Posts by jholland1964

When you have turned off TeaTimer let me know. That has to be off in order for the fixes to work.

Ya i rebooted immediately and ran hjt after my computer restarted.
everything should be accurate.

Ok good. I am going through your HJT log and should have fixes to do with that in a few minutes. In the meantime, BEFORE these could be applied you need to do this and that is turn off SpyBot TeaTimer. It can interfere with any fixes done.

Disable Spybot's TeaTimer

* Run Spybot-S&D in Advanced Mode
* If it is not already set to do this, go to the Mode menu
select
Advanced Mode
* On the left hand side, click on Tools
* Then click on the Resident icon in the list
* Uncheck
Resident TeaTimer
and OK any prompts.
* Restart your computer

It said it couldnt delete it all and had to put some on delete on reboot.

When you see that you should ALWAYS reboot immediately BEFORE doing anything else? Is this what you did or did you run the HiJackThis first? If so then the HJT log would not be accurate. In fact I always recommend rebooting after an MBA-M scan where items have been found.
If that is what you did then please reboot and run another HJT scan and post that log.

The choice is yours. I gave you my best advice, which is always it is better to be safe than sorry. You feel this was incorrect and that is fine.
Other scans we recommend here if ESET isn't an option are
• Kaspersky Online Scanner

• Panda Active Scan

• Trend Micro HouseCall

• F-Secure Online Virus Scanner
Some of those onlines will clean some will not. ESET has been recommended most of the time because it will clean what it finds.
But it is your option.
Thanks for posting back.

Crunchie, I have NOT done the things in your last response yet because I ran the Trend Scan and went to bed. I'm holding off on doing anything now until you see this and tell me how to proceed. Sorry to be such a pain.

Hi, If you had run the steps posted by Crunchie BEFORE running the TrendMicro scan then most of those things would not have been found.

Most of them were found in System Restore, they won't hurt things from there usually but if you note above one of the things he asked you to do was set a new restore point. That would have removed those so they wouldn't have been there for this scan.

Don't do it yet. Do the steps below first, then do all the steps Crunchie gave you above and the last one is resetting System Restore.

The other items found were in the Combofix Quarantine file.
Uninstall Combofix to get rid of these. I don't see that he asked you to remove it so he probably just forgot it. They were/are in quarantine there so they cannot infect the computer again but you also don't need combofix anymore so it should be removed. If it is ever needed then the helper will tell you and you would download a new copy.

Here is how you should uninstall combofix;
* Click START then RUN
* Now type Combofix /u in the runbox and click OK. …

Hi, welcome to daniweb.
Please do the following:
download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

REBOOT the computer.
Run a new HJT scan and post back here with the MBA-M log and the new HJT log.
Judy

You should not assume the problem is solved. The computer thought it needed this infected file because the infected file "told it" it was needed. It probably was listed as an auto start, possibly a starting service, very possibly have disabled all of your security programs, though they can look to you like they are working. They may even SAY they are working. System Restore isn't going to fix damaged programs. It might return "some" of the system files back but if your security programs were damaged, it is very possible they are still damaged. You said every program you opened wanted this file...what does that tell you?

You said this is a business computer, though not what operating system you have but you are taking a BIG chance not completing the clean up steps listed. MS issued a security patch several months ago which could possibly have prevented this. But most people who installed the patch were home users, businesses didn't bother, as of mid January, according to the article HERE, it is possible that 1 in every 16 business computers have been infected by this.

I just worked for over ten days on a computer that was highly infected, and ONE of the infections was the Conficker Trojan. Every single security program on the computer was totally trashed and to begin with every single new one I tried was infected immediately. The owner HAD used System Restore to try to correct the fact that …

Bravo! Give yourself a pat on the back!

