Posts by jholland1964

You have to stop relying on SpyBot. It is a good scanner but otherwise it is more trouble than it is worth.
Give me the list of programs t says are iffy or bad.
I just checked this on mine and it show only two starting programs on my computer, I know this is NOT the case, I know for certain there are several more than two. One it questions is my anti-virus program, which is an excellent program and certainly not questionable.
In you HJT log I saw some not needed.
DDS should most certainly run in Safe Mode, so something is stopping it from running. Delete the one you have and download a new copy and try it again.Do it Safe Mode only, NOT safe mode with networking.

Have things improved?

I really find this odd. So you still cannot use wifi?
Removing that infection should not have damaged the connection.
If you can find a way to go online then do this scan:
ESET Online Scanner

http://www.eset.com/onlinescan/scanner.php?i_agree=14
* You can use Internet Explorer to complete this scan and you will need to allow an Active X to be installed or you may use Firefox
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.

Post back with the log.

Uninstall these two programs.
Uniblue RegistryBooster
Uniblue SystemTweaker
Reboot the computer and then do the following:
Run the ESET Online Scanner

http://www.eset.com/onlinescan/scanner.php?i_agree=14
* You can use Internet Explorer to complete this scan and you will need to allow an Active X to be installed or you may use Firefox
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.

Post back with the ESET Log.

Barry, this thread is 3 and 1/2 years old. You need to begin your own thread

Ok do this, if you have to use a flash drive to get this program, that is fine, if you can fix the WiFi and do it with the computer that is fine too:

Download the TDSSKiller.zip archive and extract it into a folder on the infected (or possibly infected) computer with an archiver (WinZip, for example);

Run the TDSSKiller.exe file;

Wait until the scanning and disinfection completes. A reboot might require after the disinfection has been completed.

Post back with the log.

Fantastic! Do you feel things are running ok now?

Try going into the Device Manager and Uninstall the card, reboot and let the computer find and install it again.

Then we know that the computer can connect and the problem is with wireless only.
Try these steps:
Go to control panel Administrative Tools, Services.
Look for Wireless Zero Configuration on the list in the right pane. The list is alphabetical, so you should be able to locate it maybe third from the bottom.
Double-click it to open it.
Click on the STOP button to stop it (lower left). If it is not highlighted or is grayed out, then the service is stopped. (it should also say that the SERVICE STATUS is stopped).
Look for STARTUP TYPE drop-down menu. Change it from AUTOMATIC to DISABLED. then click on APPLY (lower right).
Then just change it right back from disabled to automatic and click on apply again.
Click on START button (right beside the STOP button) on the same window to start the service.
Close the services local window.

Go to Start and then Control Panel. Network Connections. If you don't see Wireless Network Connections or Local Area Connection after opening Network Connections, kindly look for Network Connections again (it maybe on the lower right).
Right-click on the icon for Wireless Network Connections then left-click on Properties.
You should have several tabs. Click on Wireless Network Connections tab (near the top of the window).
Make sure you have a checkmark on where it says, "Use windows to configure your wireless connections..." or something like that.

Make sure …

If you have spybot fix that then anything the av program tries to fix will be over ridden. Leave it alone

That info from SpyBot likely means that SpyBot TeaTimer is stopping changes being made to the registry by the antivirus program...it is not letting it fix what it should fix.It will also stop other fixes attempted also. Turn off TeaTimer and leave it off.
* Run Spybot-S&D in Advanced Mode
* If it is not already set to do this, go to the Mode menu
select
Advanced Mode
* On the left hand side, click on Tools
* Then click on the Resident icon in the list
* Uncheck
Resident TeaTimer
and OK any prompts.
* Restart your computer
Have you attempted any of these scans in Safe Mode?

You said you cleaned this infection off the computer...how did you do this? What tools did you use?
I need to see the logs from the tools you used then, not the logs from today.

Can you connect the laptop directly to the internet using modem cable?

Thanks you for posting the Attach.txt log, I have removed your zip attachment.
Have you tried a full reset of the modem and router according to instructions given in link below?

http://www.ehow.com/how_2178176_highspeed-internet-modem-wireless-router.html

Please remove that zip file, and copy/paste the log here. We don't open attachments. Instructions are very clear in the Read Me Sticky,

http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Copy&Paste both the DDS.txt and the DDS Attach.txt into your post for assistance.

