Posts by jholland1964 - Page 15

Wow - that's bizarre....

But, hey, I'm not going to question it! :) Just take it and mutter a quick thank you to the computer gods and go about my business!

Honestly speaking, experimenting with different browsers' online install was way down on my list of things to try from the beginning.
And, the fact that other versions installed with no problem really threw me for a loop.

-- I still doubt it's a Firefox "issue" - otherwise there'd be a lot of other documented instances. Could be something on your compy interacting with Firefox in a weird way...... But, there I go questioning the computer gods. I'll shut up now :)

PP

Oh I don't think it's a Firefox issue either PP. Honestly...think it "may" all go back to that Elluminate and how it is interacting with "whatever" in some way. It of course requires Java to operate and looking at their help site there are several things I see...
One being exactly what you did, try different browsers and if it works in a different browser then use only that browser.

If you have problems on one computer that is in a network then try exactly the same steps on a different computer in the same network, if you can replicate the problem on that computer then the problem is with the network, not the computer and not Java.

You must also configure the Firewall to Elluminate program AND Java Web Start, …

4.0 It seems faster. I am not loving the tabs; it's done like Opera, not my favorite, but hey, java works. I am however, back to having to turn off Comodo to load my lecture from elluminate then turn it back on after it's loaded. Otherwise java gives me an error. I can't figure out how to make it allow me to use it without having to do so. :-/

I have not yet installed Firefox 4 but here is a "tweaking" link that several people I know have used.

How to Make a Firefox 3 Theme for Firefox 4

>>>I am chastised and hanging my head in shame.

Hey, not really your fault and no need to be ashammed, happens to people all the time. I agree totally with what you say here...
>>>It makes me curious why the sites with the good stuff have the bad stuff so prominently at the top...It happens a lot to people. One way to avoid that is use AdBlock on the browser, then those ads like that, and that is what those things are, ads. Then they don't even show.
Now we go forward;
We wouldn't recommend something that would not be compatible with your system so no worries there, but Combofix is a one time only tool, it isn't something you keep on the system.
We will remove that shortly.

The Recovery Console offered by combofix is really optional and not required.
Recovery Console and system restore are not the same thing. If a Windows XP-based computer does not start correctly or if it does not start at all, you may be able to use the Windows Recovery Console to help you recover the system software. It really is very limited though.

System Restore is entirely different. System Restore actually operates only on a very few system files and settings. System Restore backs up your registry. System Restore does not backup your data. If you delete or damage a file, System Restore will not recover it.
System Restore will NOT uninstall a …

Not a problem. I am going to close this one since you have created a new one in eCommerce

Well, the Registry Reviver is most definitely NOT a good program, in fact it is considered Rogue Software. You said it removed some files, it didn't happen to produce a log or do a backup did it?
At least you ran combofix AFTER installing it and not before, but it put itself into the registry when it installed so we're going to have to get rid of it also.

Go to Add/Remove and Uninstall it immediately.

Also I have another question, in the Combofix log Avanquest AntiVirus shows as being installed yesterday.

Why? You all ready had Avira, which is one of the top av programs available today why did you install another antivirus program and one which certainly is much lower ranked? While Avira, or most anti-virus programs, do not stop a rootkit, Avira is one, if configured correctly will at least FIND a rootkit. Most rootkits do require special tools for removal, anti-virus programs usually don't remove them but Avira would certainly scan for them if configured to do so and would then give notification if one was found. I honestly don't know much about Avanquest except I haven't seen it on the lists of Top Ten av programs and I don't believe it is free but a paid program only. The only listings I have found say Free to try, meaning this is temporarily free and after a certain amount of time the program will expire and cease to work unless it is …

So, I updated to the newest version of firefox today and java is now updated and working. So weird right? Why wouldn't it work in any other browser if it was a firefox issue? I always update firefox when it tells me to... Wow, :o maybe it won't stop again! fingers crossed

Have been watching this thread with great interest and glad it is working but I have a question, what version of Firefox do you now have?
Go up to Help, About Mozilla Firefox to see for sure. I am just curious.

Hello, well your Avast was working exactly as it was supposed to work and you of course did the right thing in running the scans.
The process noted would not be unusual however, c:\Windows\system32\svchost.exe. Take a look at your task manager and you likely will see multiple instances of it running at any given time. svchost.exe is a Host process for services.
The various services are organized into different groups and each instance of svchost.exe usually helps to run the items in one group. Your av program may have three or four services running at start up, you would see one instance of svchost.exe "in charge" of that group.
Now obviously that one cited had nothing to do with your avast, I am only using that as an example. Virturally every service that runs in Windows has a svchost.exe associated with it. It is pretty hard to narrow down which one that was since there are usually always multiple instances of that running.

