Posts by jholland1964

Do you really want to clean the computer?

Then follow the steps given by PhilliePhan which INCLUDES, along with other steps, Malwarebytes' Anti-Malware.

Do you really want it clean or not?

The steps you read from Spyware-Experts cannot be trusted, the website itself has a poor reputation.

Do you honestly think that the steps given were posted just for the sake of posting something? We have steps we request because THOSE are the ones that work to begin cleaning a computer.

I need to know if SPYWARE DOCTOR (Spyware-Experts.com) and/or STOPzilla(iS3)are legit software to use to obliterate Personal Shield Pro, completely or as much as possible.
No they are not. If they were they would be in PhilliePhan's sticky.
Please use those programs listed in his sticky and post the logs here.
WE read the logs, you don't. You just need to follow the instructions exactly as given.

Glad you found the problem.

You should test this immediately, NOT later. If the system is not clean then continuing to use it will only place it at risk for additional infection. Rebooting should only take a few moments.

These services are REQUIRED for your internet to work properly.
Please check to be sure that ALL of these services listed here are enabled and NOT disabled.
http://www.blackviper.com/wiki/WLAN_AutoConfig#Additional_Information

There are very FEW Windows Services that should be completely disabled.Please read the information found on this website concerning Services and their proper configuration and then please set yours to the recommended DEFAULT configuration and reboot the computer:
http://www.blackviper.com/2010/12/17/black-vipers-windows-7-service-pack-1-service-configurations/

Note:
Manual ~ Manual mode allows Windows to start a service when needed.

Disabled ~ This setting will stop a service from starting, even if needed. Errors in the Event Viewer will show up complaining of that fact. Some services, while Disabled, will constantly complain. However, this situation is taken care of if placed in Manual. You have a LOT of Event Errors showing and none of these Services should be Disabled but they obviously are disabled or something they are dependent on has been changed to disabled because they were unable to start.

I have disabled services that run with start up only
Did you do this before or after the problem began?

MBA-M should ALWAYS be run in Normal mode unless it will not run at all. It was created to be run in NORMAL mode. It does not work like other scanners and therefore will NOT scan everything in Safe Mode.

Have you gone through and disabled any Windows Services? I am not saying you should, I am asking if you have and have you run any other security programs other than ESET?
Update MBA-M and run a Full Scan with it. Have it remove anything found. You will have to update via Safe Mode BUT, then go offline, reboot in normal mode and run the scan.

Exactly WHEN did this begin? Date I mean. The reason I ask is that it shows in your log on 7/7/2011 you removed the Linksys Wireless-G PCI Adapter.

Now clarify something;
You said this:
When I use my computer without wireless it works perfect.
And then you said:
I have the same trouble when I connect with an ethernet cable

This is rather confusing, if you NOT using wireless or ethernet cable then how can you connect???
I don't understand at all, I am sorry.
Do you mean that as long as you ARE NOT going on the internet the computer works well?
Has the computer ever worked correctly while online?

At least give us a DDS Scan log so we can see what may be going on, right now this is like shooting in the dark. We have no idea what may be running that could be causing this. If it runs fine in safe mode then this leads me to think it has to be either a setting or program that runs in normal mode but of course doesn't run in safe mode.

Download DDS by sUBs and save it to your Desktop.

If your AV has a script blocker, please disable it
• DoubleClick on dds.scr to run the tool

* A command box will open, displaying added information for your reading pleasure while DDS completes its scan.
* Upon completion, a Dialog Box should open instructing you to save and post the TWO resulting logs (DDS.txt & Attach.txt).

• Copy&Paste both the DDS.txt and the DDS Attach.txt into your post for assistance.

It can be run in safe mode if needed to do so.

Keep in mind that clearing viruses/spyware off your computer will not help with freeing your email. I would recommend reformatting your hard drive if possible, and if not ensuring your computer is free of viruses, spyware, and malware. After you can assure that (or access a seperate computer), change the passwords on the email accounts in question, and consider getting new ones.

Hope that works for you!

Reformat is a rather drastic recommendation and generally would not be required unless there were infections which could not be cleaned or there has been severe damage to key system files, neither of which has been indicated here.

If the computer has been fully cleaned and deemed infection free then changing passwords would be the normal recommendation. Removing the extra virus program and firewall is a must.
Since the thread has been marked solved then we must assume the poster has solved his problem.

Where is the TOP half of the Attach.txt file? It is in alphabetical order and yours begins with "O".

Combofix log?

