Posts by jholland1964

You don't need a special program to go to that website. Don't download anything unless told to do so. If you can't get to the site then downloading some program isn't going to help you get there.

What site isn't loading? The jotti site? Try this instead

http://www.virustotal.com/

Ok, let's try this, go to this page http://virusscan.jotti.org/en and upload that file c:\windows\system32\drivers\cvwgex.sys.
to have it scanned by multiple scanners and let me know what it finds.

Ok. Not sure of your location. I am in the US and it is nearly 1 am at my location so I will look at them in the morning if that's ok. I would advise that you not use the computer, except for completing all the scans until I can take a look and tell you the next steps that need to be done.

Continuing to use the computer while it is still infected will put it at a greater risk. So complete the scans, follow all the directions exactly and once you have completed all the scans, post the logs back here and then shut the computer completely down until tomorrow as you don't want further infections. I will read the logs first thing in the morning and post further instructions if they are needed.

If the scans were all done today you can begin with those. If they were done several days ago and you have been using the computer since then I would advise new ones be done.

Using an expired av program to scan a computer you think is infected is a bad idea. It likely would not be able to find all the infections, if they are there. In order to find the newest infections an av program must be up to date, and I certainly would not recommend backing up something I was not sure was clean.
By all means, follow the instructions found in our Read Me sticky, then save the logs and post them all here I will be happy to take a look, maybe a reformat won't be needed if we can get it all clean. There are several excellent FREE av programs available also once we get the computer clean.
Here is the link for the Read Me sticky:
http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/threads/134865

You mean a paid version of an antivirus program? You should be able to as long as you have the registration code and it is not expired. You probably would have to contact the av company to get it reactivated but that normally isn't a problem as long as you have all the key info and it's not expired.If it's expired then no you couldn't because you do have to re-register it and it wouldn't register if expired.

You ARE aware I hope that you have posted your actual name, if this IS your actual name, in your thread on a public, open forum. I have edited your post and removed it.

You say in your post
"(I always use my Orignal name "xxxxxx" while Subscribing newsletters or giving comments)". This means you are putting your name out there for the World to see. Do a google search for this and you will receive thousands of links bearing this name.
It is very likely that somebody has hacked your account or hacked your computer entirely.
If it is a webmail only, accessed via the browser, then it is probable the account itself was hacked. Email Hackers have only one job, hack email accounts in order to do exactly as they have done with yours in order to spread their malicious programs, files, websites to others. They are very patient and can sit for days trying various letter and number combinations until they get a "hit" of a legitimate account name, once they do that then they work on hacking the password in much the same way. Once they have both then it is "game on". "Professional" hackers don't do this manually, they use specific programs to do this for them.

If this email was sent through an email PROGRAM installed on the computer then your computer itself has been hacked and hijacked and you should most definitely follow all the steps given in …

Hi Karen, Judy here, PP asked if I could jump in and take a look. One thing I see is your Hosts file is hijacked. You need to replace this with a clean one.
Follow the steps on this page, note there are special instructions for Vista right next to where it says IMPORTANT

http://www.mvps.org/winhelp2002/hosts2.htm

Also you said this happens especially when you use a certain program, what program IS that exactly?

Think reformat is likely your best option

If you feel everything is good then I think you are good to go. The thread can be marked as solved. If something else develops in the next few days you can always post right back here and we can take another look.

Judy

Try Administrative Tools, Services to Stop that Service from running at Start up.
AFTER stopping it then go to C:\Windows\System32\ZoneLabs\and delete the Zone Labs folder in there, just that folder, nothing else.

No, you can't just delete those items they would have to be Uninstalled. Windows Live Care has a firewall, that is why the built in Windows Firewall won't turn on.
You can UNINSTALL Windows Live One Care.
http://social.microsoft.com/Forums/en/onecaregeneral/thread/732e6371-2e71-479a-8cd6-b189941ed4fb

I always had heard that AVG and Avast were about the same.

I don't know where because it certainly was not here. They are not remotely alike. I have helped clean more machines running AVG than any other AV programs in the last year or more.

SpyBot won't update because you all ready have the latest available updates which were released on the 15th. This shows in the log:

2011-02-15 Includes\TrojansC-02.sbi (*)
2011-02-15 Includes\TrojansC-03.sbi (*)
2011-02-15 Includes\TrojansC-04.sbi (*)

If you have TeaTimer turned on in SpyBot turn it off and leave it off. It interferes with other programs and fixes made with those programs.

