will appear, click OK.
This starts a short scan that will scan the files currently running in memory.
If you get a prompt to buy the full version just exit out of the window. The scanner will still work without buying the full version
If or when something is found, click the Yes button when it asks you if you want to cure it.

Once the short scan has finished, Click Settings > Change Settings
Under the Scanning tab UNcheck Heuristic analysis and click OK
Back at the main window, select the Complete scan button and then click the Green Arrow Start Scanning button on the right and the scan will start.
Click Yes to all if it asks if you want to cure/move any file(s).
When the scan is done.
In the Dr.Web CureIt menu on top left, click File and choose Save report list.
Save the DrWeb.csv report to your Desktop.
Exit Dr.Web Cureit.
Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

* After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
* Copy and paste that log in the next reply

taydan030109 · « **Reply #24 on:** April 10, 2009, 07:05:41 PM »

doing the complete scan, its stuck on PC TOOLS anti virus...... it just keeps scanning the same files over and over.... with no other progress when i look in add/remove programs its not there so now i realy dont know?

?

evilfantasy · « **Reply #25 on:** April 10, 2009, 07:19:42 PM »

I can't remember if you can pause Dr Web or not but it either needs to be paused or stopped to do this.

You need to go in and delete all of these files.

c:\users\corey\appdata\roaming\PC Tools
c:\programdata\PC Tools
c:\program files\PC Tools AntiVirus
c:\program files\PC Tools

You will need to unhide some folders to find them.

How to show hidden files in Windows Vista

To enable the viewing of Hidden files follow these steps:

Close all programs so that you are at your desktop.
Open the Control Panel menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and exit My Computer.
Now your computer is configured to show all hidden files.

.
Once we are finished remember to re-hide the hidden files/folders.

taydan030109 · « **Reply #26 on:** April 10, 2009, 07:54:04 PM »

the only thing i can find and delete is in the roaming.. now i clicked deleted, went to my recycle bin i emptied that.. now wat??

evilfantasy · « **Reply #27 on:** April 10, 2009, 08:00:51 PM »

Download the OTMoveIt3 by OldTimer

Note: If you are running on Vista, right-click on OTMoveIt3.exe and choose Run As Administrator.

* Save it to your Desktop.
* Double-click OTMoveIt3.exe to run it.
* Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)

Code: [Select]

:Processes
explorer.exe

:files
c:\programdata\PC Tools
c:\program files\PC Tools AntiVirus

:Commands
[purity]
[emptytemp]
[start explorer]

* Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
* Click the red Moveit! button.
* Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process.

taydan030109 · « **Reply #28 on:** April 11, 2009, 07:58:29 PM »

the move it log says its too big to attach it......

evilfantasy · « **Reply #29 on:** April 11, 2009, 09:08:46 PM »

That's OK it should have removed the folders and files.

taydan030109 · « **Reply #30 on:** April 11, 2009, 09:50:07 PM »

k??? i still have all the same probs tho

taydan030109 · « **Reply #31 on:** April 12, 2009, 05:03:09 PM »

ok now my comp keeps shuttin down and a pop up saying windows has expeierenced an unexpected error needs to shut down........... my comp only stays running about 15 mins and restarts...
Aslo my green light that shows something is running, will not stop.... wat is going on?

?

evilfantasy · « **Reply #32 on:** April 12, 2009, 05:04:42 PM »

I'm not sure but I don't think it is a malware issue. Try here http://www.bleepingcomputer.com/tutorials/tutorial148.html

taydan030109 · « **Reply #33 on:** April 12, 2009, 07:57:22 PM »

i would love to try that other site, but i cant...
i need to activate my email and password, and i cant becuz my email is "sucure server...." i cant sign in to check emails..................
I ran another scan from dr. web, and i cant attach log but i did a print screen of wat it shows, i dont know where or how to go from that, can you maybe still help PLEASE

[attachment deleted by admin]

evilfantasy · « **Reply #34 on:** April 12, 2009, 08:05:42 PM »

That's not any threat.

Why do you need your email to visit BleepingComputer?

taydan030109 · « **Reply #35 on:** April 12, 2009, 08:17:58 PM »

to make an account to ask for help, it says it needs to verfiy my email...
I CANT OPEN IT tho.... and the bottom of that attachment, it says VIRUSes found...........
The longer i cant get this fixed the more shhiiiiiiit, happens to my comp.

evilfantasy · « **Reply #36 on:** April 12, 2009, 08:19:20 PM »

I wasn't sending you there to ask for help. Read the article on the page in the link. How to automatically repair Windows Vista using Startup Repair - http://www.bleepingcomputer.com/tutorials/tutorial148.html

taydan030109 · « **Reply #37 on:** April 12, 2009, 08:24:53 PM »

simple but i dont have any disc's for laptop.......it was purchased second

evilfantasy · « **Reply #38 on:** April 12, 2009, 08:33:59 PM »

You can try posting in the Computer Help forum to see if anyone has any new ideas.

Computer Hope Forum

News:

Author Topic: virus? malware? os? computer stupid? (Read 13014 times)

taydan030109

BC_Programmer

taydan030109

BC_Programmer

taydan030109

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy

taydan030109

evilfantasy