Have you tried Combofix to get rid of the nasty beast? Much recommended.

VERY BAD Advice. Combofix is a removal tool for VERY SPECIFIC infections and should NOT be used EVER unless directed to do so by a helper in a Malware Removal forum and this is NOT a malware removal forum and it most certainly would NOT be recommended in this case. The poster has already damaged key files on the machine by taking incorrect steps.

These are not the customary steps to stop these processes which can be done automatically but if this is the way you want to try it then be my guest.
His AV program shows as running. There are no temp files showing in the running processes or in auto starts. There are standard automated steps used to stop the processes which may be running, though none are seen in the DDS log, remove these infections but you are more than welcome to take over and have him run your steps.

Customary steps are those compiled by Bleepingcomputer.
For Security Shield infection;
According to Bleepingcomputer generally the files will reside in C:\Documents and Settings\<Current User> for Windows 2000/XP, C:\Users\<Current User> for Windows Vista/7, and c:\winnt\profiles\<Current User> for Windows NT.
C:\Documents and Settings\<Current User>\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\<Current User>\AppData\Roaming and not in %windir%\WINDOWS or %windir%\WINDOWS\system32 and even temp folder. Poster has stated the running of ATF cleaner and Spybot. There shouldn't be any temp files remaining.

I may not be helping much here...

You can try to disabling all startup program in msconfig and select 'Load basic devices and drivers only'. It may stop the fake AV from starting up (usually this won't do it)

If fail, then post a new dds log to find out the real culprit that starting up.

It isn't showing in the DDS log as running. Problem is you don't KNOW the name of the running process in order to stop it. Nothing unusual is showing as an auto start.

We also need to see the second log created by the DDS scanner which is labeled Attach.txt. Please copy/paste it.

Also do the following:
Run the ESET Online Scanner

http://www.eset.com/us/online-scanner?i_agree=14

* You can use Internet Explorer to complete this scan and you will need to allow an Active X to be installed or you may use Firefox
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.

An explanation on safe scan vs normal scan with MBA-M;
MBA-M is not like other scanners, it was created to be run in normal mode if at all possible. The only time a scan in Safe Mode is recommended is if it cannot scan at all in normal mode. It does not scan in Safe Mode the same way that other scanners do. When doing regular weekly scanning then Quick Scan in normal mode is fine. If nothing is found then that is good. But IF you know you have infection OR if a regular weekly Quick Scan finds something then immediately the program should be updated and a Full Scan should be run, with a reboot done immediately after clicking the Remove all button, as some removals may need to be completed early in the boot process.

The HJT version you used is years out of date uninstall it. HJT isn't used with Vista and Windows 7 especially as it does not read the operating systems correctly. However, DDS Scanner is now the preferred scanner for XP forward.
We ask that you follow the steps and used the requested tools in our Read Me First Sticky. http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

Please Copy/Paste ALL logs produced back here and we can take a look.

I would advise the replacement of iexplorer with firefox

You should really read everything in the thread. The poster has stated that he does NOT use IE, he uses Firefox. You cannot "replace" IE it is part of the operating system, you don't have to use it but it cannot be removed.

try downloading malwarebytes running a full deep scan and see if that works if not AVGFULLINTERNETSEcURITY has a function that should remove this and maybe try avast!'s PUP scan.

If you had read the full thread you would have seen the poster all ready has run MBA-M on Jun 3rd, 2011

AVG is not one I would recommend. And the poster requested Free Av program, but am not especially crazy about McAfee either. There are much better paid AV programs out there. Avira Premium and Kaspersky currently are ranked the highest by AV Comparatives, an independent tester.

You probably have virus in your computer... Download Malwarebytes Anti-Malware and run a scan to confirm it...
If it does found it, please proceed to instruction link posted by crunchie to completely remove them... He'll help you out till you done

The link provided by Crunchie includes Malwarebytes' Anti-Malware as ONE of the steps. That link is where to begin.

"I guess an up-to-date scan of the install executable is the best option."
Absolutely, plus Avast and MBA-M both offer single file scanning for situations such as this. Scanning one executable should take only a few moments. I would use BOTH programs as each looks for different infections. Better be safe than sorry.
You're very welcome. Happy I could provide some help.

One final question: If I do need to install some application that I don't fully trust, is it safe to use a virtual machine to do a test install? Will malware be able to breach through the VM onto the actual machine?

Once again, thank you greatly for your time and patience.

