Posts by jholland1964

I still would avoid putting anything liquid or anything that will soon become liquid, whether in a plastic bag and towel or not. Too risky if you ask me.

Boot to Safe mode and see if you can locate this Steam and stop it from auto starting. Sounds like it may be too much for your machine.

What anti-virus program told you this?

Sounds like an overheating problem to me also but frankly, I would avoid the snow on the laptop.
Here is a free program to test the temperature of the laptop

http://www.almico.com/speedfan.php

something still there for sure.
Try this one:
Download the TDSSKiller.zip archive and extract it into a folder on the infected (or possibly infected) computer with an archiver (WinZip, for example);
Run the TDSSKiller.exe file;
Wait until the scanning and disinfection completes. A reboot might require after the disinfection has been completed .
The utility starts scanning the system for malicious and suspicious objects when you click the button Start scan.
f the utility detects an infection with the MBR bootkit, it will report the it has detected an infected object type “Physical drive” and prompt for action:

Cure. This action is only available if the utility has identified the exact type of the bootkit. If it has detected an unknown bootkit, it will be reported as Rootkit.Win32.BackBoot.gen.
Skip.
Copy to quarantine. The utility quarantines the infected MBR.
Restore. The utility restores a standard MBR.
A reboot might require after the disinfection has been completed.
Post back with the log.

Ok, let's try this:
Please download ComboFix by sUBs from

http://www.bleepingcomputer.com/download/anti-virus/combofix

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop
• Physically disconnect from the internet.
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When ComboFix has finished running, you will see a screen stating that it is preparing the log report
• This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
• Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your …

Did you try to run MBA-M in Safe Mode?
HiJackThis is rarely used anymore. Please follow the steps given in our Read Me First sticky and post back here with all logs.
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

I've managed to donwload ATF cleaner and ran before running DDS Scanlogs. Does it affect anything? should I restart from the beginning and run everything again in that specific recommended order?
No worries. Doesn't matter when it was run.

Your log shows a rootkit on the computer, please do the following:

Please download the TDSSKiller following these instructions:
Download the TDSSKiller.zip archive and extract it into a folder on the infected (or possibly infected) computer with an archiver (WinZip, for example);

Run the TDSSKiller.exe file;

Wait until the scanning and disinfection completes. A reboot might require after the disinfection has been completed.
Post back here with the log.

Have absolutely no idea what it was you actually got when you were supposed to download the ATF Cleaner but that is not what you downloaded. When you got to the Majorgeeks download page what you should have seen was what shows in my print screen, then you should have chosen one of the 3 download links shown, 2 from Majorgeeks and one from Internode which is only for Australian users.Once you click one of those you receive the executable file to save to the computer.
Then you double click that file to install and it definitely IS called the ATF-Cleaner, not PC Cleaner

HiJackThis is rarely used today, please follow the instructions given in our Read Me First sticky and post back here with copy/pastes of the logs produced.
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Download a new copy of Combofix and run it again, we will see if it shows anything else.

Update MBA-M and do another Full Scan, have it remove everything it finds, reboot and post back with the log.

Please now do the following:
Download the TDSSKiller.zip archive and extract it into a folder on the infected (or possibly infected) computer with an archiver (WinZip, for example);
Run the TDSSKiller.exe file;
Wait until the scanning and disinfection completes. A reboot might require after the disinfection has been completed .
Post back with that log, then continue with instructions below:

Please download ComboFix by sUBs from

http://www.bleepingcomputer.com/download/anti-virus/combofix

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop
• Physically disconnect from the internet.
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When ComboFix has finished running, you will see a screen stating that it is preparing the log report
• This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
• Re-enable all the …

Have you tried Safe Mode with Networking?

Don't see much there. Can you get me the log from the SpyBot scan that found the trojans?
Do the following to access the logs:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Pervious reports. Look for the Checks with the correct date and double click to open it and then copy/paste it back here.

Also, have you tried resetting the modem and the router?
Turn off all computers, laptops and video game consoles that are using the Internet connection through the modem and router. Unplug the power cords from the modem and the wireless router.

