Posts by jholland1964

Ok now you need to Uninstall Combofix. Follow THESE instructions EXACTLY which are slightly different from the last ones I gave you:
Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

Give me a new HiJackThis Scan

Yes, turn on Windows Firewall

If you find that Avast won't allow you to install without being online then of course stop the install and follow the steps for going back online. Then download from the link and install.

Pardon me while I pick myself off the floor!!!!!!!!!!!! Ok, make sure that Windows Defender is OFF and Disabled in the Services.

Download Avast from here to the flash drive
http://download.cnet.com/Avast-Free-Antivirus/3000-2239_4-10019223.html?part=dl-85737&subj=dl&tag=button

put it onto the affected computer. See if you can install it. Of course it won't update. Then turn off the affected computer, plug the ethernet cord back in, wait about two minutes and then power up the computer. Open Avast and update it.

Now here is a page where you can download a .zip file for with pictures for the correct settings you need to use with Avast. Download and open it so you can see the pictures on correct settings.

http://www.mediafire.com/?qfjnl0n4q46kot5

After that update MBA-M again and run a new scan with the updated database. Come back with that log and hopefully you won't need to wear your new boots.:icon_lol:

Never mind, try this removal tool

http://tinyurl.com/ylsyx24

Put it on the flash drive, move it to the infected computer, run the tool and reboot.

Tell you what, did you get an install disk from AT&T when you hooked up with them?

Unfortunately, Windows Defender isn't easy to remove. Personally...I don't like it and never recommend it's use. You can turn it off and keep it off however by going to Services and stopping it there and then change it's start up type to Disabled. Then it "shouldn't" restart. I said should because as you and I have found out this may not be the case.

I would like you to manually update MBA-M by downloading the manual update file to the flash drive, take it to the computer and install the updates from the flash drive. Then do a full scan with MBA-M and of course have it remove everything found, REBOOT the computer with your newly purchased spam boots :icon_lol:, sorry, couldn't resist,
Ahem...sericously, reboot the computer and come back here with the new log.

Here's the link for the manual update for MBA-M. It ususally is slightly behind the regular downloaded updates but hopefully an update with a higher database than you have.
http://malwarebytes.gt500.org/

The last one you showed was 5173 and as of just now the latest one is 5194. Hopefully you will get something in between. If it is older than the one you have, don't use it.

I see or saw that you have Revo Uninstaller on the computer. Use it to look for and remove that AT&T stuff and also have it look for Authentium and RPS. Have it remove all of those it finds.

Wow, I didn't know that those "boots" that are being advertised from Lucyye would help get this computer fixed ?
:D:icon_lol:
you and I will be the only two who know what you are talking about because I deleted that spam post...but your comment, Tumbleweedracef, is hilarious! Glad to see that even with all this you still have a sense of humor.
Maybe those are what is really meant when somebody tells you to "reboot" the computer:icon_lol:

Have you rebooted the computer since the run and why do you want to go into the Control Panel?

Did you follow Crunchie's instructions exactly?
STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
This WOULD include Windows Defender.

Did you drag the script onto the top of Combofix?

I am sure that Crunchie is going to take a look at this log to make sure all was done as it was supposed to, but I have a question, earlier you said this;
I have tried to get completely rid of the AT&T Internet Security so that I could use Avast.
yet it clearly shows in both Combofix logs
AV: AT&T Internet Security Suite AT&T Anti-Virus *On-access scanning disabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
FW: AT&T Internet Security Suite AT&T Firewall *disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}
SP: AT&T Internet Security Suite AT&T Anti-Spyware *disabled* (Updated) {307352C6-1CBD-11DB-8AF6-B622A1EF5492}
but it DOES NOT show in your Uninstall list. Exactly HOW did you try to "get rid" of the AT&T Security Suite because it obviously is not gone.
Also showing in the Combofix logs is
Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} but it shows nowhere in any other log or list. Where is it? Did you know that you had it on the system?

