Computer won't let me access anti virus websites or downloand any anti virus software

Question

katrina85_04 0 Newbie Poster

15 Years Ago

Hello,

I believe I have a virus but I don't know what to do about it. Any time I try to download a program to fix my computer, it won't let me. Also, if I try to go to a website for an anti virus program, I get an error page. Occasionally when I am on the internet tons of internet explorers will open on their own, over and over again, crashing my computer.
Please help.

Thanks in advance!
Katrina

windows-virus

12 Contributors
43 Replies
1K Views
2 Years Discussion Span
Latest Post 12 Years Ago Latest Post by CHaoTiiKX

jholland1964 650 Posting Expert

15 Years Ago

Do you have access to another computer? If so you could download programs to a thumb drive or cd and then take them to the infected computer and install them. You could also try Safe Mode with Networking which would allow you to boot the computer with only the barest necessary files running AND give you internet access and you possibly could download removal programs that way.

PhilliePhan 171 Central Scrutinizer

15 Years Ago

I was able to download and run Vundo, but it said it did not find anything

Well . . . That's not good.

-- Try this:
Get a command prompt (start > run > type cmd > OK\
Type or Copy&Paste ipconfig /flushdns at the prompt and hit ENTER.
See if that helps at all.

-- You will probably need to purchase a flash drive and use a friend's computer or a compy at your local library or coffeeshop to download some more comprehensive cleaning tools such as MBAM and Combofix.
That would be the easiest course of action.

PP :)

crunchie 990 Most Valuable Poster

15 Years Ago

Hello, I am new here and even though I am in School for information TECHNOLOGY, i STILL AM VERY LOST. i WAS READING THE LASt POST HERE (sorry about the caps) and did the file rn too. I 'm going to post thereport if anyone would please te a ook at it and hlp me out I wil be forever grateful

Hi ourchiliean.

First of all- welcome to Daniweb :).

We ask that members not piggy-back questions on to a thread previously started by another member here in the Viruses, Spyware & other Nasties forum, (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/forums/faq.php?faq=daniweb_policies

Thanks for understanding.

ourchiliean commented: Thank you for the information, this site is great yet also a little vwerwhelming +0

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Thank you for the information, this site is great yet also a little vwerwhelming

katrina85_04 0 Newbie Poster · Answer 1 · 2009-10-05T01:42:13+00:00

Thanks for your response, I do not have access to another computer that I can download those programs from unfortunately.
I have tried using safe mode with networking and for some reason I still cannot get those websites

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 2 · 2009-10-05T02:01:31+00:00

Exactly WHAT website are you trying to access? Are you using the infected computer to come here?
Try downloading and running HiJackThis using this executable.
Then run the scan and post the log here.

katrina85_04 0 Newbie Poster · Answer 3 · 2009-10-05T03:52:09+00:00

Well one website I have tried to use is the AVG website, to update my AVG scanner. The virus will not allow me to get to this website. And also, I tried clicking on your link to download hijackthis, and the virus would not let me visit that page either.
I found this website using the Google, but this is also something I forgot to mention: Whenever I run a search (doesn't matter if it is google, yahoo, msn, or whatever), I have to copy and paste the actual link from the results to visit the website... if I click on the link from the search engine results, I get taken somewhere else. Hopefully that makes sense.
** And yes, I am using the infected computer right now

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 4 · 2009-10-05T04:04:51+00:00

What I gave you was really not a link to a website but should have given you the actual executable program file.
Can you access this site which will give you HiJackThis

katrina85_04 0 Newbie Poster · Answer 5 · 2009-10-05T06:10:48+00:00

Ok the link to the place where I could download it worked for me this time. Here is the log...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:06:08 PM, on 10/4/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\Rar$EX01.250\Analysethis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O16 - DPF: CM_AdvancedCAB - https://www.gs.reyrey.com/common/ClientCheck/CM_AdvancedCAB.CAB
O16 - DPF: PrintTemplateViewerCab - https://www.gs.reyrey.com/clientdll/printtemplateviewer.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - http://www.symantec.com/techsupp/activedata/nprdtinf.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: ,avgrsstx.dll zrqabm.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Defender (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe (file missing)

--
End of file - 6576 bytes

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 6 · 2009-10-05T07:28:39+00:00