Wait 30 seconds and plug the power cord into the modem. The modem will start up and the indicator lights will begin to flicker. Wait for the lights to remain steady.

Plug the power cord into the wireless router. The indicator lights will flicker as it establishes a connection to the modem. When the lights are steady, the Internet connection is reset.

Turn on the computers, one at a time, that are using the router. Allow each one to boot to the desktop.

There is nothing in the MBA-M scanner that would be causing power problems in the house. Sounds to me like you have more than a computer or router problem. The computer does not have to be online to do any of these scans, only time it would need to be online with MBA-M would be when it is updated, otherwise it can be totally disconnected from the internet. But as I said, there is nothing in the program that would even relate to power problems in the house, except the computer needs power to run of course but if it.

Those two DDS Logs were supposed to be copy/pasted, not attached. We don't open attached logs from possibly infected computers. The instructions are quite clear on that.

Good Job! Great to have somebody who reads and follows directions! Helps things move much faster.

Attach.txt log needs to be copy/pasted also. Then also run this scan, have it fix/remove anything found. Reboot and come back with the log.

ESET Online Scanner

http://www.eset.com/onlinescan/scanner.php?i_agree=14
* You can use Internet Explorer to complete this scan and you will need to allow an Active X to be installed or you may use Firefox
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.

Then I would say the AVG findings are a false postive. AVG is just not a very good anti-virus program. When researching your problem I found no other av program that found this file. I would advise you use a different anti-virus program, it certainly is one that I never recommend.
It rarely ranks among the highest or most reputable. My advice would be use Avira Free 2012 or Avast Free, but not AVG.
Your System restore is set way to large. You have restore points going back over six months. System Restore should never be used to go back that far, if it is used at all and then it should be only for a very few things.
Your Java is way out of date, you are running version 6 Update 25 and the most recent update is version 6 update 30.
Uninstall All Java listed in add/remove and then go here to download the latest version. http://www.java.com/en/download/manual.jsp

We have absolutely no information and the only way we can offer assistance is seeing the logs produced when you run these programs on our Read me before posting a request for assistance
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

We cannot offer any assistance until you run the tools from our Read Me first sticky and post the logs

http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Post back with logs produced and we will be happy to provide assistance.

We need the second log from DDS and also a log, not a screen shot, from AVG

Also please upload this file C:\WINDOWS\system32\services.exe

to https://www.virustotal.com/ for scanning.

Post back with that information given. Not a print screen, but full information.

AVG will not remove a trojan as you have found. You need to follow the steps given in our Read First sticky
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Run all the requested programs allow them to clean whatever is found.
Then post back here with Copy/Pastes of all requested logs and we can then help you complete the removal.

Alireza_021, crunchie has very patiently given you the correct instructions to follow but you have not followed those instructions for the correct use of MBA-M which clearly say, Post the Full Log, which you did not do, you only posted items found, the entire log from the very first line at the top which gives the following information:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version:
Operating System
Version of Internet Explorer
Time and date the scan was run
Type of scan run.
You posted none of the above, which is vital information needed for the helper to see.
You also didn't follow the very clear instructions given in the instructions which say;

Be sure that everything is checked, and click Remove Selected.
We know that you did not do this because your log shows for every item found;
-> No action taken.
Meaning you only ran the scan and then closed the program. So no wonder your system is not running, you didn't do the Key step with the program which is tell it to clean.
You need to UPDATE the program once again and run another Full Scan and this time Have it Clean, reboot and come back here and post the entire log from top to bottom. Then we can give you the additional steps needed and based on the findings in the log there will be other steps needed.

Those are only two of the logs requested and it is not a removal program it only gives a picture of all that is installed and running on the computer. We need to see ALL the logs from the programs run from our Read Me First sticky, not just these two. According to the logs posted you did not install or run any of the other programs listed in the sticky, so you did NOT attempt to clean the machine, you only ran DDS. If you truly want to get the machine cleaned then you have to run all of the programs requested.

These two logs most definitely show a huge amount of malware on the computer.

