Computer Hope
Software => Computer viruses and spyware => Topic started by: roughbernie on July 12, 2008, 12:56:53 PM
-
Dear kind sirs
I downloaded a virus I tried every thing from Norton AVG and one care but I still had the Virus alert next to my time in the bottom right of the computer. In addition I could not open the programs in the windows file nor find the icons that display my C and D drives. I have completed the initial scans as explained in the "Read this before requesting malware removal help" and everything seems to be normal now. Please could you go through my logs to see if any more help is required thankyou. PS Im not very computer savy so I will need a lot of explaining when it comes to remedies thanks.
[recovering disk space -- attachment deleted by admin]
-
*** Download, and run CTFMON-Remover: http://www.gerhard-schlager.at/en/projects/ctfmonremover/
The CTFMON-Remover helps you removing the annoying CTFMON.EXE from your Windows operating system. The program is easy to use and displays whether the CTFMON.EXE is installed and running or not. If it was found then you can remove it within seconds. Just in case that you need the CTFMON sometime in the future there is also an option to restore the original one.
Note:The CTFMON.EXE is among other things responsible for changing the language schema of your keyboard (e.g. for switching between the German and English keyboard layout). So in case you are using this feature you shouldn't remove or disable the CTFMON.EXE!
*** Download, and run QuickTime Killer: http://www.softpedia.com/get/System/Launchers-Shutdown-Tools/QuickTime-Killer.shtml
QuickTime Killer will remove QuickTime from start up and kill any running QuickTime processes. This application runs silently at start up and closes itself as soon as it takes care of QuickTime
*** Did you install Win-Spy?
1. Print this post out, since you won't have an access to it, at some point.
2. Close all windows, except for HijackThis.
3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases [marked with *], no actual program will be removed):
- O2 - BHO: (no name) - {3BA3028F-FD37-46BF-AD27-733734684F06} - (no file)
- O2 - BHO: (no name) - {51664F3E-54BC-4EF7-ADF9-98F6FDDBCE70} - (no file)
- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
- O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
- O3 - Toolbar: (no name) - {80123684-A222-4009-8220-A867294D6DE8} - (no file)
- *O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
- *O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
- *O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
- *O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
- *O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
- *O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
- *O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
- *O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
- *O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
- O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present (to be fixed if not done intentionally)
- *O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
- O20 - Winlogon Notify: awtqnkhe - awtqnkhe.dll (file missing)
4. Click on Fix checked button.
5. Restart computer.
6. Post new HijackThis log.
-
here is my new hijack this log (i did as you requested)
[recovering disk space -- attachment deleted by admin]
-
Your computer is clean (http://209.85.48.8/228/109/upload/p3879546.jpg)
1. Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version.
Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html.
Run CCleaner.
2. Turn off System Restore:
- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK
3. Restart computer.
4. Turn System Restore on.
5. Download, and install McAfee SiteAdvisor: http://www.siteadvisor.com/download/ff.html. It'll warn you (in most cases) about dangerous web sites.
6. (optional) Download, and install free version of ThreatFire: http://www.threatfire.com/. It'll give you an extra protection against malwares. It won't interfere with your antivirus program
7. Read "So how did I get infected in the first place?": http://www.castlecops.com/postlite7736-.html
8. Let me know, how your computer is doing.
-
Thanks alot for your time and effort your a star.
Just one last question I paid for Norton 2 months ago how come this didnt pick up the viruses?
-
1. There is no perfect antivirus program.
2. Norton is pretty lame antivirus application.
-
hi guys... have the same problem virus alert in taskbar, can't see c drive in my computer, can't open task manager and various thigs in my tart menu are no longer available... have ran hijack this and checked the boxes you instrutced roughbernie and after fixing them everything is still on the computer.... any idea's??
thanks
-
ungerey
You need to start your own topic.