Looks much better. Run HiJackThis again and put a check mark next to this entry
O20 - AppInit_DLLs: wbsys.dll mega.dll
Click the Fix Checked button.
Exit HJT.
Then double click My Computer.
When that opens double click "C" drive.
When that opens double click c:\windows\system32\
and when that opens scroll through the list, and look for the following files mega.dll and wbsys.dll.
If you find them delete them.
Reboot the computer.
Run a new HJT scan and post back with that new log.
Judy

Really happy to have helped you Anne.

You have a very infected computer. You also have STOPzilla installed which, frankly ranks as just a "so-so" program. Those O10's are likely from that program, cannot be certain but found several references to it. Frankly, I would UNINSTALL it anyway, obviously did you no good whatsoever.
Every site listed on your log as a Trusted Site is a nasty one.
I would recommend that you do the following, after getting rid of that STOPzilla program.

Download ComboFix
Click on the Save button and then when it asks you where to save it, make sure you save it directly to your Windows Desktop.
Once the download is complete you will see the Combofix on the desktop.

* Close all open Windows including this one.
* Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
Doubleclick the combofix icon on the desktop to run the program.

Windows will issue a prompt asking whether you wish to run the program, click Run
You will then see a Disclaimer screen asking you to agree to the disclaimer. Press the number 1 key to accept the disclaimer.

Now just sit back and allow the program to run

Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do …

Lots of file sharing programs on there, some with open ports. Good way to get infected, as you have seen.
Reboot and run and new HJT scan and post the log here.

I just noticed a CID help log within the add/remove programs in the control panel. There is no file size like most programs have along side it but it is there. the CID is the pop up that is coming up. Should I remove this???

Yes. Try that and see if it helps.

One reason more was found is because you ran an out of date version of the program. The KEY to using MBA-M is ALWAYS update prior to running the program. It is an excellent program and they often issue updates more than one time a day. But I believe there is a bit more on the computer so you should run this other program.

Please do the following;
Download ComboFix
Click on the Save button and then when it asks you where to save it, make sure you save it directly to your Windows Desktop.
Once the download is complete you will see the Combofix on the desktop.

* Close all open Windows including this one.
* Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
Doubleclick the combofix icon on the desktop to run the program.

Windows will issue a prompt asking whether you wish to run the program, click Run
You will then see a Disclaimer screen asking you to agree to the disclaimer. Press the number 1 key to accept the disclaimer.

Now just sit back and allow the program to run

Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all and …

Looks better, notice any difference?
Have a couple questions; how are you connected to the internet?
The reason I ask are these two O17 entries;

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = studio.local
O17 - HKLM\Software\..\Telephony: DomainName = studio.local

are unusual, at least to me. Are you networked to other computers?
Secondly, do you know what this site is in your Trusted Zone?

O15 - Trusted Zone: http://*.server02

Did you add it, if so, what is it?
Judy

You Malwarebytes' log shows NO ACTION TAKEN. You have to REMOVE everything found. If you do the log will then show that. PLUS Malwarebytes' is out of date. Current version is 1.34 and current data base is 1770. You need to Update MBA-M and run it again and have it REMOVE everything found. Then REBOOT and run HJT again. Post back with both logs.

Please do the following;
Download ComboFix
Click on the Save button and then when it asks you where to save it, make sure you save it directly to your Windows Desktop.
Once the download is complete you will see the Combofix on the desktop.

* Close all open Windows including this one.
* Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
Doubleclick the combofix icon on the desktop to run the program.

Windows will issue a prompt asking whether you wish to run the program, click Run
You will then see a Disclaimer screen asking you to agree to the disclaimer. Press the number 1 key to accept the disclaimer.

Now just sit back and allow the program to run

Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

When ComboFix has finished running, you will see a screen stating that it is preparing the log report.
This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. …

Yes, just a couple final steps.
First of all you need to remove Combofix as it is no longer needed and it IS a specialty tool not commonly used.
Do the following:
* Click START then RUN
* Now type Combofix /u in the runbox and click OK. The space between the combofix and the /u, it must be there.
When shown the disclaimer, Select "2"

You should remove HiJackThis, you don't need it any more. Do this via Add/Remove.