Even though you believe you had not started any applications, there are many programs and services that are set to auto start when you boot the computer, these would not necessarily show to you but they are auto starting when the computer boots up. Avast of course is one of those, you don't have to tell it to start, it does so automatically. But it is likely one of those services that triggered this Avast warning. Since this had never happened before then …

Hi Cathy, since this forum is solely for the removal of infections from machines your post might receive more information in the Internet Marketing forum

http://www.daniweb.com/internet-marketing/25

Cathy, that only removed the rootkit, there likely are more infected files on there. Even though MBA-M had removed some the rootkit would likely have brought in more that it would not allow MBA-M to clean at that time or others which could not be found by MBA-M

Now do the following:
Please download ComboFix by sUBs from
http://www.bleepingcomputer.com/download/anti-virus/combofix

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When ComboFix has finished running, you will see a screen stating that it is preparing the log report
• This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
• Re-enable all the programs that were disabled during the running of ComboFix..
• Then post back here with that log.
Note:
Do …

Hi and welcome to daniweb. You have a rootkit infection. You need to do the following:
Please read carefully and follow these steps.

* Download TDSSKiller and save it to your Desktop.
http://support.kaspersky.com/downloads/utils/tdsskiller.zip
* Extract its contents to your desktop.
* Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

* If an infected file is detected, the default action will be Cure, click on Continue.

* If a suspicious file is detected, the default action will be Skip, click on Continue.

* It may ask you to reboot the computer to complete the process. Click on Reboot Now.

* If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
* If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Maybe, but I doubt it. I think what happened is when you allowed the free trial to expire you probably lost the ability to uninstall. You might try downloading the same program again, install it and then immediately uninstall it.
Part of the problem is the McAfee on there too.
You got the infection, likely anyway, because you had two av programs running, even if you couldn't see both, and when you do that they fight against each other and let infection in.

Here is the CNET link for the AVG Internet Security 2011 Free.
http://download.cnet.com/AVG-Internet-Security-2011/3000-2239_4-10710160.html

You will have to turn each and every part of the McAfee program or completely uninstall it before doing anything with the AVG.
Uninstall McAfee via Add/Remove and then when it completes use the Revo program to look for and remove any remainders

After you get those off then you need to do the DDS scanner again.

Just noticed what you said earlier, AVG at this point but am also concerned I have a spoofed version of it now...even though I downloaded it off of CNET.

The logs clearly show AVG Internet Security 2011, did you pay for this? The AVG Internet Security 2011 offered at CNET is a Free to TRY for 30 days version after 30 days it must be paid for, Price: Free to try (30-day trial); $43.99 to buy
The Price: Free to try (30-day trial); $43.99 to buy
AVG Internet Security 2011 program includes the firewall, the AVG Free antivirus program does not. They don't offer a continuing free version of the Internet Security suite, only the "free to try".

When did you put this McAfee program on there? Can you uninstall it also? Are you willing to do that? Did you pay for it or is it also a trial paid security suite?
Neither AVG nor McAfee have very high marks today. There are many others which do a much better job, both free and paid.

You said earlier that YOU found AVG files, The AVG is still on the Root of my C: drive...there is a folder $AVG and under that $Vault filed with a bunch of .fil files.
Did you use the Search function of Revo to see if it could find those?
That program does show as definitely running in every log you have posted, there are other things I could have you try but the av and firewalls would have to be turned off and we can't take that chance.

The AVG is still on the Root of my C: drive...there is a folder $AVG and under that $Vault filed with a bunch of .fil files.

You have to get that off of there as it most definitely is still running. Try using this program to remove the AVG stuff:
Revo Uninstaller, Free version
http://www.revouninstaller.com/revo_uninstaller_free_download.html

That isn't the full log, there should be more showing after
==================== Find3M ====================

and before

============= FINISH: 11:41:16.96 ===============

Open the attach.txt and copy/paste the log here.We don't want the file attached at all, we want it copy/pasted

The poster stated that he will get an external hard drive from his friend to backup his data, i am recommending him good external hard drive that will crash less.