Instructions for TDSSKiller are very clear:
Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
There is no mention of "from a unique folder or with a new name"...where did you get those instructions?

please download this file: xp_scr_fix.

Unpack the file onto your desktop and double-click it. You will be asked if you wish to merge the file with you registry, say yes.

You should then be able to run DDS.scr.

It appears that you had or still have the Koobface infection on the computer.
Please follow these instructions given on our Read Me First sticky and post back with copy/pastes of ALL logs and then we can give you further instructions

http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Not sure what exactly you mean when you say
"DDS only runs as garbage in notepad"
Do you mean the log won't show correctly? Or the program itself won't run correctly?

You have SpyBot TeaTimer running, it will stop any fixes attempted, please turn it off and leave it off following these instructions:

* Run Spybot-S&D in Advanced Mode
* If it is not already set to do this, go to the Mode menu
select
Advanced Mode
* On the left hand side, click on Tools
* Then click on the Resident icon in the list
* Uncheck
Resident TeaTimer
and OK any prompts.
* Restart your computer

You also have SUPERAntispyware running all the time, turn it off also.

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

It may ask you to reboot the computer to complete the process. Click on Reboot Now.

If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that …

Glad to hear all is running well. Hope you did update the Java. This is very important, it does help you view websites properly AND keeping it updated also helps with security.I also hope that you did install SpywareBlaster, very important piece of protection every computer should have installed.

Go to Add/Remove and Uninstall HijackThis.
You can just Delete TDSSKiller, RKill and DDS Scanner as those are all executable files and are not installed and are for use only in situations like this. If you would ever need them again, new copies should always be used, hopefully that will never happen again.

KEEP CodeStuff and use it if you feel there is something auto starting that you don't need.
KEEP SUPERAntispware and Malwarebytes and update them every week and do a scan with each, at least once a week. The Malwarebytes' scan can be a Quick scan, not always a full one. If something is found have the program remove it and then reboot and immediately update again and do a full scan. If it's clean then just close the program. Weekly scans with both of those are as important as the weekly scans with your anti-virus program, as you have found. Those two programs look for things that the average anti-virus program doesn't look for or find.

Now, about your McAfee. Obviously it didn't work as it should and you certainly didn't "get your money's worth". Even though your license runs until February I truly …

Your SUPERAntispyware is also out of date. Current versions are:
Core Definitions 8012
Trace Definitions 5824
The number one rule using any security program is UPDATE before each scan, always. It should become routine to do this, without having to think about it.

To not get tracking cookies you need to configure your browser correectly which is to block them.
In IE do the following;
go to Tools, Internet Options, Privacy, Advanced, and put a tick in Accept 1st Party Cookies and one in Block 3rd party cookies. OK your way out.

Also a key program to use that will also help to prevent tracking cookies is the program SpywareBlaster from JavaCool. It is FREE.

http://www.javacoolsoftware.net/downloads/spywareblastersetup45.exe

Download, install, UPDATE and then Enable ALL protection and then close the program. This one does NO scanning, it does NOT run in the background but it BLOCKS spyware, adware, browser hijackers, and dialers. It will
Prevent the installation of ActiveX-based spyware and other potentially unwanted programs.
Block spying / tracking via cookies.
Restrict the actions of potentially unwanted or dangerous web sites.

It absolutely, positively works exactly as it says it does. I would never run a computer without this installed and fully enabled. It does not update daily. It generally has updates every couple weeks and you will have to remember to check manually for updates. If there are any then install them and remember to then …

Bad news...you failed to update MBA-M before the scan. Your database shows as
Database version: 8271
Same database as shown on your original scan done on November 29th. MBA-M has multiple updates DAILY. This is why the very first thing that must be done before each and every scan, even for scans run on the very same day, is to check for updates. The current database is 8295 so your program is out of date.

You need to update it again and run another Full Scan. Have it remove everything found and Reboot.
Post back here with the log.

Did you immediately reboot the computer I hope?