Try to update MBA-M and see if it will update now in normal mode.

How did you uninstall Zone Alarm? Your logs show that some of this may remain because it is trying to start, which is why your Windows Firewall may not work.

Completely Uninstall AVG, it likely was damaged by the infection.

It really is not a good antivirus program either. You should use either Avira or Avast.

Your MBA-M program is woefully out of date as you say. Try doing this see if you can boot to Safe Mode with networking and try updating MBA-M and if you can then run the Full Scan while in Safe Mode, have it remove everything found, and then reboot to normal mode and do another scan. If it will scan then have it again remove everything found, reboot and post back here with that log. Then we will go from there.

You say you previously removed an infection, what was it and how did you remove it? Do you have any remaining logs from this removal? If so, post those too.

Doesn't look bad, however my main concern is BitComet 1.25 which of course a violation of our rules here, clearly stated in PP's Read Me first sticky.

[B]Please Uninstall or Disable any P2P (peer-to-peer) programs on the infected computer before posting in this forum. Rather than write a long piece on the dangers of P2P, I’m just going to say this:

    P2P software circumvents common-sense security measures and opens a user’s computer to a world of hurt.
    Our regular volunteers' time is valuable and most are not willing to waste it on a machine that is almost certain to be reinfected in short order.
    So, please remove or disable all P2P software for the duration of the cleaning process. Failure to do so may result in your thread being ignored.[/B]

Quite likely the way the computer was infected. So as he says, there is a good chance of re-infection.
Your Java is way out of date, you have version 6 Update 17 and current version is update 23 so you do need to update this.

Otherwise I think it is likely clean. You need to Uninstall Combofix using these instuctions:
Uninstall Combofix:
Go Start > Run [Vista and 7 users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

You also need to set a new, clean Restore point.
To do …

Give me a bit to go through this and I will get back with you ASAP.

Now you need to do this. If you DON'T have MBA-M on the computer then you will need to download it
Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

REBOOT after running MBA-M! This is VERY Important.

If you DO all ready have it then Update it and run a Full Scan following the directions above.
Post back with that log.

Also, HJT just isn't as useful as it once was, especially with Vista and Windows 7.
We ask that you follow these instructions instead:

Download DDS by sUBs and save it to your Desktop.

• Just leave it there for now.

Be sure follow the instructions below carefully!

• …

Ok, now you need to do the following:
Please download ComboFix by sUBs from

http://www.bleepingcomputer.com/download/anti-virus/combofix

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop
• Physically disconnect from the internet.
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When ComboFix has finished running, you will see a screen stating that it is preparing the log report
• This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
• Re-enable all the programs that were disabled during the running of ComboFix..
• Then post back here with that log and a new scan log from HiJackThis.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF …

It may be nothing, but my feeling is better safe than sorry. And I have found no references stating this is a false positive.

This rootkit,whistler@mbr.has added the TDSS rootkit to its "arsenal" but that cannot be removed with the other tools and requires it's own removal tool and that is the TDSSKiller.

This has become a very common problem with lots of posts concerning this very thing at the Avast forums in just the past few weeks. I don't believe this is a false positive but an actual rootkit.
Try running the TDSSKiller
Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Going to have to have somebody else take a look at this. One of us will get back to you ASAP.

Please download OTC by OldTimer: http://oldtimer.geekstogo.com/OTC.exe
Save it to your Desktop.
Double click OTC.exe.
Click the CleanUp! button.
If you are prompted to Reboot during the cleanup, select Yes. The tool will delete itself once it finishes.

Catalina, stop running and re-running combofix. This should never be done unless instructed to do so. The instructions on the tutorial page are very clear, if you have problems during the run immediately report that to the helper who instructed you to run it, it does not say continue to run it. Please stop.

Please look for any logs created by your multiple runs of it. They will be found at C:\ComboFix.txt We need to see any or all of those created.

wnoorlag, this thread is three years old and is somebody else's thread. You will not receive answers in another persons thread. You should begin your own thread after completing the steps given in our Read Me Sticky.

http://www.daniweb.com/forums/thread134865.html

Catalina, to see those entries in a HJT log about IE is perfectly normal and one would be concerned if it didn't show in an HJT log because that would definitely indicate serious system damage.

IE cannot be removed it is part of the operating system, even if you don't use it.