That may be, however, he is going to borrow one from his friend which he plainly stated so he does not need to purchase one or maybe cannot afford at this time to purchase one. He does have access to one so telling him to purchase one is not necessary. You have all ready been told not to post in this forum, yet you continue to do so. I am telling you again, do not post in this forum.

please download this file: xp_scr_fix.

Unpack the file onto your desktop and double-click it. You will be asked if you wish to merge the file with you registry, say yes.

You should hopefully then be able to run DDS.scr.

Do a manual search on the computer for AVG just to be sure.
Try again to run the DDS Scanner. If it doesn't run in normal mode and produce a proper log, try it in Safe Mode. Need to see both logs.

Well AVG is most definitely on the machine, it shows very clearly in the log.
AV: AVG Internet Security 2011 *Enabled/Updated*
FW: AVG Firewall *Enabled* {8decf618-9569-4340-b34a-d78d28969b66}
These two, along with McAfee AV program and McAfee firewall means you are running TWO of each. One reason for major problems on any machine.
First of all you must get that AVG stuff off the machine.
Go to this link and download the uninstaller to remove it.

http://www.avg.com/us-en/download-tools

Honestly I also think McAfee is also a huge part of your problem too. Since this is a work computer are you allowed to remove it?

Another big problem is the fact that you are continuing to use the computer instead of getting this cleaned up. I don't know that you will be able to get it cleaned up unless you can actually stick with it.

Ok, thanks jholland for correcting my mistakes, but i did not say he must reformat now. About the top antivirus you post, i have did a check and you were correct. Here is the link to prove

http://antivirus.about.com/od/freeantivirussoftware/tp/freeantivirus.htm

Thank you for the link but I would not have posted the information if it was not accurate information in the first place.
You advised the poster to >>>Backup your data on a hard disk then later erase and reinstall your computer. Do a virus scan first
to me this meant you were telling him to scan the computer and then reformat the drive, a reformat is not necessary to increase drive space, all he needs to do is move some of whatever it is he has on there off the drives. If you were advising a reformat due to the infection then this is not necessary at this time either. AND if the drive was going to be reformatted then installing a new anti-virus program and doing a scan would not be necessary because a reformat will wipe everything off the drive anyway.

Please, I advise you again, post information that you are certain IS correct information or don't post at all.

Try installing other anti virus program such as Kaspersky Internet Security 2011, Norton Internet Security or VIPRE Antivirus. The last one was my friend recommended to me, try it out. Do a full scan and tell me the log. As jholland has say, there might be less disk space. Backup your data on a hard disk then later erase and reinstall your computer. Do a virus scan first

There is no need to reformat the computer at this time. The poster is using a Free antivirus program that should be UNINSTALLED. There are several excellent FREE anti virus programs which can be used and have very high reputations.
Avira Free is one and Avast Free is the other.

I would recommend you use to seagate, buffalo hard disk. It is compatible with a lot of operating systems, try it. Buy a hard disk that have around 500 GB. After you get it go and back up your stuft and reformat your computer. Keep posting updates about the process

The poster is not purchasing a new hard drive, the poster is reformatting the computer, there is no need to purchase a new hard drive.

gunny:
That was a complete scan done with MBA-M.

If there IS a rootkit on the computer then the DDS log may show it Let's wait for all the logs requested in our sticky to be posted and then go from there.

Now to mazekx
Please do not post logs in Quotes, that makes them nearly unreadable. They must be copy/pasted.

Before running any other tools please post both of the logs produced by the DDS Scanner.

There are no instructions which say do not post the DDS logs, we wouldn't ask that you run them if we didn't want to see the logs.

Do not Attach either one, both must be copy/pasted and please don't quote them, post them.

Spelling error larieu. It should be linksy, but anyway i agree with larieu. Your linksy router is able to work as router (not default NAT mode)?

Your spelling is also incorrect roy, the correct spelling is Linksys

If your problem is solved can you please mark the thread as solved. You can do that by going to the bottom. Thanks, i appreciate it.

The poster has not yet returned. Stop asking people to mark threads as solved to boost your solved threads count. That is up to the thread creator himself to decide to do that, since he has not returned we don't know.

If your problem is solved can you please mark the thread as solved. You can do that by going to the bottom. Thanks, i appreciate it.

You need to stop making this request in order to boost your own solved thread count. It is not for you to ask this.

Honestly don't see a lot there, besides the fact that your hard drive space is getting low for the amount of total space you have
C: is FIXED (NTFS) - 110 GiB total, 16.142 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 30.163 GiB free.