I need to see the TDSKiller log. It will be located on your C drive. It will have a name similar to the example here. I need to see that.
C:\TDSSKiller.2.4.7_23.07.2010_15.31.43_log.txt

I still don't like this. Please do the following,

Please download ComboFix by sUBs from

http://www.bleepingcomputer.com/download/anti-virus/combofix

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop If it is not run from the DESKTOP it will not run correctly.
• Physically disconnect from the internet.
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix. McAfee Anti-Virus and Anti-Spyware and McAfee Firewall
• Double click combofix.exe & follow the prompts.
• When ComboFix has finished running, you will see a screen stating that it is preparing the log report
• This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
• Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is …

Go in and TOTALLY turn off McAfee. This may be the reason that none of these specialized tools are not running. Do you have a disk for McAfee or did you pay for and download it? If so do you have your license code? You may be better off uninstalling it entirely while attempting all of this.

These will show in task manager if it won't shut down. The entire program must be turned off

McSACore.exe
mcagent.exe
mcshield.exe
mfefire.exe
McSvHost.exe

Here is RKill
http://www.bleepingcomputer.com/download/anti-virus/rkill

If need be download all copies.

Yes, get a new copy of TDSKiller and either one is fine.

You are getting the MBA-M error because its RealTime protection is set to auto start with Windows, that can't happen unless you have the paid version

I believe the other error has to do with your Netgear Wireless Adapter. You need to uninstall the software for that and then reinstall using the install disk that came with it.

Try this TDSKiller again, download a new copy. Also run Rkill BEFORE trying to run TDSKiller and see if that works. Of course run as Administrator, that is an absolute must.

When safe mode is requested, unless otherwise directed, you should always use safe mode only not safe mode with networking. Many of these infections automatically start when a connection is present regardless of the boot mode, they need internet connection to bring in more infection and will certainly do so using safe mode with networking because there are no security programs active in safe mode with networking. Internet connection is not required for this to run. Only online scans would require internet connection.

This is from safe mode also? Not safe mode with networking, safe mode only.

Ok, try this zip file:
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

archive and extract it into a folder on the infected (or possibly infected) computer with an archiver (WinZip, for example);

Run the TDSSKiller.exe file;

You are using a 64bit system. You must run TDSKiller as Administrator. To do this you must Right Click and choose Run as Administrator.
Also rename it, did you? Delete it entirely and download a new copy from here:
http://support.kaspersky.com/downloads/utils/tdsskiller.exe

Save it to the desktop. Rename it 123abc.com

Try first to run it in Normal Mode, if it will not run in normal mode then reboot to Safe Mode and try again.

ednick, you need to begin your own thread rather than posting in another person's nearly two year old thread.
Follow the steps given in our Read Me First Sticky
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

then create your own thread, stating all the problems you are having and giving full information about your computer. Post all of the requested logs from the Read Me First sticky and we will be happy to provide assistance.

If System Fix is truly what was on your computer then this infection is known to be bundled with the TDSS rootkit infection.
It would have helped if you had posted the MBA-M log from when this infection was removed so we could be sure.

You should also run the following program and post back with the log.

TDSKiller:
http://www.bleepingcomputer.com/download/anti-virus/tdsskiller
download the EXE file and save it to the desktop. Close all other running programs.
you should rename the TDSKiller by right clicking and choosing Rename and then rename it to iexplore.exe
Once the file is renamed, you should double-click on it to launch it.If you get a security warning about running an unknown program just click Run button to allow TDSSKiller to run. If you did not receive this warning, then TDSSKiller should have started.
TDSSKiller will now scan your computer for the TDSS infection. When the scan has finished it will display a result screen stating whether or not the infection was found on your computer. If the infection was found click on the Continue button and TDSSKiller will attempt to clean the infection. If it does not say Cure, leave it at the default action of Skip and press the Continue button. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.

When it has finished cleaning the infection you will see a report stating …

And the Attach.txt log from DDS? Please copy/paste it also.

So skip step five and go onto the rest. We honestly can't even begin to offer assistance until we see the logs from the other programs.
Though it should have run, it is a Microsoft Tool and the download is from Microsoft and it definitely is not incompatible with Windows 7. But don't worry about it.

Take a look at these links:

http://www.sevenforums.com/drivers/159966-atheros-ar9285-wifi-adapter-not-working.html#post1375161

http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/atheros-ar9285-and-windows-7-not-compatible/e57cf687-a4c3-49fa-bc0b-4d22e110af95

Here also seems to be a different driver, though check yours to be sure. This is the HP website where you likely will have to get the driver.

http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=12454&prodSeriesId=472276&swItem=ob-91782-1&mode=4&idx=1

It sounds to me as if your connection is timing out.
Here is something to check:
In the properties of the network connection (WiFi), click the Advanced tab, then uncheck "Allow the system to turn off this device".