You show three or parts of three different anti-virus programs on the computer though none of them show on the installed programs list;
ESET NOD32 Antivirus 4.0
Authentium AntiVirus5
Symantec\Norton

All of the items listed below are installed and were running on the computer during the DDS Scan and every single one of them is known malware;
AskToolbar
Babylon toolbar
Chikka Messenger V4
ICQToolBar
RegWork
Sky-Banners Browser Enhancer
SpeedyPC Pro
Street-Ads Browser Enhancer
Support.com Toolbar
Support.com Toolbar Updater
TelevisionFanatic toolbar
voguecash browser enhancer

Those listed above are just the ones I could easily identify, there are many, many others that I could not identify but they are running. Some of those above …

tinkerdink2005, this thread is over 5 years old. Much of what was done or recommended here may no longer apply. You need to begin your own thread and follow the steps given in our Read Me First sticky and somebody will be happy to assist you.

http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

What is it that you are classifying as junk files? If you mean items in the recycle bin, just empty it.
Run Disk clean up which also removes temp files and that type of thing. But we need to know what you mean when you say junk files. If you mean programs you no longer use then those would need to be actually Uninstalled using Add/Remove.

Downloading of SpyBot Search and Destroy would not cause this problem unless you did not get the real program. Where did you get the program?
The only download sites for this program are those listed on it's website:

http://www.safer-networking.org/en/mirrors/index.html

You need to follow the steps given here:
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

You obviously are posting from another computer since you say you cannot access the internet with the affected computer so use this computer to download the programs, put them onto a flash drive and use that to put the programs onto the affected computer, then run the programs and post back with the logs.

Always happy to help!

MBA-M Free version is a scanner/remover only, doesn't run in the back ground so it would have no affect whatsoever.It is just another good and very effective way of keeping the computer clean. Update it and do a scan with it at least once a week. Always update before each and every scan.

Happy to help. Hope things are working well for you. Thanks also for identifying those start up which were unknown to my.
PhilliePhan gave me that avatar years ago at another forum and I like it also so I "carry it with me":)

I would suggest you begin from scratch, however, previous advice was reformat, present advice would be no different. HiJackThis is really no longer used that much and offers little if any information that can determine infection. The Read Me first sticky is what we would work from.
Yes, a recovery disk will wipe the drive and bring the computer back to it's factory install condition. After 18 months and having no clean up done of the computer then that would be my recommendation. however if you wish to start a new thread of course this is your option, but those tools in the Read me first sticky would be required, that is the only way we can get the information needed to proceed. If one tool doesn't work, go on to the next. DDS scanner, both logs are two of the key things that must be done.Without those we have no information whatsoever.
But after 18 months without doing anything my advice is a clean install. It would likely take you only a few hours to do so. You have waited 18 months to even think about returning so I am certain a clean up may very well be totally impossible too much time has passed to even half way believe that this computer can be cleaned to the users satisfaction.

You are aware that this thread is nearly 18 months old I presume. We have no idea what project or audits you are talking about here, or what tutorial you are talking about either.No one offered to post a tutorial. We recommended reformatting the machine, which would likely remove all malware because the drive would be wiped clean.

Did you turn off usb auto play as directed?
Please follow all the steps given in our Read Me First sticky and post back with all the requested logs. We really aren't able to offer much assistance until we can see the logs. Please run the tools and post back with copy/pastes of those logs

http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Really your log doesn't look bad. You have some definitely unnecessary auto starting programs that can consume unnecessary resources, all of these can be run manually when needed and that's my recommendation. A good program to control auto starts is the CodeStuff Starter
http://www.snapfiles.com/get/starter.html Download, install. Open it.
It is pretty straight forward. Three tabs, Startups this shows auto starting programs, Processes, pretty much the same as Task Manager, maybe a bit more in depth, and Services, Same as Windows Services. This one program gives you everything in one package.
Choose the Startups Tab and Choose the All Sections at the top. This will show you everything listed that can appear as an auto starting program on the computer. The ones with the check marks next to the are the ones that ARE auto starting every time you start the computer, some will start up when the computer starts and then, maybe turn off, some will continue to run all the time in the background.Of course some of those you do want to auto start and do want to run all the time, your Comodo for instance. But there are others that are not needed with to auto start or run all the time. The ones that startup and then stop, slow your start up time, the others slow startup time and consume resources. Here is a list of those that you can remove the check marks from the box next to the name, they definitely …

What operating system do you have? You need to disable the auto play of the usb drives so that when you plug it in it won't automatically run. Sounds to me like there is possibly an infected file on the usb drive. Have you run a scan of the usb drive with your av program AND MBA-M?