. What was the location of the file found by AVG? Do you have a log for that?

That said, AVG just isn't the "top of the line" as far as anti-virus programs go today.
You also have this program on there, Advanced SystemCare 3 which basically is a junk program and should be removed. It causes more damage than it fixes. Uninstall this ASAP.

Keep us posted somjit!

Don't know where you got the idea the log was 600 pages long, it's 13 pages.The KEY part of the log however that is needed is the portion that begins with the wording Start of the scan: and the date. The upper portion of the log just lists the configuration settings and that's not needed except to be sure the program is fully up to date.
The majority of the infected files were found in System Restore. It should be reset and most definitely made smaller.To do this do the following:

Right-click the My Computer icon, and then click Properties.
Click the System Restore tab.
Check "Turn off System Restore" or "Turn off System Restore on all drives"
Also reduce the size of System Restore to no larger than 5%. The default setting is 12% I believe and that is much too large.
Now remove that check mark and System Restore will be turned back on.
There were other infected files found, at least three.
You need to update MBA-M and do a Full Scan with it. Have it Remove Everything found and then Reboot the computer.
Post back here with the log produced.

Who told him to use combofix? Multiple OTHER tools would have to be run before anyone would tell him to run combofix. It should NEVER be run as a matter of course as it is for use only for specific types of infections, Using it without supervision by the helper on a forum who requested is never advised. No helper would request it without first seeing all OTHER logs from all the other tools run.

Also, we do not open attached files here. All logs must be copy/pasted.

The only steps we will begin with are those found in our Read Me Sticky.

Once those steps are completed then post back here with the requested logs and they must be copy/pasted or we will not read them.
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

We offer no advice without first seeing logs from all programs requested in our Read Me sticky. Please complete those and report back with those logs;
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Using a registry cleaner is really unnecessary, it will not speed the machine. If there is infection in the registry then good tools like MBA-M will usually remove those files.
advanced system cleaner has a VERY poor reputation and has been known to actually damage machines.
IF something must be done to the registry you need to know exactly what you are doing, make a back up BEFORE doing anything and do it manually.

There are no updates available anymnore for Outlook Express so that makes it rather difficult. I will do some checking and see what I can come up with, you might also try Thunderbird, an email program that is similar to Outlook Express from Mozilla, the creators of the Firefox browser.

http://www.mozillamessaging.com/en-US/thunderbird/

I have sent an SOS to gerbil, crunchie and PP. Hopefully one of them will look in here soon and maybe give us an answer.

Hi PP
I will, of course, follow your recommendations. When you say 'post the logs' what do you mean ?
Regards
Richard

Follow the instructions on the link PP gave you. The program will scan, show you what, if anything is found, you choose remove all if anything is found, then you reboot. Open the program again, go to the Logs tab, choose the bottom log, open, Copy the log and paste it back here.

so i know something more than an industrious poster at daniweb?? if this is true.. this just made my day!! lol :D ( just fooling around sir, hope u dont mind:) )

Hey I don't mind! I don't pretend to know anything like that! Hey I barely know enough to post right here! I depend on the experts like gerbil, crunchie and PP when I finally "hit the wall". :D
I'm not a sir by the way, my name is Judy. :)

for(i=0;i<100;i++)
{
printf(" THANK YOU!! :) ");
}

hope i got the code right.. been nearly one year since iv written any C at all..

Well I know absolutely nothing about writing any coding or reading it either so...?

u know.. just a few posts back, u said " just a nice guy, very rare!" ..

hey, u people here at daniweb are just that!! :) showing the patience u have showed to me and tons of others here who had asked for help!! u guys are just an awesome bunch of people!! :)

We try, that's the best we can do. We just want to keep everyone and their computers safe and clean.
Hopefully we can get yours cleaned up and safe for the future.

yeah.. got to know that AFTER the insatll was finished!! i knew then n there it wasnt a very smart thing on my part to just CASUALLY try something out just coz i was hearing abt it. especially when u know its risky stuff!

im finding it the hard way... though it could have been harder.. if u guys werent there, n if i had continued with my blissful ignorance of the mess iv gotten myself into!

i am gonna spread that message... maybe ill help out a few ignorant ones like me..