Since you were able to run HiJackThis then you should be able to run the tools noted in our read me sticky. You need to do that and then post back with all of the logs.

http://www.daniweb.com/forums/thread134865.html

I want you to Unistall that other copy of combofix that you previously used, please do it EXACTLY this way:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

AFTER you uninstall that old copy, then download a new copy from here:

http://www.bleepingcomputer.com/download/anti-virus/combofix

Save it to your desktop.

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop
• Physically disconnect from the internet.
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.Since you are using Windows Vista, and receive UAC prompt asking if you would like to continue running the program, you should press the Continue button.
• When ComboFix has finished running, you will see a screen stating that it is preparing the log report
• This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see …

Part of the problems now have to do with the fact that you waited nearly 19 days to come back here and tell us you couldn't figure out how to fix the host file. These things must be done as soon as possible after requested obviously there is still serious infection on the computer judging by the number of infected files found by your anti-virus program. Many of these were temp files, telling me you have incorrect settings in your browsers. 1st party cookies are the only ones which ever should be allowed. You also are not emptying your temp files on a regular basis.
I would advise that you begin again with the steps given in the read me sticky and post back here with the logs.

You don't need to run any more removal tools you all ready have removed everything.

I caution you one final time. Do not come back here and ask for assistance if you infect your system again by using any type of file sharing, cracked software, keygens, etc. You will NOT receive assistance for removal of infections due to illegal activity.

Forget about making a short cut. There is nothing on that page about making a short cut. Forget it and follow THEIR instructions.

never mind about my question about running combofix twice, you did...33 days ago in your first thread. I won't need to see that other log.
Can you see now why this is all so very frustrating to all of us who work to help people clean their computers?
33 days! and you are back again with the same problems for the very same reason!
We care about keeping computers clean and safe and fun to use, it is people like you who do not.

Now you need to UNINSTALL Combofix and it MUST be done this way, EXACTLY:

Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

If you feel your problems are solved you can mark this one solved.

Did you run combofix twice? If so, I need to see the other log.

I can assure you Avast was NOT disabled, if it were disabled it would show that it was disabled in your log. I told you, since it was run incorrectly you would have to wait until I get information concerning this incorrect running. That is all I can tell you now.

Sorry, but you are 100% incorrect. NO place does it say that combofix will not scan if the anti-virus is enabled.
The instructions in the say the following:
"Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix."

It DOES NOT say combofix will not run, it says it will not run PROPERLY. Which means that some infected files may not be removed.

I posted similar instructions:
"Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix."

I DID NOT say it would not run.

It OBVIOUSLY DID run on your machine, the log clearly shows that Avast WAS enabled and Windows Defender WAS enabled. Neither one was turned off.

Here again is the top of YOUR log that you posted here:

AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

If they were turned off the log would have said Disabled like this,

AV: avast! Antivirus [B]*[B]Disabled[/B][/B]/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus [B]*[B]Disabled[/B][/B]/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *[B][B]Disabled[/B][/B]/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

Your log clearly does NOT say Disabled.

Again, you have NOT followed instuctions:
combofix instructions are VERY CLEAR

• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

Yet your log shows the following:
AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

What is it about the word STOP that you do not understand?

Do NOT run the program again. but sooner or later you are going to have to learn to follow instuctions.

I will have to consult with somebody else on this since you didn't follow the instructions correctly.

Please download ComboFix by sUBs from

http://www.bleepingcomputer.com/download/anti-virus/combofix

Please note that the BleepingComputer.com download link will expire in 10 minutes after you click it so if you don’t click within ten minutes after reaching the page you will need to refresh the page.

• You must download it to and run it from your Desktop
• Physically disconnect from the internet.
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When ComboFix has finished running, you will see a screen stating that it is preparing the log report
• This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
• Re-enable all the programs that were disabled during the running of ComboFix..
• Then post back here with that log

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually …

I have previously requested that you update Malwarebytes' and you do a Full Scan in normal mode. Why are you asking if this is what I want you to do?
Any other scans that don't run then don't attempt them again.It may be that key files on your computer has been damaged by this illegal downloading and therefore some things may not be able to be done.

Please, I say again, Update Malwarebytes' and do a full scan in NORMAL mode. Have it remove everything found and REBOOT the computer. Post back here with that full log.

Ok continue with the rest.

When you have finished with these scans and posted the results, not just a general comment...5 infections found...but actual NAMES and LOCATIONS of all of them then you need to Update MBA-M and run a FULL scan with it in NORMAL mode. Your previous scan was done in Safe Mode and that does not scan all files. MBA-M is meant to be run in NORMAL mode.
When it completes have it remove everything found. Reboot the computer and post back here with that new log.