Download, Install, Update SpywareBlaster
This is a MUST HAVE tool. Will protect your computer from Dialers, malware, adware, tracking cookies, hijackers and does it for FREE.
Works with both IE and Firefox
Once you have it updated then go into each section and Enable All, including the Restricted sites portion. Once you have enabled everything then CLOSE the program. It DOES NOT run in the background. Manually check for updates weekly.

Then you also need to set a new, clean Restore point.
To do this Right Click My computer.
Choose Properties
When System Properties opens choose the System Restore Tab.
Place a check mark in Shut down System Restore.
You will probably get a message telling you it will be shut down, click ok or yes.
Allow it to shut down.
Wait a moment. Then go back in and take that check mark Out so that System Restore will turn …

Still getting the pop-ups?

First item found by Norton was the Combofix quarantine. Second item was in System Restore.
Looks pretty good to me.
Do you feel things are running better? If so I can give the steps for a final step.

Go into the Scheduled Tasks folder and remove this entry:
c:\docume~1\rosedale\applic~1\interl~1\32 defy vga.exe

Download ComboFix
Click on the Save button and then when it asks you where to save it, make sure you save it directly to your Windows Desktop.
Once the download is complete you will see the Combofix on the desktop.

* Close all open Windows including this one.
* Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
Doubleclick the combofix icon on the desktop to run the program.

Windows will issue a prompt asking whether you wish to run the program, click Run
You will then see a Disclaimer screen asking you to agree to the disclaimer. Press the number 1 key to accept the disclaimer.

Now just sit back and allow the program to run

Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

When ComboFix has finished running, you will see a screen stating that it is preparing the log report.
This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a …

Yes progress is definitely being made, combofix removed a lot of bad items. Now update your Norton Program and run a Full System scan with it. Have it remove or quarantine everything found. Please note names and locations of all that is found so you can post it back here.
Reboot the system.
Then Update MBA-M and run a Full System scan with it. Have it REMOVE everything found.
Reboot the system.
Run a new scan with HJT and save the log.
Post back here with both logs and the info from your Norton program.
Judy

Hi welcome to daniweb,
You obviously have malware of some type on the computer. Have you run any scan with your McAfee Anti-Virus program? If not please UPDATE it and run a Full System scan with it. Have it remove or quarantine anything it finds. If it produces a log then save that log for posting here. If no logs are produced please make a note of the FULL NAMES of all malware found AND their locations. Post that information in your next post.
Next ATF-Cleaner.exe by Atribune

• You can put ATF-Cleaner on your Desktop for easy access.
RUN ATF-Cleaner.exe.

-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK

If you use Firefox browser, do this also:

* Click Firefox at the top and choose Select All from the list.
* Click the Empty Selected button.
* NOTE : If you would like to keep your saved passwords, click No at the prompt.

Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform …

I would like to see all new scans please.
Update MBA-M and do a FULL System scan, allow it to REMOVE all found. Save the log.
REBOOT the computer.
Run the ESET Online Scanner and post the ScanLog with your post for assistance.

* You will need to use Internet Explorer to to complete this scan.
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is Un-checked at this time (we may have it clean what it finds at a later time), and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please post that log for us as directed below.
REBOOT the computer
Run a Full System Scan with HJT and save the log. Exit HJT
Post back here with ALL three logs.

:sweat: :icon_rolleyes: :icon_eek:
Almost wish I hadn't asked!
Let me look around, though to be honest, you may have lost me here!

Hi Anne,
Appears that ESET did remove the files that Kaspersky found. But you still have two suspicious entries in the new HJT log so do this;
Please do the following;

Download ComboFix
Click on the Save button and then when it asks you where to save it, make sure you save it directly to your Windows Desktop.
Once the download is complete you will see the Combofix on the desktop.