Have you run the Troubleshooter available in the Network and sharing center?

Are all of these computers laptops? Are they all running Windows 7 or do they have different operating systems?

Also read this page from Microsoft.

http://support.microsoft.com/kb/910387

Since this is an HP computer you should also check there for updated drivers for your system. Mainly because as I said the drivers listed in your logs show Vista, not Windows 7. They may very well be the same but you should check on the HP help site to see. Is the computer still under HP warranty, since it is only six months old it may very well be. They have an excellent Chat help line, I have used it many times, not for a computer but for my printer and I would think that their chat help may also be helpful with a computer. My warranty expired for my printer long ago but I have gotten chat help there in the last year and I was not charged for it. You may need some updated drivers and they certainly could help you with that.

http://www8.hp.com/us/en/contact-hp/contact.html

I am very interested in seeing how things go tomorrow too. Keep us posted, …

Have you re-enabled all those 3rd part start up services and drivers or are they still turned off?

You are showing several wireless drivers, and they are for Vista, not Windows 7. Did you personally install these or did they come with the computer?

netr28x;Ralink 802.11n Wireless Driver for Windows Vista;C:\Windows\system32\DRIVERS\netr28x.sys
netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys

Are you using a router? How many other computers are on this network of computers?

Is it possible for you to actually use a hard wired connection to the computer? Temporarily I mean. Plug the internet cable directly into the computer to see if the problems still exist?

This likely means the problem lies with a 3rd party service that is starting or a driver that needs updating.

You said this is a fairly new computer and is running Windows 7, did the computer come with Windows 7 installed or did you do an upgrade to Windows 7?

Use the tools noted here, follow instructions, and post back here with your logs and a clear description of what problems you are having.

http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

We can be fairly certain this is not an infection. Since the computer works fine online in safe mode it is very likely it is a service or driver problem.
Test this out by doing the following:
In Safe Mode, go to Start -> Run -> msconfig
Go to the Startup tab and uncheck everything.
Go to the Services tab and check the box at the bottom labeled "Hide all Microsoft Services"
Then uncheck all the non-MS services.
Click on Ok and reboot into normal mode and go online. Report back here on how things run that way.

How are you connected to the internet by the way?

I just noticed something about your most recent MBA-M scan done on November 25, you did not update the program before running the scan. The database showing is 8211 and on Novemeber 23rd the database was updated to 8222 so yours was out of date on the day you did the scan. The three cardinal rules for using MBA-M are, scan in NORMAL mode if at all possible, if infected files are found have the program remove them and REBOOT so that removal can complete. Of course if nothing is found a reboot is not necessary. Finally, ALWAYS update the program before each and every scan, even when doing multiple scans in the same day. MBA-M releases updates throughout each and every day so you actually can run a scan at noon and then run another and then check for updates an hour later and receive new updates. So please update MBA-M and run another Full Scan in Normal mode. If anything is found be sure to Remove all, REBOOT and post back with the log.

You don't need Windows Defender, leave it turned off. It interferes with other security programs that are much better.

Download and install this program, CodeStuff Starter
http://www.snapfiles.com/get/starter.html

Once it is installed then open it up and choose the Start ups Tab. Remove the check marks from those programs I noted above. Then reboot the computer.

Are you using a wireless connection? If so, have you tried connecting directly to the internet without using a router?

You have some unnecessary auto starts, which then run all the time and do slow the computer. These can all be run manually when needed so you need to stop these:
NortonOnlineBackupReminder
Adobe ARM
Adobe Reader Speed Launcher
HP Software Update
Messenger (Yahoo!)

You also need to update your Java, it is WAY out of date. You need to go to Add/Remove and Uninstall

Java(TM) 6 Update 18

Then go here

http://www.java.com/en/download/manual.jsp

and download the Offline install files and save them to the desktop.
Because you are running a 64bit system you need BOTH the 32bit and 64bit versions.

Close ALL browsers and double click each one to install. Then go back to the download page and click Verify now to be sure the udpates were successful.

Reboot the computer.