Quite honestly I don't know, though I would think that if there is a security vulnerability in VM software that is known to an attacker and it is unpatched, it certainly can be exploited like a vulnerability in any other type of software used for security. But like I said, I am not that familiar with VM software. But as devious as these malware writers are today one must assume that really nothing is 100% safe today. We just have to make the best attempt to keep our machines as safe as possible so the question I then would have for you is why would you NEED to or even consider running a application that you don't fully trust? To me that would be like hiring a convicted bank robber to be the guard in a bank just because he promises not to rob any more banks. Would you trust him completely? I doubt it, would you even hire him? I doubt it.

Still no sign of svchost playing up. Dare I say I'm cured?
It looks pretty good.I would say you are very lucky for several reasons, one probably due to the fact that you had just done the reinstall. Not a lot of the usual extras that can easily be infected and make the removals difficult, if not impossible. Probably also not a lot of personal information on there that then puts really a person's whole financial and personal life at risk. Another reason is the fact that you obviously DO or DID P2P sharing. Such a dangerous activity! As I said, probably the easiest way to get an infection. It never ceases to amaze me that persons are more than willing to risk the computer itself, personal and banking information, telephone numbers, email addresses and yes, their ability to be served by their internet provider all for the sake of illegally getting "for free" a 99 cent song or a $50 game or $100 program. I always ask person's who use P2P to illegally obtain these things if they would even seriously consider walking into a restaurant and eating the rest of a partially eaten sandwich left on a table by an unknown customer rather than purchasing their own, untainted and freshly prepared sandwich. The answer of course given by 99.9% of persons asked always say unless they actually were starving to death they would never even consider this. But yet this is what is being done using …

I meant avast. They have some good boasts on their site.

Avast is an excellent antivirus program. Highly recommended and has very high ratings on independent testing also. Wait until you are certain the system is clean however before changing your av program. You don't want to damage a new program. Once it's clean you can remove AVG, which DOESN'T rank very high and go with Avast.

Daemon Tools Lite is fine as far as I can see. Azureus - now called Vuze is a Bittorrent Client and is a P2P program. Absolutely the easiest way to get serious infections, without a doubt.
Anything you may have already downloaded with it would also be very suspect and should also be removed.
Also uninstall Auslogics Registry Cleaner. There is absolutely no reason whatsoever to ever use a registry cleaner.

Uninstall this and leave it off the computer, if you want to keep a clean computer.
You now need to Update MBA-M and run another Full Scan with it. Have it remove everything found and Reboot.
Post back here with the new log.

After that then do the following:
Please run the ESET Online Scanner

http://www.eset.com/onlinescan/scanner.php?i_agree=14

* You can use Internet Explorer to complete this scan and you will need to allow an Active X to be installed or you may use Firefox
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.

Post back with that log also.

I ask that you please don't disable or re-enable standard operating files during the clean up. By doing so you could make the scanners not see what they need to see or see something they need not worry about. So Please leave your security center and that type of thing alone. Also, if files are running, let them run, please do not do any manual stopping or anything else like that unless it is requested, ok?

You ARE aware that the COMODO Internet Security program is a FULL security suite aren't you? It contains both and anti-virus program and a firewall. This means you are running TWO anti-virus programs, which is a no-no. Plus, AVG is certainly not one of my favorites, but that is neither here nor there right now. You do have two anti-virus programs installed there.

You also did not post the Attach.txt log from the DDS Scanner and we DO need to see this. Please copy/paste that here also. Also please just copy/paste the logs directly into the posts, no need to put them into text boxes.

There is a rootkit on the system, which is evident by the findings of the Windows Malicious Software Removal tool and the DDS scanner, both of which have the notation of TDL3/Alureon rootkit.

Now, let's get rid of that rootkit. Please do the following and post back with the log.
Please read carefully and follow these steps.

* Download TDSSKiller and …

And as I said, Adaware is NOT an anti-virus :).

crunchie is 100% correct, no matter what it calls itself, AdAware is NOT an antivirus program.

You're welcome!

I thought that MSE was good because studies have shown more windows users use them. Have no idea what "studies" you are reading but never have seen that anywhere. Just because some program has a lot of users doesn't make it a good program to use...P2P programs for instance, lots of people use them and all of them are putting their computers at risk. Does that make P2P programs good programs? Hardly.

One last question is there a need to install two antivirus products

The ABSOLUTE RULE is ONE anti-virus program and ONE firewall should be installed on a computer NEVER two of either at the same time, ever.
Having two installed at the same time will lessen your protection because they can fight each other and miss the infections.