* Close all open Windows including this one.
* Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
Doubleclick the combofix icon on the desktop to run the program.

Windows will issue a prompt asking whether you wish to run the program, click Run
You will then see a Disclaimer screen asking you to agree to the disclaimer. Press the number 1 key to accept the disclaimer.

Now just sit back and allow the program to run

Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

When ComboFix has finished running, you will see a screen stating that it is preparing the log report.
This can take …

Are you still getting those pop ups?
Do you know what this program is?
O4 - HKCU\..\Run: [download draw] C:\DOCUME~1\Rosedale\APPLIC~1\INTERL~1\Surftrust.exe

Ok, just wanted to be sure what was installed on the computer. I see nothing unusual there.
Follow these instructions.
Be sure that Spybot TeaTimer is off and stays off. TeaTimer can be a tool for the prevention of spyware, but for an infected computer it will prevent its cleaning.
Do the following:
Please download ATF Cleaner HERE by Atribune. It does not require any installation.. It is set up to clean Windows TEMP folders, as well as IE, FireFox and Opera, Temporary Internet Files and Cookies.

* Double-click ATF-Cleaner.exe to run the program.
First Step:
* Under Main choose: Select All
* Click the Empty Selected button.
.
Next, if you use Firefox (and some Mozilla-based browsers)
* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.

. With all other applications closed (Taskbar empty), open HijackThis again, System Scan only. Place a check mark next to this entry, if it is still there:
O4 - HKLM\..\Run: [Fork live trust pop] C:\Documents and Settings\All Users\Application Data\Eq Anti Fork Live\Test Debug.exe
Then click the Fix Checked button. Exit HJT.
Reboot.
Update MBA-M and again run a full system scan and REMOVE items found. Save the log.
Reboot.
Run and new full system scan with HJT and save the log, post back with both logs.

Ok, I will do some research and come back when I find something.
So you have three computers, each with it's own printer and you want to be able to send a document from one to the other two and be able to print from all three printers from all three computers...correct?
What OS's do all three computers have?

Post the make and model of the printers and I will do some searching for you.

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
click on the Save list... button. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad into a reply please post that list here.

These are the popup family member is getting on their computer:

\

Sorry, but I see nothing except your message and a \
Sorry, didn't wait long enough for you to upload.

Found one more you should take a look at:
http://www.2009softwarereviews.com/Default.aspx?Refer=GCO12&Keyword=antivirus%20security

To be honest, if it were my choice, and I have to tell you I don't use either, the programs I use are all FREE, but if I had to get rid of one of these paid programs then I would Uninstall Windows Live OneCare. It doesn't rank in the top 10 on any lists.
Most of the lab tests rank it's anti-virus portion of the program at average or below.
Here are some reviews for you to take a look at and maybe help you make the decision:

http://internet-security-suite-review.toptenreviews.com/

http://anti-virus-software-review.toptenreviews.com/windows-onecare-live-review.html

http://reviews.cnet.com/online-software-services/windows-live-onecare/4505-9239_7-31899024.html

http://anti-spyware-review.toptenreviews.com/spy-sweeper-review.html

Can you run the ESET Online scanner and have it remove what it finds? Save the log, reboot the computer and then run a new HJT scan and post back here with both logs.
*Please note: You will need to use Internet Explorer to to complete this scan.
You will need to temporarily Disable your current Anti-virus program.
Judy