Good idea! Just tell others what you are going through right now. For the moment anyway, until gerbil can weigh in here, anything on your computer is at risk because of the possibility that you may have to resort to a reformat. I sincerely hope it will not come to that. I don't want to risk something here that may cause more damage so that is why I want him to take a look and advise before we go any farther.

please dont leave me because my original post was abt something else than whats happening now... i hope that u guys know that im hopeless without these instructions ur giving me :( so please dont leave !!

Never said we were leaving, I was just giving you this caution that this "could" be your only option and would likely involve all drives.

One thing you can and should do is go into all the drives and totally delete anything you have downloaded using any P2P program, you have no way of knowing which of these may be infected so you should get rid of all of them. The same would go for anything on a flash drive from one of these programs, and possibly something like an iPod. While an iPod usually can't get infected it can carry that infected file with the music. If you plug it into another computer it could then infect that computer. Same goes for a CD/DVD you may have burned with these files on them. They can't be infected but can carry the infected file with the music or movie. I have seen this happen. I cleaned two computers last year infected by transferring music from a CD to another computer that contained infected files in the music files. The CD played fine, but because the person downloaded them directly onto their hard drives they downloaded the infected files also.

i knew using a P2P program was dangerous... but i was hearing a lot abt file sharing, and wanted to see what all that was abt. heard that limewire was a popular tool for doing these sort of stuff.. so thought id give it a try ( if i dont like it .. would just uninstall it.. problm solved!! ) .. BAADD DECISION ! :(

How right you are! #1 Limewire is "no longer". It was ordered to stop distributing it's software October 26, 2010 by US Courts. Of course that is here in the US, don't know if that applies world wide. BUT that should be enough to tell you that if a US Court orders it's removal, then don't use it. Limewire is certainly NOT the only P2P program under a "cease and desist" order in the US to stop all business, there have been many.

The Court Order had nothing to do with the infections spread by P2P it was because it is a violation of US copyright law to TAKE copyrighted material. A copyright means the material must be PAID for in order to use it.
However, when using P2P you absolutely, positively have no way of knowing who or where that file came from and much of the time it is via a malware writer. Just common sense should make a person ask, WHY? Why is this unknown person willing to give away something that normally is required to be paid for? Occasionally, …

Your original question concerned installing an av program after a reformat.You now do realize that a reformat in this case, if you decide to go that route, could possibly include all of your drives since there is infection on all drives.

im sry, but i really have no idea what this program is. i dont remember installing anything like this, or using it. even the name sounds fishy...

Here are just two of the many listings for it:
c:\program files\common files\Spigot\
"c:\program files\common files\spigot\search settings\SearchSettings.exe"

Ok, did some more searching and here is what it is:
It runs automatically at start up. It is foistware, installed with something else. That Dealio toolbar for one thing.

One likely source would be something you downloaded using Limewire. So anything you got via that program or any other P2P program you have used would be highly suspicious.

but sality is not showing on the logs anymore.. does that mean sality has been deleted? i would do the sality killer run if i could get that page open.. but its not loading !

But it IS showing on the logs, at least it showed in the MBA-M log that you posted last night, meaning it was still there.
We can't say a computer is clean until all the logs find NOTHING, not just that they cleaned something.

One thing that constantly shows infection is some sort of program called Spigot, what is this program?

We are going to have to wait until gerbil can look at this because he may have something else that you can try, but for now your computer is still very infected and it appears you have been backing up those infections on all other drives so those also have to be cleaned of infections also. That is one of the problems doing backups without scanning them first before doing the backups. I have sent gerbil a message to ask that he take a look. Don't do any more downloading or backing up until he can take a good look at all of this.

Probably, and they likely are still there, especially since you didn't run all the programs requested by gerbil, namely the Salitykiller porgram

I ask this because each and every drive is still showing infection, except D of course. But all the others have infected files on them.
They don't have as many as they had before but they are still there.

When you say all those sites won't load, what happens when you try? Do you get an error message or something?

What do you have on all these additional drives?

do you have access to another computer?

When you say these sites won't load, what exactly happens?

Just noticed that you did not follow this portion of gerbils instructions:

download and run Salitykiller.zip and then Sality Regkeys.zip as per instructions here: http://support.kaspersky.com/viruses/solutions?qid=208279889
-turn System Restore off for all drives, then turn it on again and make a Restore Point.

I will wait for the logs. Hopefully all will be well and then we can proceed with setting this up more safely in hopes you can avoid all this in the future.

You still cannot get online? When was the last time you tried? How do you normally connect?