I gave you the corrected link all ready and corrected the link in my original post. But here it is again
http://www.bitdefender.com/scanner/online/free.html

http://www.bitdefender.com/scanner/online/free.html

Not sure what you mean by scan not complete...Quick Scan is NEVER a complete scan it only scans a limited number of files, never scans the full computer, why do you think it is called a Quick Scan? Full Scan means full computer.
If we wanted a Quick Scan we would ask for one. Unless we do you can assume any requested scan means a Full Scan.

You need to run FULL scans not Quick Scans. Quick Scans don't scan all files, since I have no idea what has been found then Quick Scans are not enough.

Since you are not telling ESET to save the full log then you are not getting one.

Now, since this second scan found five infections but the original one allegedly found none this tells me there are numerous infections remaining. This is going to take you a long time to be certain all of these are removed. All of this because you continue to use your computer for illegal activity. Claiming that you were helping a friend, and downloading a program needed for educational purposes just doesn't get it. I am very familiar with educational requirements. If schools require specific programs for use in classes these programs are usually offered to students either free for temporary use until the class period expires or at a reduced student rate so these excuses are bogus to me. Plus I have not heard of any school recommending illegal activity like stealing software in order to fulfill classroom requirements.

Since you failed to request the full ESET log and did not make full notes of what 5 infections were found and where then I am at a disadvantage in telling you what other programs will be needed. So you will need to run ALL THREE of the other scans noted. I need all of the information given you following these scans.

Very odd that you never receive a log. I just ran it on my machine, it was clean, and I received a full log. Since I have no idea what was found or if it was run correctly then you will have to run others:

Disable your own Antivirus first to run these

http://housecall.trendmicro.com/ Scan with IE or Firefox

http://www.bitdefender.com/scanner/online/free.html

http://www.f-secure.com/en_EMEA/secu...nline-scanner/

Tell you what, I am somewhat doubtful when you say you had no idea how to remove uTorrent but thought it was gone, because your log clearly shows it was reinstalled on Janurary 7, 2011.
"Helping a friend" doesn't really make a difference to me either.

I will believe you, this time, but it is the last time.

No, I don't want another DDS scan at this time.

Instead do the following:

Please Run the ESET Online Scanner

http://www.eset.com/onlinescan/scanner.php?i_agree=14
* You can use Internet Explorer or you may use Firefox to complete this scan and you will need to allow an Active X to be installed
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.

The last time you failed to ask the program to save the log. Please do so this time because I need to see the log.
Post back here with that ESET log.

I am not certain why you keep posting these same logs.
Please note this entry from your DDS log
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

You were told in your previous thread to uninstall this, you said that you did uninstall it, yet, here it is again.
Obviously you have not heeded any warnings.

"i was downloading a key gen to crack a software coz i needed it for educational purposes anywayz ive downloaded a virus again"

Doesn't matter WHY you are doing this, taking a program for free that must be paid for is illegal. That was what you did
previously and now you have done it again, in less than 30 days. You ignored our rules the 1st time and now you have done it again the second time.

Our rules are very clear here concerning files illegally obtained.
#1. Because it IS ILLEGAL
#2. As PhilliePhan says first thing in our Read Me Sticky:
Our regular volunteers' time is valuable and most are not willing to waste it on a machine that is almost certain to be reinfected in short order.
By doing this again in less than 30 days you have proven his point exactly.

Assisting people to illegally obtain files is also ILLEGAL, which is what you are asking those of us at this forum to do by again requesting assistance because you have obtained a file or program illegally and therefore infected your machine.

I am giving you a LAST warning. I will help you once more, I stress ONCE MORE. But after this LAST time I will never again help clean up your machine infected due to illegal file sharing. I also will tell you that we CAN tell if a machine has been infected due to illegal file …

This is the second infection you have had in 30 days. You failed to follow all steps exactly as given previously but said the system was clean, obviously it was not.

Follow the steps given in our Read Me Sticky EXACTLY and post back with all the requested logs.

http://www.daniweb.com/forums/thread134865.html

Doesn't matter if you are running IE8 on other machines and they happen to work fine, this one does not. As I said, it works fine on some machines running XP and others it does not because it is basically for Vista and Windows 7 and not XP, though it will run on some XP machines, not all. It could be the core file is damaged so no matter what version you would run you would get the error.
Have you run Check Disk?