Hi Ben, welcome to daniweb. Please bear in mind that the thread you noted is nearly 4 years old, and while your symptoms may be similar it is probably unlikely you have the same one. AVG antispyware is no longer used or even available. If you found it some place it had to have been a very old program and certainly would not have helped your problems. So be thankful you were not able to install it.

We ask that you begin with the steps given on our Read Me sticky first

http://www.daniweb.com/forums/thread134865.html

Post back here with all the logs, and please, do not attach them, copy/paste them into a post. After a look at the logs we can give you the next steps any are needed.

Crunchie, computer has no av program on it because poster was running parts of three av programs. I had him disconnect the computer and uninstall all av programs. He is running these programs via flash drive with the infected computer disconnected from the internet. I told him to do this since he was having so many problems. Told him I would tell him when to connect, which would be after an av program would be installed via the flash drive.

Sorry, missed that Cleaner 2011 earlier. You didn't answer my question, is it the paid or trial version? Also, is your AdAware the paid or Free version?

Your computer is really way out of date. You only have XP SP2 on there and SP3 was released 3 years ago but you don't have it installed. This means it is likely that you have no XP security or critical updates that are very recent meaning your computer is very much at risk, no matter what or how many security programs you are running on there. Unless you install SP 3 your system is not supported anymore. XP SP3 is fully supported until 2014 but support for systems without SP3 installed has expired. This could also cause future problems adding other programs as many today require that XP have SP3 installed to be able to download their programs.
You still have a portion of the Emisoft program running but it is doing nothing but running and that is a-squared Free. It does absolutely nothing as it is no longer a stand alone program. You need to go into Services and stop the service and then change it's startup type to disabled. You also need to do the same for Emsisoft Anti-Malware 5.0
Run HJT again and put check marks next to the following entries:
O2 - BHO: (no name) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - …

Are all problems corrected?

No, you need to wait. I will have somebody else look at this too. Just turn off the computer and keep checking back on the other one. Not sure when somebody else can take a look since it's a holiday but we WILL get back with you ASAP.

Look, I told you all ready that you had too many anti-spy programs running on there. You removed some, I believe, since I no longer see the Spyware Terminator or the Trojan Killer. But now I see you have added another, The Cleaner 2011. Did you purchase this program? If you did not pay for it and are using the trial version then its real time scan is disabled by default and cannot be turned on during its trial period. So it is pointless having this run in the back ground because it does nothing until you pay for it.

Emsisoft Anti-Malware 5.0 - this gets very poor reviews. Here is just one of them from PC Magazine; Program fails to thoroughly remove detected malware. Explicitly identifies valid programs as malware. One-dimensional behavior blocking blocks many valid programs. Emsisoft Anti-Malware 5.0 is great at finding malware; too bad it flopped at removing what it found. It erroneously flagged several valid programs as specific, named malware, and its behavior-based detection kills both good and bad programs.

SpybotSD TeaTimer is still running and as I said before this is absolutely KNOWN to block fixes attempted by other programs. Turn it off and leave it turned off.

Exactly WHAT anti-virus program are you running?

ok got to run and type msconfig and then adialog box will appear click on startup tab and click disable all restart and normally delete d file it wil get deleted and then go to msconfig and enable each process by clicking on each of it((run is present on the dialog box dat appears when you click on start)):)

This thread is six years old. That said, sharvin this is BAD advice. The computer in question obviously had malware or infections on it. We have no way of knowing since the original poster never returned. But doing what you recommended likely would not have made a difference. Plus telling the poster to turn off all autostarts without knowing what they are is also bad advice. Having somebody do this could very well disable their anti virus program, leaving them open to more infections.
We are always happy to have those who would like to offer assistance but our rules must be followed.
Rule 1. Use tools recommended in our Read me stickly
http://www.daniweb.com/forums/thread134865.html

That happens to a lot of people the first time they use it. Once they get the hang of it, no problem. This tool is top of the line, be sure to keep it and use it for Quick Scan at least once a week, be sure to update first. If Quick Scan finds something then of course remove, reboot, update again and run the full scan. Quick Scan doesn't scan as deeply as the normal scan so this is why a second run with full scan is recommended if something is found.