I agree with caperjack. MSE rarely ranks "up there". Avast is excellent. Avira Free is quite good, however, due to Avira's recent partnering with Ask.com to add the Avira SearchFree tool bar and Trialpay to help cover the cost of providing the WebGuard extra, which is included in their paid version, many forums have removed it from their lists of recommended free programs. This WebGuard with it's Ask.com provided SearchFree tool bar certainly is not required and this has resulted in many, many complaints posted on their forum.
IF you watch their installs closely you can opt out of these toolbars in Avira but of course many people neglect to watch these installs and end up with these toolbars. They certainly are NOT needed and often are flagged by anti-malware scanners.

Have never been a fan of AVG. On several other forums where I post there are a lot of infection removal threads where AVG was the av program installed so I personally would not recommend it. But "to each his own".

The Rising Antivirus Software Free Edition 2011 on caperjacks link was tested by a fellow at another forum and his results were not good. With scanner settings set at Medium/Default;
Quick Scan produced very high CPU usage which remained extremely high during the entire scan. Scan took 4 minutes to scan 1509 objects. Full scan test resulted in 9 false positives during the first half of the scan. This is …

You're welcome. Don't reinstall that P2P stuff when you do the reload. It will bring it all right back in.

Never said that uTorrent started up. The thing is p2p is p2p and connects you to people and places you don't know and many times have absolutely no control over whatsoever. It should be uninstalled. P2P puts a computer at great risk, especially to serious infection and, yes, computer hijacking.
Didn't request another MBA-M log but even though it shows nothing there obviously is something that is "running" IE and if you aren't then it is likely that "somebody else, somwwhere else" is.
Knew what Tunngle beta was essentially but it certainly should never have been auto starting and it is considered a p2p program. Means you have no guarantee that whomever you are sharing with is on the "up and up". Easy way to take over machines. Plus the program was a beta version, meaning TEST version and all the possible "bugs" are not removed. That in itself can be dangerous. You don't know what these bugs may be.

One thing I do want to mention, you have a program installed, Tunngle beta. Now I am not that familiar with this and I am not a gamer so possibly somebody else may be able to give more info, however, this program, according to your logs starts automatically when the computer boots up and then runs ALL the time in the background, whether you are actually using it or not. That shows in the logs. It does involve p2p most definitely. So there is something else that can be very questionable and if this program is running all the time this could also be the cause of your multiple instances of IE opening on its own.

You also have uTorrent installed which also is a p2p program.

I would like you to do the following please:
You are going to use RevoUninstaller, which is the free version of the program, to Uninstall these two Programs which really are considered malware in many cases and can be causing your problems, or at least are contributing.

DAEMON Tools Lite
DAEMON Tools Toolbar

Download and install Revo Uninstaller

Double click the Revo Uninstaller icon on your desktop to start the program
Scroll through the listed programs and Right Click on the program you wish to uninstall
From the pop out menu choose Uninstall
Click Yes to the confirmation dialogue
In the next window select the Advanced mode
Click Next to start uninstalling the program
Answer Yes to confirm the uninstall
When the program has completed the four steps, click Next to allow the program to search for leftovers
Once complete, click Next, then Finish
Repeat the above steps for any other programs you wish to remove.

Once those are removed, then reboot and update and run a new MBA-M scan. Post back with the log.

We won't worry about that for now then. One thing you need to do is turn off the SpyBot TeaTimer and leave it off. It often interferes with any kind of fixes attempted. To turn it off do this:
* Run Spybot-S&D in Advanced Mode
* If it is not already set to do this, go to the Mode menu
select
Advanced Mode
* On the left hand side, click on Tools
* Then click on the Resident icon in the list
* Uncheck
Resident TeaTimer
and OK any prompts.
* Restart your computer

Then do the following:
Run the ESET Online Scanner

http://www.eset.com/us/online-scanner?i_agree=14

* You can use Internet Explorer to complete this scan and you will need to allow an Active X to be installed or you may use Firefox
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.

Post back with that log.

GMER log?

Where is the GMER log and the Attach.txt log from DDS Scanner, both of those also requested in our Read Me First sticky.Both of those must also be copy/pasted here.

The RiskWare.Tool.CK is a "hack" tool used to get a pay for software program via pirating...have you done this?

