Computer Hope
Software => Computer viruses and spyware => Topic started by: varun on March 15, 2008, 12:24:20 AM
-
i found maindwxp malware. i think it comes frm orkut...
i saw it in process list in window taskwar... also its present in startup option in msconfig...
i removed it frm processes and also check frm startup....
but nortan antivirus 2007 is not able to detect this. also i tried window defender which is also unable to detect it...
so what can i do to get rid of it;;;;
is it very harmful for system
-
Start here
Please read this before requesting help. (http://www.computerhope.com/forum/index.php/topic,46313.0.html)
-
during installation of sp1a i got setup error msg...
" setup has detected that the srvice pack version of the system installed is newer than the update you are appling to it.
you can only install the update on service pack1."
rest all i have done
here are the log files
[recovering space - attachment deleted by admin]
-
What SP1a are you talking about? Why did you try to install it, since you have SP2 installed?
Is Windows firewall ON?
Go to Add\Remove, and uninstall Rediff Toolbar, if present.
Post new HJT log.
-
varun, Norton is not capable of detecting malware, but download a program called Ad-Aware from download.com it IS capable of detecting and deleting malware.
-
Start here
Please read this before requesting help. (http://www.computerhope.com/forum/index.php/topic,46313.0.html)
under instruction it is given to download sp1a...
i deleted rediff toolbar as per ur instruction
here is the new hjt log
[recovering space - attachment deleted by admin]
-
varun, Norton is not capable of detecting malware, but download a program called Ad-Aware from download.com it IS capable of detecting and deleting malware.
macdad:
If you receive advice from someone other than the approved Malware Removal Specialists, you do so at your own risk. We are not responsible if you take potentially inaccurate/harmful advice from someone who is not a designated helper. Anyone interested in joining the crew must have a good amount of experience and submit references to CBMatt (Chris) in a PM. References will be checked. Others posting advice without approval are subject to have their posts removed immediately as the wrong advice is too risky. We welcome new helpers so if you are interested, follow the above guidelines.
-
from today i also found a problem in my internet explorer 7.0
i posted this problem as a seprate post in internet browser forum
http://www.computerhope.com/forum/index.php/topic,53306.0.html
plz look at it also....
-
srry patio, i just wuz trying to help, since Ad-Aware is actually a certifictied anti-malware prog and that it helped me deleted all the malware on my comp so i wanted to lend a hand.
-
I understand...however his infection is identified as a Trojan which AdAware is not designed to deal with....
-
o srry.
-
under instruction it is given to download sp1a...
Oh, that's in case, you don't have any SP installed. You're fine here.
Does your Norton include firewall, or you have Windows firewall on?
1. Print this post out, since you won't have an access to it, at some point.
2. Close all windows, except for HijackThis.
3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed):
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
- R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
4. Click on "Fix checked" button.
5. Turn off System Restore:
- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK
6. Restart computer.
7. Turn System Restore on.
8. Post new HijackThis log.
-
i am also facing problem with my internet explorer 7.0
which i posted in internet browser forum
plz see
http://www.computerhope.com/forum/index.php/topic,53306.0.html
and here is the is the new log
[recovering space - attachment deleted by admin]
-
The log is clean.
Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version.
Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner
Let me know afterwards how your computer is doing.
-
hiii
after analyzing when i click on runcleaner tab i got the msg
"rundll
error in intetcpl.cpl
missing entry:clearmytracksbyprocess"
and also internet explorer give error still not working.....
these are log files for runcleaner and registry
[recovering space - attachment deleted by admin]
-
It looks from your logs, that CCleaner actually worked.
As for IE7 problem, open it, go Tools>Internet Options>Advanced tab, and click on Reset button.
Restart computer.
Does Firefox work? Where are you posting from?
-
yes firefox working .. i am posting frm firefox
-
i cant do what u say bcoz as i click on the explorer the window showing error come and it hang unless i click dontsend . tools etc icons are not coming....
-
i do search for maindwxp now and i again find it in the location given below
maindwxp.execommonstartup c:\windows\pass
and also when i run msconfig
it is present in startup it is not tick(right mark) in startup but it is present 2 times.
-
it is present in startup it is not tick(right mark) in startup but it is present 2 times.
If it's not ticked, it doesn't start. Nothing to worry about.
c:\windows\pass
pass, or pss folder?
maindwxp.execommonstartup
Please, post exact file name, and location.
i cant do what u say bcoz as i click on the explorer the window showing error come and it hang unless i click dontsend
Instead of opening IE, go Start>Control Panel>Internet Options>Advanced tab
-
ya it is pss
and i found maindwxp.execommanstartup C:\windows\pss
exactly same writtern in search window
can i click restore default in advance tab
-
No. You click "Reset" button, not "Restore Defaults".
-
i see only restore default button in advance tab and no restore button in tat tab.....
-
no reset button
-
So, you don't see this:
(http://209.85.48.8/228/109/upload/p3758389.gif)
-
no
infact in accesability i saw only two option..
first two and both are uncheak
instead advanced setting .... in my tab writtern as restore default
and after tat nothing
i hve windows xp pro
details from winver
version5.1(build 2600.xpsp_sp2gdr.070227-2254:service pack 2)
physical memory abailable to windows 1,038,452kb
-
I'm not sure what's going on here....Your HJT log shows, that you have Internet Explorer 7, but from your description, it looks like IE6.