After these scans complete then also do a system scan with HiJackThis version 2.0.4 and save the log. Post that log here too.

http://free.antivirus.com/hijackthis/

Actually database wasn't that far off. But running again is a good idea because...you didn't have the program do any cleaning. Look at the log for all items found, -> No action taken.
Be absolutely certain you follow this part of the instructions;
* Be sure that everything is checked, and click Remove Selected if malware is found.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily.The log can be retrieved by opening up MBAM and clicking on the Logs Tab at the top of the program .

Reboot the computer this is VERY important as many infections cannot be fully cleaned by MBA-M until very early in the boot process when the infected files have not had a chance to activate. So you must always click that Remove Selected button and then reboot right then. Otherwise the tool won't be able to do it's full removal.

AFTER the computer reboots then open MBA-M again and go to the Logs Tab. It would be the bottom one you want, open it up and copy/paste it back here.
Then do the following:

Please Run the ESET Online Scanner

http://www.eset.com/onlinescan/scanner.php?i_agree=14
* You will need to allow an Active X to be installed or you may use Firefox if you have the IE tab add on.
* You will need to temporarily Disable your current Anti-virus program.
* Be sure …

Looks good David. Do another HJT system scan and post the log, ok?
Judy

Good enough! Enjoy your turkey dinner!

Run a full malwarebytes' scan and post the log back here. You also need to run the online scan from ESET

http://www.eset.com/onlinescan/scanner.php?i_agree=14
* You will need to use Internet Explorer to to complete this scan and you will need to allow an Active X to be installed or you may use Firefox if you have the IE tab add on.
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.
Post back here with both logs.
You need to do this because this thing can be hard to remove and we need to be certain it is gone.

Do to lack of activity this thread is being closed. If you need this thread re-opened please contact a moderator.

jholland1964

Are you able to get online with the computer now?

Malware is defintiely NOT the cause of your problem.
Your GMER log shows only XP Service Pack 2 so you have not fully updated your XP so installing Office 2010 is the least of your worries. You need to go to Windows Updates and complete all updates required for XP. If you don't do full updates your XP is no longer supported, if you install Service Pack 3 then your XP is fully supported by Microsoft, meaning you CAN continue to receive all updates, until April 8, 2014.

Office 2010 system requirements state clearly Windows XP (must have SP3) in order to install.

Thanks for the reply. From what I have found the Authentium AntiVirus program is often installed when users install software from their ISP and I have also found that it could be that the RPS Antivirus (and RPS stands for RadialPoint Software) is really Authentium and therefore may be why you couldn't find it anywhere after you removed the Authentium.
So I would say on that let's assume that it is gone. If we find it later we will deal with it. But here is your next step. Read everything VERY carefully, follow each and every step EXACTLY
I want you to run Combofix. You are going to have to download the file to your flash drive and take it to the infected computer. It must be put ON TO the infected computer, it cannot run from the flash drive and you must put in ON the desktop

Please download ComboFix by sUBs from

http://www.bleepingcomputer.com/download/anti-virus/combofix

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts, though you can ignore the part of instructions about creating …

The only place that those programs showed up was in HijackThis so I tried to use that to delete them as you requested.

Which programs exactly?

Does the printer work?

Some HP printers are designed to add a dot 4 port,which is virtual.

A virtual port can not do peer to peer and this is by design.

http://support.microsoft.com/kb/302361

Look, this is totally ridiculous. You now have done two things I didn't request, download another program and install it and run it and also used HiJackthis, incorrectly, to do a fix that I did not tell you to do.

I am telling you right now ONCE, if you keep taking steps that I don't tell you to do then I am out of here. You can go elsewhere for help or take this computer to a shop and pay to have it fixed.
This computer is supposed to be OFFLINE, no programs should be installed on it unless I tell you to do so.

As I try to delete the file " index.dat", it won't let me. There is a warning/popup that keeps saying....
The action can't be completed because the file is open in another program
Close the file and try again.
Leave it alone. It is NOT a virus.

Now did you uninstall combofix as I told you to do?