See here to turn off Auto Play for whatever operating system you have. Also many, if not most AV programs can be configured to stop auto play when the devices are plugged in. This is done for your safety so that it stops the drive from auto playing and passing an infected file onto the computer. This won't stop the drive from being used, it will just have to be used manually.
http://support.microsoft.com/kb/967715

Until I can see current full scan logs, done today with the fully updated programs I cannot say for sure that the laptop is clean.
One of the problems with the scan you did with MBA-M on the 30th of December is that it was done in Safe Mode.
Unless it is absolutely 100% impossible to get MBA-M to run in normal mode then safe mode can be used as a last resort, however,even in situations like that there is a small file that can be run to very often stop the running infection processes so that MBA-M can then immediately be updated and run a Full Scan in normal mode.
MBA-M does not scan all files in Safe Mode, even with a Full Scan, so there were some files that were not scanned in that Safe Mode scan.
Normal mode should generally always be used for all scans, unless it is impossible to do so.
While those two findings on that safe mode scans were "technically" not trojans they were downloaders, meaning they bring in other things.
While your Comodo Internet Security and SuperAntiSpyware scans have found nothing, that is not a 100% assurance that there is not something else on the computer, all three programs, Comodo, SAS and MBA-M look for different types of infections, two can be clean but a third may find something and if you have not updated MBA-M and run another Full Scan in Normal mode since that …

Sorry HeidiGiller, We seemed to have overlooked your request for assistance. If you are still having difficulty I will be happy to assist. I have a suggestion, which I hope will simplify things a bit, work on one computer at a time. I would suggest beginning with the desktop, leaving the laptop powered completely off and disconnected from the home network. Get the desktop 100% clean and then begin with the laptop. To clean computers of malware/infection it is really most helpful if you have an additional clean computer to work through in order to be able to move cleaning tools back and forth from the clean computer to the infected computer while keeping the infected computer off line until it gets to the point where it can more easily go back online to finish the clean up.

One more thing, HiJackThis is rarely used today, it gives such a small picture of what may be going on that very often a log can look clean even when a very serious infection is at work on the computer.
Today the scanner tool most used, especially on computers running Vista and Windows 7 is the DDS scanner which gives a much more in depth picture.It is also used most of the time today on XP computers too.

If you still want assitance, begin with the desktop and follow the steps given in our Read Me First Sticky
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Use all the tools and post back …

No problem between SpywareBlaster and Avira, I also use it and have for many years along with Avira.

This "concern" comes from the new possible compatibility Caution that shows before new version of Avira is installed. This is just a general caution and not an ORDER to uninstall any of the programs mentioned in the warning prior to install the install file scans the computer for any programs installed that MAY cause a problem, it does not say it will cause a problem. It is just an Alert of POSSIBLE conflicts and you do not need to uninstall these software programs mentioned during the install. It is only there to make the user aware of the possibility.

It truly only applies to programs that also RUN real time protection...this is where the problem "may" come in, though not always either. This includes Resident SDHelper and Resident TeaTimer, Malwarebytes' Anti-Malware Paid version, which has realtime protection, SUPERAntispyware Paid which also has realtime protection.

And one more. You will receive this large pop up when one of the updates occurs.It is just the "price" you pay for using the Free version. Just click the "x" in the right corner to close it out.
There is one update built into the program, automatically schedule to occur around the time of your original install. The one you schedule will be one additional update for the day. I suggest that you make it 10 to 12 hours different from the time of the built in one. This way you are assured you have all the daily updates.

Here are the rest;

Here are print screens to show you how to set up Avira correctly, they are pretty self explanatory, any questions don't hesitate to ask.
this will take me two replies to get all the print screens on here.

yay! i turned windows defender off and ran the norton removal tool. i installed avira with no problems and installed comodo firewall too. :)
i kinda got ahead of myself though, is there certain settings i should set avira and comodo to? or should i post something for you guys to make sure my laptop is 100% safe now?