Open IE, go Help, and click on "About Internet Explorer". What does it say about version?
-
ya it is ie7 and i cant able to open it .
as i click it error window come.
can i reinstall it.
i do search for maindwxp now and i again find it in the location given below
maindwxp.execommonstartup c:\windows\pss
and what will i do for maindwxp.
-
IE7 should be listed in Add\Remove. When you uninstall it, it'll go back to IE6. See, if IE6 will give you errors as well.
Please, post fresh HJT log.
-
ie7 is not present in add\remove . i can see firefox in add/remove
this is fresh hjt log
[recovering space - attachment deleted by admin]
-
Hi Broni and varun.
To remove IE7
First download the IE6 installer to the desktop just in case you need it. (don't install it)
Download Internet Explorer 6 (http://www.microsoft.com/windows/ie/ie6/downloads/critical/ie6sp1/default.mspx)
If you are unable to see IE7 in Add or Remove Programs follow these steps:
- Click Start
- Click Run
- Type or copy and paste, into the text box:
- %windir%\ie7\spuninst\spuninst.exe
- Then Press Enter
- Restart your computer.
.
Now try to open internet explorer. If it doesn't work the run the installer for IE6 you just downloaded. If IE6 does work then delete the installer from the desktop.
-
thanks evilfantasy and broni...
now ie7 problem is solved.
i downloded it again frm microsoft. and it remove previous explorer automatically at the time of downloding.
now the problem left is maindwxp. plz see my hijack log and tell me what to do know.
and also i want to know uptil know what the problem with my system. actually i am
computer science student so want to know details for knowledge.
-
Thanks, evil :)
varun
1. Turn off System Restore:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
2. Restart in Safe Mode.
3. Go Start>Run, type in:
regedit
Click OK.
Registry Editor will open.
Click File>Export, and save your registry to safe location.Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
One of the services listed there will be Partizan, and its value: "Group" = "Boot But Extender"
Right click on Partizan entry, and click Delete.
4. Close Registry Editor, and open Windows Explorer.
Navigate to:
C:\windows\pss
and delete maindwxp.exe file
5. Restart in Normal Mode. Turn System Restore on. Create fresh Restore Point.
-
hi broni
sorry for late reply
i deleted maindwxp from the location but dint see any file named as partizen in location given by you.
i also attached the recent highjack log, i saw again rediff toolbar in the log, but this time it is not present in the add/remove.
is my system safe now,
also plz decribe me actually what was the problem with my system.
in add/remove yahoo toolbar is present can i delete it also. is toolbar harmful for system. why??
-
here is the log
[recovering space - attachment deleted by admin]
-
Open HJT, and checkmark following lines:
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
- R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server.toolbar.rediff.com/toolbar/3.0/sidesearch.html?mode=toolbar
Click "Fix checked".
Restart computer, and post new HJT log.
P. S. You were infected with The Orkut Worm (maindwxp.exe). More info: http://www.symantec.com/enterprise/security_response/weblog/2008/02/the_orkut_worm_digging_deeper.html
-
NEW LOG
[recovering space - attachment deleted by admin]
-
Looks good...
HJT log is clean.
1. Turn off System Restore:
- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK
2. Restart computer.
3. Turn System Restore on. Create new Restore Point.
4. Run CCleaner one more time.
6. Download, and install free ThreatFire: http://www.threatfire.com/, which will give you real-time protection against malwares.
It won't interfere with your antivirus, nor firewall.
7. Let me know, how your computer is doing.
-
rest is normal but sometimes on system tray i saw mcafee icon..
my antivirus is nortan
previosly it was mcafee
and when i tried to click that icon it disappeared surprisngly
can i delete registry backup files that was save during ccleaner
-
but sometimes on system tray i saw mcafee icon..
Thank you for sharp eye. Apparently, I missed something.
Disable Windows Defender, as it'll interfere with cleaning process:
* Open Windows Defender
* Click Tools
* Click General Settings
* Scroll down to Real Time Protection Options
* Uncheck Turn on Real Time Protection
* After you uncheck this, click on the Save button
* Close Windows Defender
Open HijackThis, and checkmark following lines:
- O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
- O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
Click "Fix checked".
Restart computer, and post new HJT log.
As for CCleaner backup, I'd leave it for a week, or so. If everything works fine, you may delete it.
-
sometimes on system tray i saw mcafee icon..
and when i tried to click that icon it disappeared surprisngly
why this happened.... why this disappeared.....
i post a new log....
now can i on windows defender or remain it off.....
[recovering space - attachment deleted by admin]
-
also in msconfig under services i can see mcafee framework service which is marked (right). and in c drive under program files this folder mcafee in which frame work services is present....
so can i delete this folder or uncheak service in msconfig......
-
You can keep Windows Defender on, no problem.
We'll delete McAfee folder in a moment. We must stop its service, first.
Go Start>Run, type in:
services.msc
Click OK.