Ok, disconnect from the internet, unplug the cord in other words and if you connect wirelessly then disconnect the connection.
Turn off ALL protection programs completely. Look in the task manager to make sure none of them are running.
Then following the instructions given by the printer manufacturer try to install your printer.

Did you uninstall ALL software for the printer?

Using a flash drive and another computer, do the following:
These are instructions given on the MBA-M General Help Forum
http://forums.malwarebytes.org/index.php?showtopic=10138
You need to DISCONNECT the affected computer from the internet.
You will need to download required files to the flash drive. Take it to the infected computer and run them.

MBA-M removal utility; http://www.malwarebytes.org/mbam-clean.exe

Download the randomized renamed mbam.exe version from http://malwarebytes.org/mbam-download-exe-random.php
In some cases, it will be needed to rename the random named mbam.exe to explorer.exe
since you will have the computer off line you also won't be able to do the regular update so go here and download the manual update file
http://malwarebytes.gt500.org/

After you have all those files on the flash drive then go to the infected computer and transfer those files and follow steps below.
# Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.
# Restart your computer (very important).
# Download and run this utility. mbam-clean.exe
# It will ask to restart your computer (please allow it to).
# After the computer restarts, Temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware that you brought on the flash drive and update it using the manual update files also from the flash drive.

Next run a Full Scan with MBA-M. Have it remove everything found. Reboot the computer and save the log to the flash drive and post …

Since you cannot run any of the needed utilities you probably are going to have to do most of these using a flash drive to take them to the infected computer and then running the programs offline. Do you have a flash drive?

You forgot the GMER log. Please don't attach it, please copy/paste it. We don't like to open attachments from infected computers.

All those RPS things listed indicate another security program too. Remove those also.
Once you have done all this then I will give you another tool to put on the flash drive and take to the infected computer.

As I try to delete the file " index.dat", it won't let me. There is a warning/popup that keeps saying....
The action can't be completed because the file is open in another program
Close the file and try again.
I don't have anything else open. What should I do ?

Boot to Safe Mode and remove it.

Do a file search on the computer for Authentium AntiVirus SDK - 2 and if you find it remove it. If you don't find it then it is a likely left over listing. Right Click the entry and delete it.

Unplug the printer from the computer. Then Uninstall ALL the software that is on there for the printer.

AFTER you have done all of the above then we will begin again to clean up the computer. You had two anti virus programs on there, a big no-no. This is why I want all of them removed. Once things are clean then I will tell you how to reinstall Avast.
I stress again, LEAVE THE COMPUTER OFFLINE until we are finished and I tell you to plug the cord back in.
Judy

desktop.ini. - This hidden file is placed in every folder to tell the operating system how to display and customize the viewing of that specific folder

Index.dat are files hidden on your computer that contain all of the Web sites that you have ever visited. Every URL, and every Web page is listed there.
Delete them both.
Run CCleaner and make sure it is configured as show in my attachments. You will use the Windows Tab first, click Analyze and then click the Remove button once it lists everything.
Then do the same using the Applications tab.
Then close CCleaner.
Next I want you to Uninstall the following programs.
Authentium AntiVirus SDK - 2
avast! Free Antivirus
ESET Online Scanner v3
Eusing Free Registry Cleaner
RPS Ad Blocker
RPS AntiFraud
RPS AntiSpyware
RPS AntiVirus
RPS App Detector
RPS AsRealtime
RPS Backup
RPS Burn
RPS Diagnostic Utility
RPS Firewall
RPS ParentalControl
RPS Performance Tool
RPS PopupBlocker
RPS Privacy Manager
RPS RpsCore
RPS Security Cleanup
RPS Zip

Those are not really cookies. They are infected files that look like cookies. Empty EVERYTHING out of your cookie file.
Keep this computer OFFLINE until you are told to put it back online. You are going to have to do everything using a flash drive.
Do you have CCLEANER on that computer?

If the computer is connected any of the ways I stated above then it IS online even if you have no programs that you can actually see, like browsers that use the internet open. If you have it set to check for automatic updates for anything then that program is open in the background
Disconnect the computer.