I am going to advise against that Comodo Firewall. It does not work well with Avira.This is noted at Avira also. I would advise you keep Avia, it is one of the top three av programs around but I would Uninstall the Comodo and go with
PC Tools Firewall. It works very well with Avira and is one they recommend to use with their program.
Uninstall Comodo.
Then install PC Tools Firewall from here:

http://majorgeeks.com/PC_Tools_Firewall_Plus_d5470.html

Also add, if you have not yet, SpywareBlaster. Truly a MUST HAVE for all computers. It blocks spyware, adware, browser hijackers, and dialers also will
Prevent the installation of ActiveX-based spyware and other potentially unwanted programs.
Block spying / tracking via cookies.
Restrict the actions of potentially unwanted or dangerous web sites.
It is FREE and it does NOT run in the background.
Download, Install, Update, Enable all protection and close the program. Check manually for updates every couple weeks. If there is an update available it will download and when it is finished be sure to Enable all protection again and close …

I am having PP take a look at this, he gave me the script to give to you. You will just have to wait until he can respond, sorry.

Try this:

copy and paste this to notepad:

@ECHO OFF

net stop winmgmt /y
cd /d %windir%\system32\wbem
if exist repository ren repository repository.bad
net start winmgmt

save it to desktop as Fix.bat and then close all windows and run it.
REBOOT and see if problem remains.

It has to be on the computer, it cannot be uninstalled, it is part of the Windows 7 System, it can only be turned off,

Try this:
To enable the viewing of hidden and protected system files in Windows 7 please follow these steps:

Close all programs so that you are at your desktop.

Click on the Start button. This is the small round button () in the lower left corner of your screen that has a Windows flag on it.

Click on the Control Panel menu option.
Now click on the Show hidden files and folders option as shown by the red arrow in Figure 2 above.

Under the Hidden files and folders section select the radio button labeled Show hidden files, folders, and drives.

Remove the checkmark from the checkbox labeled Hide extensions for known file types.

Remove the checkmark from the checkbox labeled Hide protected operating system files (Recommended).

it's not listed there either..... :(

Positive...It is in the "W"'s See my attached.

Think we will have to have somebody else take a look here. Obviously more damage than we thought.

Notice I said if not in your programs folder. then go to Services.
Go to Start and in the search box type services.msc
Now when that opens the Windows Services are all in alphabetical order so scroll down and look for Windows Defender. I guarantee it IS listed there. Then turn it off.

Are you certain you entered the script correctly? one of those still remains, and Windows Defender was enabled. It must be turned off.

Open Windows Defender by clicking the Start button Picture of the Start button, clicking All Programs, and then clicking Windows Defender.

Click Tools, and then click Options.

Under Administrator options, select or clear the Use Windows Defender check box, and then click Save. Administrator permission required If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Also, go into Administrative Tools, Services and make sure that Windows Defender is Disabled. Double click the entry to open the properties. If it shows as running Stop it. Then change the startup type to Disabled. Then reboot.

the laptop restarted itself before combofix created the logs, is that normal?

Yes, it can do that.

Now do the following:
Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above SecCenter::

SecCenter::
{63DF5164-9100-186D-2187-8DC619EFD8BF}
{5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
{D8BEB080-B73A-17E3-1B37-B6B462689202}

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe which still should be on the desktop.
This will start ComboFix again. Ignore any warnings about Norton. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Ok, let's do this again:
Please download ComboFix by sUBs from

http://www.bleepingcomputer.com/download/anti-virus/combofix

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop
• Physically disconnect from the internet.
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When ComboFix has finished running, you will see a screen stating that it is preparing the log report
• This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
• Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting …

Well your DDS log clearly shows Norton as installed though disabled but it also shows Windows Defender as Enabled. This might be the cause of the problem with removing Norton. Windows Defender interferes with pretty much anything tried by any other security program. Turn it off and leave it off.

AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

Turn off that Windows Defender and try running that Norton Removal tool once more and then run DDS once more and see if Norton still shows.