You are running Hijackthis from the zip file. Extract it to a permanent folder then run it again please.

katrina85_04 0 Newbie Poster · Answer 7 · 2009-10-05T08:17:38+00:00

Sorry, here it is again...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:16:17 PM, on 10/4/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\HP_Owner\My Documents\Analysethis\Analysethis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O16 - DPF: CM_AdvancedCAB - https://www.gs.reyrey.com/common/ClientCheck/CM_AdvancedCAB.CAB
O16 - DPF: PrintTemplateViewerCab - https://www.gs.reyrey.com/clientdll/printtemplateviewer.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - http://www.symantec.com/techsupp/activedata/nprdtinf.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: ,avgrsstx.dll zrqabm.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Defender (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe (file missing)

--
End of file - 6751 bytes

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 8 · 2009-10-05T10:34:45+00:00

You have Zone Alarm Firewall on there are you also running the Windows Firewall?
Try turning off Zone Alarm and see if you can access any of the security programs.
Have you done any scans with your AVG 8 that is you anti-virus program and where you should begin, with a full scan with it.

katrina85_04 0 Newbie Poster · Answer 9 · 2009-10-05T19:07:36+00:00

Even with zone alarm shut off, I am still unable to access the avg website. I just tried running avg and got this error message:
"avgwdsvc.exe has encountered a problem and needs to close. We are sorry for the inconvenience."
Tried running it again and got the same error message, however scan continues to run. I will let scan run it's course and see if anything pops up.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 10 · 2009-10-05T19:36:02+00:00

jholland1964 650 Posting Expert

15 Years Ago

Try running the scan in safe mode.

katrina85_04 0 Newbie Poster · Answer 11 · 2009-10-07T09:20:59+00:00

I tried running AVG in safe mode and the scan started, so I left the computer to do it's thing and when I came back there was nothing, just the start up screen for AVG again. Tried one more time to be sure and same thing...
I'm not sure why it won't let me run AVG??

umesh8all 0 Newbie Poster · Answer 12 · 2009-10-07T09:34:14+00:00

First Close two services Analysethis.exe & ctfmon.exe & then try to access the websites. according to me these services are the viruses which don't let us open several websites.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 13 · 2009-10-07T10:07:51+00:00

Both of these files are fine.
Analysethis.exe is HiJackThis only renamed.
ctfmon.exe is located properly and is involved with the language/alternative input services. It will run as long as Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features and can be turned off there.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 14 · 2009-10-07T10:25:33+00:00

Hi Katrina,

See if you can do this:

-- Download DDS by sUBs and save it to your Desktop
-- If your AV has a script blocker, please disable it
-- DoubleClick on dds.scr to run the tool

* A command box will open, displaying added information for your reading pleasure while DDS completes its scan.
* Upon completion, a Dialog Box should open instructing you to save and post the TWO resulting logs (DDS.txt & Attach.txt).

- Copy&Paste the DDS.txt into your next post.
- Please post Attach.txt as an attachment to your post - there is no need to Zip it. If you don’t know how to post an attachment, please Copy&Paste it along with the DDS.txt scanlog.

Cheers :)
PP

katrina85_04 0 Newbie Poster · Answer 15 · 2009-10-09T18:50:49+00:00

I tried to download, but when I clicked on the link you provided, the page loaded like what it does when I try to go to AVG's website (internet explorer cannot display the page)

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 16 · 2009-10-10T01:10:38+00:00

I tried to download, but when I clicked on the link you provided, the page loaded like what it does when I try to go to AVG's website (internet explorer cannot display the page)

--- Are you able to RightClick on the DDS link I posted and select "Save As" and then save it?

--- Run a scan with HijackThis and Check the Box next to this line and then Click "Fix Checked."
O20 - AppInit_DLLs: ,avgrsstx.dll zrqabm.dll

--- Please do a search of your machine for this file: zrqabm.dll
It will likely be in the System32 Folder - Be sure to enable the viewing of hidden files.

Then, once you find the file's location see if you can do this:

Go here ---> and use the Browse Button at the top of the page to navigate to zrqabm.dll and and Submit it for analysis. Let us know what you find.