While typing this, I watched cookies just start showing up, even though I'm not on line.

Look, there is NO way you can get cookies on your machine unless the computer IS online with a browser is open.
How are you connected to the internet? If you are connected via broadband, dsl, wireless and have the computer powered up even if you don't have a browser OPEN the computer IS online unless you remove the connection cord if you have broadband/dsl, and with wireless you must manually Disconnect the connection. You CAN get more infections on there without a browser open but you CANNOT get cookies without a browser open to a web page.
You can't be posting here UNLESS you are online. And WHERE are you watching cookies show up? Please tell me how to do this as it makes no sense.

No need for another log. Here are the instructions for UNINSTALLING Combofix, it must be Uninstalled NOT just deleted:

* Click START then RUN
* Now type ComboFix /Uninstall in the runbox and click OK. The space between the combofix and the /uninstall, it must be there.
When shown the disclaimer, Select "2"

Are you still getting these Avast warnings and the additional cookies?

I would like to see an Uninstall list generated by HiJackThis. To get this do the following:
Start HijackThis
Click on the Misc Tools button
Click on the Open Uninstall Manager button.
Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad into a reply

You have some anti-spy programs on there and running, Emisoft Anti-Malware, Trojan Killer 2.0, SpywareTerminator, Spybot, SpywareBlaster and AdAware.
Spybot has TeaTimer enabled and running, turn it off as it interferes with fixes done and is not needed. Uninstall SpywareTerminator, it is not very good, uninstall Trojan Killer, Emisoft Anti-malware is ok I guess.

Also Uninstall MediaBar, it is used with Bearshare, a P2P program and it considered malware.
Run HiJackThis again and put check marks next to the following entries;
O2 - BHO: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\MediaBar\DataMngr\IEBHO.dll
O3 - Toolbar: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'NETWORK SERVICE')
O20 - AppInit_DLLs: C:\PROGRA~1\BEARSH~1\MediaBar\DataMngr\datamngr.dll
O20 - Winlogon Notify: ACNotify - Invalid registry found

After you have placed the check marks then click the Fix Checked button and Exit HJT.
Reboot the computer and run another HJT scan and post the log.
Judy

You need to update MBA-M and run a full scan with it. It IS the tool of choice for trojan removal today. Have it remove everything found and post the log.

Combofix was run back on 9/8/2009. If I remember correctly, it was this site that I worked with when I ran it.

Don't believe so. I went back through all of your previous threads here. The only one with Combofix in 2009 was this one;
http://www.daniweb.com/forums/post781415.html#post781415

and you had run it before your opening post. Crunchie told you at that time, Combofix should not be on your computer unless someone has advised you to use it. He then told you to uninstall it and gave the specific instructions that must be used to do so. If these instructions had been followed then the Combofix would have been removed along with it's quarantine files. It obviously was either not removed, removed incorrectly at that time or it has been used since then because the files found and removed by the ESET scan, with the exception of two, were all Combofix quarantine files.
You also did not post the entire ESET scan log. We need to see the entire log, from top to bottom not just the infected files removed.

Verizon Security pops up

What happened to McAfee? Are you telling me that you have TWO security programs running? That is an absolute No-No
and why in the world are you trying to install a printer when you are in the middle of a clean up?

sorry, I should mention that 'Artemis!117A7F38669A' comes up

I have no idea what you are talking about.

I requested a new scan with MBA-M but instead you are attempting to install a printer. Not sure I can continue with this since you evidently feel installing a printer is more important than completing the clean up. You failed to follow the instructions to disable the McAfee during the Combofix run and now you are installing a printer instead of continuing with the instructions given to get this computer clean.
The only other thing I can suggest since you don't want to continue cleaning is to reformat.
But when you do be sure to only install ONE security suite, not two. Running more than one and having them fight each other makes it that much easier for severe infections to invade a computer. Add to that the use of P2P and you are pretty much guaranteed of major infections which you obviously have on there.

Oh I am happy to help. Can I ask you when you ran Combofix and who told you do do so?