Services window will open.
Find McAfee Framework Service in the list, right click on it, click Stop.
Right click again, click Properties, and under Startup type select Disabled from drop-down menu.
Restart computer.
Post new HJT log.
-
i got the message
cant stop mcaffe framework service
error 5 : accesss is denied
-
Restart in Safe Mode, and follow very same procedure.
-
it shows already stop
services.msc
Click OK.
Services window will open.
Find McAfee Framework Service in the list, right click on it, click Stop.
Right click again, click Properties, and under Startup type select Disabled from drop-down menu.
Restart computer.
Post new HJT log.
when i tried to disabled even in safemode got the same msg
cant stop mcaffe framework service from local network
erro5: access is denied
Restart computer.
[recovering space - attachment deleted by admin]
-
Download, and install Unlocker: http://ccollomb.free.fr/unlocker/
It'll install under right click menu.
Navigate to:
C:\Program Files\McAfee\Common Framework folder.
Right click on FrameworkService.exe file, click Unlocker.
Select Delete from drop-down menu. Click Ok.
Most likely, it won't let you delete, but it'll give you an option to delete on reboot.
Select that option. Click OK.
Restart computer.
Disregard any possible errors.
Post new HJT log.
-
hiiiiiiii broni..
new log
[recovering space - attachment deleted by admin]
-
Looks better...
Using Unlocker, now you should be able to get rid of a whole McAfee folder from C:\Program Files
Give me a new log, after restarting computer.
-
this is new log......
[recovering space - attachment deleted by admin]
-
Good.
Open HJT, checkmark this line:
- O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (file missing)
Click "Fix checked".
Restart computer. Give me new HJT log.
-
Great thread. Thanks for the help.
-
Oh, did you feed on it?...LOL
-
new log but still i see mcaffe framework service in it......
[recovering space - attachment deleted by admin]
-
Let's try one more time...
Go Start>Run, type in:
services.msc
Click OK.
Services window will open.
Find McAfee Framework Service in the list, right click on it, click Stop.
Right click again, click Properties, and under Startup type select Disabled from drop-down menu.
Restart computer.
-
broni, again same error when i tried to disable it...
acutually it is already stop... but when i go through properties and tried to disable..got the same error...
under its discription writtern "shared componenet framework for mcaffe product" status is blank and starttype is automatic.....
-
Open HJT.
Click Config... button.
Click Misc Tools button.
Click Delete an NT Service button.
Pop-up windows will open.
Copy this:
McAfee Framework Service
and paste it into pop-up window.
Click OK.
If any trouble with deleting the above service, try Safe Mode.
Let me know.
-
got msg service McAfee Framework Service is not found in the registry.........
but i can see it in log file..... in msconfig service option it is unchecked.......
-
Try very same steps, as in my last post, this time using McAfeeFramework, instead of McAfee Framework Service
-
got msg " mcaffee framework service is enable/or running . disable it first using hijackthis scan result or services.msc "
-
OK, then...
Go Start>Run, type in:
services.msc
Click OK.
Services window will open.
Find McAfee Framework Service in the list, right click on it, click Stop.
Then, go back to HJT, and try deleting NT service again.
-
it is already stop broni.. on right clicking i can see start tab active not stop tab... its status is stop...
-
Go Start>Run, type in:
cmd
Click OK.
Command Prompt window will open.
Type in:
sc delete McAfeeFramework
Hit Enter.
If any error with the above command, do the same from Safe Mode.
-
hello broni,
first of all sorry for late reply,
i did what u said but still even in cmd request denied is coming....
-
Try same thing in Safe Mode.
-
broni, even in safe mode i got same msg access is denied.... what to do know......
-
Download, and install RegSeeker: http://www.snapfiles.com/get/regseeker.html
Search registry for McAfeeFramework
Delete all found instances.
-
this is new hijack log.....
is it clean know.....
what can i do to make my system my system more fast....
[recovering space - attachment deleted by admin]
-
Finally, it's gone...good job :)
As for your system being faster....
What are your computer specs? Processor speed, amount of RAM, hard drive size/free space?
-
thanks broni...
following are the details..
core2duo processor 1.40ghz
1gb ram
160 gb harddisk divided in to 1drive of 20 gb and other 4 of 30 gb.. 10 gb for fedora os
two os fedora and xp prof....
10 gb total free space from 5 drive...
following are specification for free space
c 2.92
d 1.60
e .98
f 2.81
g 2.25
xp is in c drive...
os is running on booter grub....
approx 3,4 min system take for startup.....
-
Just thinking aloud...
...3GB free on 20GB Windows partition is just on the edge of 15%, Windows needs to operate properly
...Symantec may be another issue (hog)
How long does it take to start in Safe Mode?
-
now in c drive free space is 4.48gb.... in safe mode booting process take time but when dekstop screen
( wall paper) come then it take only few seconds. while in normal mode even after wallpaper came it will take time in launching systray icons..... ( under msconfig only 7 items are cheak in startup ).... in hibernate mode it is fine....
-
it will take time in launching systray icons
Pay close attention, which icon takes longer time to pop-up.
Do you have a lot of desktop icons?