Then come back and report how things are going after doing all of the above.

Just be aware, what works for one computer may not work for another. Even if computers "seem" to be identical, all depends on programs installed, internet service, where the different users surf, what they do online...even identical computers in the same house will react differently because of the surfing habits of the different users.So you know that even though problems seem to be identical to yours on somebody else's thread, that is all you know...you know nothing about the person, how he got the infection on his computer, how he connects to the internet, how he receives his email...nothing would be exactly the same so the steps may be totally different.

Are you still having problems going online in normal mode?

One problem I see here right away is your MBA-M scan was done in Safe Mode. That program is configured for scans to be done in NORMAL mode, it does not scan everything in Safe Mode. It should only be run in Safe Mode if it cannot be run at all in Normal mode.

Please update the program and run a new Full Scan in Normal Mode and post back with the log.

Happy to help David.

You made a wise choice Avast, it's very good. You're right, AVG just isn't top of the line.
Your system restore had restore points going back 4 months which is way too long.
System Restore actually operates only on a very few system files and settings. System Restore backs up your registry. System Restore does not backup your data. If you delete or damage a file, System Restore will not recover it. System Restore is meant to restore from very RECENT changes like just day or two, not weeks or months. If you install a new driver for instance and that driver doesn't work correctly then System Restore may be able to restore the computer back to just before the time that driver was installed and revert back to older settings...not weeks back just a short time back. This is why you need to reduce the size.
PC Tools Firewall is a pretty good one. It is free. Just be sure to turn off the Windows Firewall when using it.
http://www.pctools.com/firewall/

I recommend that you also add SpywareBlaster. It truly is a must have tool, also Free. I wouldn't run a computer without it. It prevents the installation of ActiveX-based spyware and other potentially unwanted programs.
also blocks spying / tracking via cookies.Restrict the actions of potentially unwanted or dangerous web sites.Download, install, update and enable all protection and close the program, that's it. It doesn't run in the background. Just manually check …

You are not running an anti-virus program or a firewall, these are absolute musts, especially in today's world.
There are excellent Free ones available I would advise you choose one of these and install.
Avira 2012 is the one I use and am quite pleased with it. It is available for download here:
http://download.cnet.com/Avira-Free-Antivirus/3000-2239_4-10322935.html?part=dl-&subj=dl&tag=button
Click the GREEN Download Now Button to get the executable install package, save it wherever you can easily find it, I chose My Desktop.

Before you begin the install CLOSE all unnecessary programs, browsers, email, etc.
To begin, double click the executable file to start installation.
Before installation the installer will scan your system for other security programs installed. Avira Free AntiVirus 2012 may warn you of POSSIBLE incompatible security software on your system like Emsisoft AntiMalware, some 3rd party Firewalls, especially Zone Alarm. It is just a warning of POSSIBLE conflicts and you do not need to uninstall these software programs. Just install Avira Free AV and everything is OK. I was warned about SpyBot and SpywareBlaster, I IGNORED the warning, I still have the programs and they ARE working fine. The warning is of POSSIBLE conflicts, not absolutes. I say again, you DO NOT have to uninstall the programs you may receive a warning about.
You will need to WATCH the full install as ALL of it REQUIRES User interaction. It will not proceed unless you continue to follow it and read the screens and …

You have made some major errors here. First thing is you are running more than one anti-virus program, or at least parts of three, Microsoft Security Essentials, AVG 2012, and Norton Internet Security. Parts of all three are running on the machine. The number one rule for computer security is ONE antivirus program and ONE firewall, you have three. That alone could have caused your connection problems.

The next thing is you did not follow the instructions given to you twice by Caperjack which was to follow the steps in the Read Me First sticky, that is how you receive help here and are steps everyone must follow. None of the tools run thus far are included in that Read Me sticky.

The 3rd and most dangerous and possibly damaging thing you have done is "assume" that you have the same infection posted by another and then followed the steps given for that posters computer.

The number one clue to you telling you that the steps were not for your problem was the fact that the TDSSKiller found nothing.
The next major problem was you ran manual fixes using OTL that were not meant for your computer. Those are hand written individually by the helper for each specific computer, they are not "blanket" fixes given. So the cut and paste you used from that thread likely did not even apply to your computer and could have done some damage.
You ran an LSP Fix, also …