Probably not the best idea
You are right there, System Restore actually operates only on a very few system files and settings. System Restore backs up your registry. System Restore does not backup your data. It also will NOT uninstall a program or an infection. System Restore does not remove infections, only what may be a very clear pathway or footprints needed to FIND that infection.

Hello Twiggy159,
You forgot to update MBA-M before running the scan. You should remember you always should update before each scan.
Update it and run another Full Scan, have it remove everything found, reboot and then post back here with the new log.
You said that you had the Windows Repair" virus earlier and got it removed. How did you do this? Do you have any of the scan logs from the programs you ran at that time? If so could you post those also? That will possibly give us some help right now to decide what other tools should be run.

Well that may very well be that spyware removal would not be covered by warranty service. I had not thought of that. I too have had very good results dealing with their service techs. No, their techs would likely NOT be working on commission like that. Sales would be a different story possibly but not their service techs.

If that's the case then it should be ok. Have no idea why the dell tech support would tell you that they would charge you. You should have at least a 1 year warranty on the computer if it is brand new. That comes with the computer. If I were you I honestly would call Dell back and ask them about it. I have had Dell computers for 8 years and never had this happen.
Hey, you can't "pull the age card on me"....LOL...I am 65! We are always ready to help here so never hesitate to come here.

The SwagBucks Toolbar is a tracking toolbar. It is not recommended. The website appears to be ok but since I am not familiar with it I cannot say for sure, but the Toolbar is known tracking software.
The WinMaximizer was installed on July 1st. See if you can figure out what else you did that day. It may be located there.Try going to Start and type WinMaximizer into the search window there and see if it finds anything. DON'T delete anything you find just report back if something was found and exactly where.

"I went in and deleted some things that did not look necessary to me and the clicking has stopped"
And how did you know 100% that these were not necessary? You never just delete programs. The must actually be uninstalled. When you just delete them it only removes their name, not the program. Where did you go to delete these items?
Where did the clicking sound come from, INSIDE the computer itself or on a webpage? clicking sounds from INSIDE the computer would generally always be bad and would mean there is likely a bad component, usually the hard drive clicking from a webpage could just be sound effects from the page. Do you have your sound turned on all the time? Many very normal sounds will be heard with the sound turned on and clicking on various web pages.

You need to uninstall, using Add/Remove these programs;
Swag Bucks Toolbar
Coupon Printer for Windows

There is absolutely no need for a "special" coupon printer. Any page that has coupons on it can easily be printed using your printer software.
The Swag Bucks toolbar is known malware.

Since you did not purchase McAfee there is absolutely no reason to keep it.
Uninstall it and install one of these very good, highly rated FREE anti-virus programs. Either Avast Free from here;
http://www.avast.com/download-thank-you.php?src=http://files.avast.com/iavs5x/setup_av_free.exe&product=FA&page=free-antivirus-download&locale=en-ww&avast=0

or Avira Free from hee:
http://download.cnet.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html?part=dl-10322935&subj=dl&tag=button&cdlPid=11012914

You can't just delete a program, it has to be Uninstalled using Add/Remove. That is where you have to look for it.

Hello the.avon.lady1, You did not post all the requested logs. It is important that you post the DDS Attach.txt log..So please copy/paste that log here.

flagstar is incorrect, tracking cookies ARE most definitely spyware, hence their name TRACKING cookies. You do NOT want these on the computer. If SAS keeps finding them this means that your browser is NOT configured correctly to block them
Open Internet Explorer, Click Tools, Internet Options. On the General Tab,Browsing History section in the middle click the Settings button. When that opens put a dot in Everytime I visit the web page. Reduce the space saved to use to about 250. Click Ok.
Click the Privacy Tab, then click the Advanced button. When that opens put a check mark in Override automatic cookie handling. Then put a dot in Accept 1st party cookies and a dot in Block 3rd party cookies (those are the tracking cookies)
Also put a check mark in Accept session cookies.Click OK Then close out Internet Options.

From your one DDS log it appears you have a program installed called WinMaximizer. Uninstall this program. It is unnecessary and a junk program. I certainly hope you did not pay for this program, it is a paid program, and is totally unnecessary. These types of programs are never necessary.

SpywareBlaster is an EXCELLENT program and works perfectly well with ALL other security programs, I have used it for years and would never run a computer without it …

the.avon.lady1, this is another person's thread and you shouldn't post your problems in anothers. Too confusing for one thing and also unfair to the original thread creator.

Go to the top of the front page and click Start a new thread, as shown in my attachment. Then name and create your own thread. State all of your problems and somebody will be most happy to assist.