Best Luck :)
PP

katrina85_04 0 Newbie Poster · Answer 17 · 2009-10-11T20:53:53+00:00

Hello!
I'm going to start this off with thank you for posing all of those tips.
HOWEVER (now I get to the frustrating part)
When I right clicked on that download to save as, I got this error message: "Internet Explorer cannot download dds.scr from download.bleepingcomputer.com.
A connection with the server could not be established."

So I ran HiJack this and found zrqabm.dll and fixed it.
I then ran the scan and found the file.
BUT when I tried clicking on the website you told me to go to, my lovely computer would not let me go there. It displayed the usual internet explorer cannot display the webpage.
I do have firewalls turned off.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 18 · 2009-10-12T00:52:02+00:00

So I ran HiJack this and found zrqabm.dll and fixed it.
I then ran the scan and found the file.

-- Are you able to ZIP zrqabm.dll and attach it to your next reply? Please try that for me.

-- Download and Install Firefox browser (linky below) and tell us if you have the same problems as with IE.
http://www.mozilla.com/en-US/

PP :)

katrina85_04 0 Newbie Poster · Answer 19 · 2009-10-12T04:10:19+00:00

katrina85_04 0 Newbie Poster

15 Years Ago

Here is the attachment you requested, and I am currently testing out Mozilla. Will let you know if it lets me access that website. Thanks!

This attachment is potentially unsafe to open. It may be an executable that is capable of making changes to your file system, or it may require specific software to open. Use caution and only open this attachment if you are comfortable working with zip files.

zrqabm.zip (110.06 KB)

katrina85_04 0 Newbie Poster · Answer 20 · 2009-10-12T04:12:32+00:00

Just tried downloading with Mozilla, and still would not work. :(

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 21 · 2009-10-12T05:33:06+00:00

Here is the attachment you requested, and I am currently testing out Mozilla. Will let you know if it lets me access that website. Thanks!

Yep - that's a baddie.
http://virusscan.jotti.org/en/scanresult/09720eaf5c44c34795dc5068ac91f0bb70aa5e8b

Go ahead and DELETE zrqabm.dll

-- See if you are able to access and run VundoFix as per the linky below:
http://vundofix.atribune.org/

--- Do you have a flash drive you can download tools to from a clean computer. Or, perhaps burn them to cd?

PP:)

katrina85_04 0 Newbie Poster · Answer 22 · 2009-10-12T07:36:32+00:00

Thank you for researching that for me.
I tried to delete the file and got this error message: "Cannot delete zrqabm: access is denied

I do not have access to a clean computer where I can download those programs unfortunately.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 23 · 2009-10-12T08:58:09+00:00

Thank you for researching that for me.
I tried to delete the file and got this error message: "Cannot delete zrqabm: access is denied
I do not have access to a clean computer where I can download those programs unfortunately.

What about the link for VundoFix?
If you cannot get that link to work, please do this:

Download the attached VundoFix.zip and extract Vundofix.exe to your Desktop. Do not run it from the ZIP!

* Double-click VundoFix.exe to run it.
* When VundoFix opens, click the Scan for Vundo button.
* Once it's done scanning, click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will reboot your computer, click OK

*****Note: It is possible that VundoFix encountered a file it could not remove.*****
In this case, VundoFix will attempt run on reboot, simply follow the above instructions starting from "Click
the Scan for Vundo button." when VundoFix appears at reboot.

Please post the Vundofix log for me. ---> C:\VundoFix.txt

PP :)

katrina85_04 0 Newbie Poster · Answer 24 · 2009-10-12T20:59:01+00:00

I was able to download and run Vundo, but it said it did not find anything

ourchiliean 0 Newbie Poster · Answer 25 · 2009-10-14T15:02:53+00:00

Hello, I am new here and even though I am in School for information TECHNOLOGY, i STILL AM VERY LOST. i WAS READING THE LASt POST HERE (sorry about the caps) and did the file rn too. I 'm going to post thereport if anyone would please te a ook at it and hlp me out I wil be forever grateful

JohnGDonohue 0 Newbie Poster · Answer 26 · 2009-10-14T20:16:05+00:00

One of the things viruses do is put fake web addresses into the HOSTS file (on Windows XP: C:\WINDOWS\system32\drivers\etc\hosts). All you have to do is edit that file with Notepad, remove the lines that redirect symantec.com, etc., and you should now be able to get to the "real" websites. Good luck.