Open With Problem 2

[dgreen]

Hi,

I have just read 007will's post (Open With Problem) and I have exactly the same issue.
I realise I can not simply solve this by following the instructions on his post as every one is different.

I would very much appreciate help in resolving this problem.

I am running XP and also AVG virus scanner (this runs a nightly scan)

Thanks so much

David

[BC_Programmer]

Hello dgreen-

Even if you are experiencing the same symptoms as another poster, it could be caused by something completely different. Either way- the malware experts will need you to follow the steps described  here, and to post the logs here for them to examine, and then they can advise you further.

[dgreen]

Hi BC,

Thanks for that advice, the only problem is, how do I run these utilities if I can't open anything on the infected PC ?

(I hope that isn't a dumb question)

Thanks

David

[SuperDave]

Hello dgreen and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
Save Rkill to your desktop.

There are 4 different versions. If one of them won't run then download and try to run the other one.
 
Vista and Win7 users need to right click Rkill and choose Run as Administrator
 

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.exe
Rkill.com
Rkill.scr
Rkill.pif

Once you've gotten one of them to run then try to immediately run the following.
 
Now download and Run exeHelper.

Please download exeHelper from Raktor to your desktop.

• Double-click on exeHelper.com to run the fix. A black window should pop up, press any key to close once the fix is completed. A log file named log.txt will be created in the directory where you ran exeHelper.com Attach the log.txt file to your next message.
  
  Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).
  

[dgreen]

Hi Dave

Thanks for your help.
I have copied the files to CD and hopefully one of them will run on the PC.
I will post the logs on here as soon as I get back home (I travel quite a bit so apologies for any delays between postings)

Thanks again, I really appreciate it.

Regards,

David G

[dgreen]

I've run the Rkill & exeHelper utilities.

The logs are below:

Rkill log:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Administrator on 06/03/2010 at 16:01:36.


Processes terminated by Rkill or while it was running:


C:\Documents and Settings\Administrator\Desktop\rkill.com


Rkill completed on 06/03/2010  at 16:01:41.



exeHelper:

exeHelper by Raktor
Build 20091220
Run at 16:07:20 on 03/06/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

[SuperDave]

Hi Dave. Now, could you please go to the link in Reply 1 and see if you get those programs to run? Please post any logs that you can create.

[dgreen]

Hi Dave,

I am about to follow the instructions listed in the Computer Hope Virus and Spyware section Guidelines but I can not do step A as the PC will not allow me to open anything.
I have AVG installed but it has been deactivated and is not running.

Regards,
David

[SuperDave]

Ok. I would like for you to try this. Please ensure that you follow all the directions.

Go to this link to create a Rescue CD or to this site to create a Rescue USB. Carefully follow all the instructions for whichever method you choose.

[dgreen]

Since my last post and prior to your latest post I have somehow managed to get AVG to run.
I did a scan and there was no infection detected.

Shall I still go ahead with the Rescue USB?

[SuperDave]

Shall I still go ahead with the Rescue USB?

Only if you can't get the other scans to run. I will need the SAS, MBAM and HJT logs.

[dgreen]

Hi Dave,

I have tried to get the USB bootable to work but there is no option in the PC's setup to allow a USB as a bootup.
The infected PC is a DELL Optiplex GX260.
Should I be doing something else to get this working.

Thanks

[SuperDave]

You still cannot run the SAS, MBAM and HJT scans? What happens when you try to download and run them?

[dgreen]

Hi Dave,

I managed to run SAS and left it overnight to complete the scan.
When I came back to it this morning the scan seemed to have finished but there was no summary box or anything else open relating to SAS.
The only thing that was open was AVG asking for an upgrade to ver 9 (free) which I did.
I opened SAS and saved the log (see attached).
I then ran MBAM (see log attached).
I've updated JAVA and run CCleaner.
I then ran HJT (see attached Log)

Thanks



[recovering disk space - old attachment deleted by admin]

[SuperDave]

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

R3 - URLSearchHook: (no name) - 0467aefd-1e68-4957-a5a7-5ace32ea1167} - (no file)
R3 - URLSearchHook: (no name) - bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - (no file)
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
(Description: Intel hotkey applet. Unnecessary. Removing this will free up a small amount of system resources.)
O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Program Files\Common Files\Java\Java Update\jusched.exe\"
(Description: Sun Java update scheduler. Checks for updates. Not necessary. Removing this entry will free up a small amount of system resources.)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] \"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe\"
(Description: Adobe reader startup - unnecessarily uses system resources.)
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

==========================

Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

link # 1
link #2

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts. (you will receive a UAC prompt, please allow it)

Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

[dgreen]

Hi Dave,

ComboFix & HJT logs attatched as requested.

Can I ask why HJT had to be renamed to sniper and also whenever you have referred
to HJT should I be running sniper?

Thanks

[recovering disk space - old attachment deleted by admin]

[SuperDave]

P2P - I see you have P2P software installed on your machine. (BitTorrent) We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs.

=======================

ESET Online Scan

Scan your computer with the ESET FREE Online Virus Scan

* Click the ESET Online Scanner button.

* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.

* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the Back button then click Finish.

In your next reply please include the ESET Online Scan Log

[dgreen]

Hi Dave,

Did the ESET scan which returned no threats but it didn't give me the option to save a report it only gave the option to either uninstal it or close it.

Any ideas.

Thanks

[SuperDave]

Did the ESET scan which returned no threats but it didn't give me the option to save a report it only gave the option to either uninstal it or close it.

No threats is good news. When that happens, it doesn't produce a log. I never did find out what your original problem was with your computer. Is it working any better now?

[dgreen]

Hi Dave,

The computer seems to be working perfectly and I think, better than ever so than you so much for your brilliant support, I really appreciate it.

Obvioulsy I should be running anti viurs software (which I am) but what else would you recommend I install to keep the computer safe and running well.

Cheers

David

[SuperDave]

The computer seems to be working perfectly and I think, better than ever so than you so much for your brilliant support, I really appreciate it.

Your Welcome. I'm glad I was able to help. Now it's time for some cleanup. You can uninstall HJT. You may keep SAS, MBAM and ESET if you wish. Update SAS and MBAM and run them on a regular basis. If you don't want to keep ESET, just delete it.

To uninstall ComboFix

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

(Note: Make sure there's a space between the word ComboFix and the forward-slash.)

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

==============================

Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

===============================

Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
===============================

Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

[SuperDave]

I also forgot to mention that you already have MicroSoft Malicious software removal Tool on your computer. Just go to run, and type in mrt.exe to run the scans. It doesn't produce a log so I never use to clean other computer but I use it on both my computers. If it's not there, you can download from the MS download site.