Ok, told you I might not be "reading things right"...had to do some converting here, your memory looks fine. Math was NEVER my strong suit. Your memory looks fine.
Let's start at the beginning again. You said you did a Kaspersky scan, I hope this was an ONLINE scan as you have Norton Anti-virus on the computer. Did you do a scan with Norton and did it find anything?
Really see no other signs of infection. Have you done a defrag of the computer lately? If there are a lot of fragmented files on the computer this can certainly slow the computer down. A program has to "work extra hard" to locate the needed files to run.
You have a large number of programs running all the time in the background, this could be a cause of slow downs. The Norton program itself is a known resource hog but it is basically a good antivirus program. If it is current, not expired, then of course keep it.
I would suggest a defrag and recommend you try stopping some of those auto starting unnecessary programs and see if this makes a difference.
First thing to do is Uninstall Viewpoint Manager. This is considered foistware, because usually it is installed along with another program without your permission. It starts when Windows starts and runs ALL THE TIME in the background.
1) Right-click on the clock in your taskbar and choose Task Manager
2) Click on …

Sorry, am I missing something? All I see is a webpage, which is a real web page by the way, I checked. I don't see any pop-up and I don't see 'CID' anywhere.

Infected so soon after I cleaned you up :(.

Well that's encouraging:(

We need to see the actual logs plus a HiJackThis log so try Safe Boot with Networking.

There doesn't appear to be a lot of memory here, unless I am reading things totally wrong.
How large is the HARD DRIVE and how much space is remaining on it?

How does Malwarebytes compare to Adaware or Spybot?

MBA-M is currently the top of the line. Crunchie clearly stated

* Post the log back here. & Post new HJT log.

He will need to see those logs.

Here is the link for AviraFREE an excellent antivirus program. Download, install and update it. Run a Full System scan and allow it to remove or quarantine all that it finds.
Then go HERE
Follow ALL of the steps given WITH THE EXCEPTION of Deckard Scanner which is NO LONGER AVAILABLE. Do all scans requested and allow the removal of all items found. Save the logs from all scans completed.
Substitute instead HiJackThis for the FINAL step. Do a Full System Scan with it and save the log.
Post back here with the logs from MBA-M, ESET Online Scanner and the HiJackThis log.

These are the steps we would prefer that you follow to begin:

Please go HERE Please do ALL steps with the exception of the Deckard Scanner, it is NO LONGER AVAILABLE.
Run each recommended program. If the instructions say to REMOVE ITEMS found, please do so. Reboot after each scan, especially MBA-M.
You also must TURN OFF SpyBot TeaTimer as it can interfere with fixes done.
Disable Spybot's TeaTimer

* Run Spybot-S&D in Advanced Mode
* If it is not already set to do this, go to the Mode menu
select
Advanced Mode
* On the left hand side, click on Tools
* Then click on the Resident icon in the list
* Uncheck
Resident TeaTimer
and OK any prompts.
* Restart your computer

Also please TURN OFF Skype, Instant Messaging programs, anything like that for the duration of this clean up.
Run ALL programs noted in the link above.
Once you have completed all then save requested logs.
Post back here with all of those logs and we will go forward.

You need to begin clean up by following all the steps given HERE with the exception of Deckard Scanner. It is no longer available. Substitute instead as the final step a Full System Scan with HiJackThis

Please post back here and copy/paste the logs from MBA-M, the online scanner and HiJackThis.
We will then be able to determine what other steps will be required.
Judy

Your Malwarebytes' program is out of date. You should always remember to UPDATE before each scan. If updates quite frequently, sometimes multiple times in one day. They released the newest version on 2/11 the newest version is 1.34 and as of 5 minutes ago the database version is 1756. Please open the program, go to update and click the update button. The program will automatically download, remove the old and install the newest version.
Once this is complete please do another Full System scan with it and have it Remove Everything it finds.
Reboot the computer.
Once the computer has rebooted then run another Full System scan with HiJackThis.
Post back here with both logs.
Judy

All I see is the webpage Sportsbook.com...is that what it is?

Your choice. Glad things worked out for you.

Hi,
Still getting those same popups.

LOL...Wondered why you posted the printscreens from Spybot and ESET...what I want is a printscreen of the pop-ups if you can get one.

Can't read that ESET print screen, it's too blurry. The spybot screen shot is fine, just remove all.