[Resolved] Computer slow, can't run SpyBot

I'll try Kaspersky and post log when it's done. This may take a long time, it is still updating. (edit) well, 15 minutes into scan progress is at 1%, we may have to take this up again tomorrow, Monday.

This is the Kaspersky report ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Monday, August 17, 2009 Operating system: Microsoft Windows 2000 Professional Service Pack 4 (build 2195) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, August 17, 2009 01:14:20 Records in database: 2637950 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ I:\ Scan statistics: Objects scanned: 92692 Threats found: 2 Infected objects found: 1 Suspicious objects found: 1 Scan duration: 07:10:37 File name / Threat / Threats count C:\Documents and Settings\Barry Baram\Local Settings\Application Data\Identities\{8C1BBE98-8B93-48CA-AD30-DFE6DC5DFA3B}\Microsoft\Outlook Express\eBay member.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1 C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1 Selected area has been scanned. After I posted this report, I decided to shut down and reboot the computer since it had been running all night. When I did, at the end of the new boot, the program UnhackMe , which scans every boot-up, caught something, I think it was called Kernel Auto Run, it asked to delete it and I clicked yes.

Hi,

Kernel Auto Run <–Not to sure what this does

You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see.

c:\program files\en.exe


How are things running now?

OK, I sent the file to the analysis site, but when it put the report on the screen, I did not see any button to save it, only to print it, and I have no printer on this machine, so I highlighted the text and pasted it below, although it lost some formatting Antivirus Version Last Update Result a-squared 4.5.0.24 2009.08.17 - AhnLab-V3 5.0.0.2 2009.08.17 - AntiVir 7.9.1.1 2009.08.17 - Antiy-AVL 2.0.3.7 2009.08.17 - Authentium 5.1.2.4 2009.08.17 - Avast 4.8.1335.0 2009.08.17 - AVG 8.5.0.406 2009.08.17 - BitDefender 7.2 2009.08.17 - CAT-QuickHeal 10.00 2009.08.17 - ClamAV 0.94.1 2009.08.17 - Comodo 2005 2009.08.18 - DrWeb 5.0.0.12182 2009.08.18 - eSafe 7.0.17.0 2009.08.17 - eTrust-Vet 31.6.6681 2009.08.17 - F-Prot 4.4.4.56 2009.08.16 - F-Secure 8.0.14470.0 2009.08.18 - Fortinet 3.120.0.0 2009.08.17 - GData 19 2009.08.18 - Ikarus T3.1.1.68.0 2009.08.17 - Jiangmin 11.0.800 2009.08.17 - K7AntiVirus 7.10.820 2009.08.17 - Kaspersky 7.0.0.125 2009.08.17 - McAfee 5712 2009.08.17 - McAfee+Artemis 5712 2009.08.17 - McAfee-GW-Edition 6.8.5 2009.08.17 - Microsoft 1.4903 2009.08.17 - NOD32 4343 2009.08.17 - Norman 6.01.09 2009.08.17 - nProtect 2009.1.8.0 2009.08.17 - Panda 10.0.0.14 2009.08.17 - PCTools 4.4.2.0 2009.08.17 - Prevx 3.0 2009.08.18 - Rising 21.43.04.00 2009.08.17 - Sophos 4.44.0 2009.08.17 - Sunbelt 3.2.1858.2 2009.08.17 - Symantec 1.4.4.12 2009.08.18 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.17 - VBA32 3.12.10.9 2009.08.17 - ViRobot 2009.8.17.1887 2009.08.17 - VirusBuster 4.6.5.0 2009.08.17 - Additional information File size: 132491 bytes MD5…: 29b759b5c318013654cd15abfe12a977 SHA1..: bbcf4e796c2c1996a89970ef93f72ed8f2c91d0d SHA256: f5f6b1a70ec5d4422ee96262048fadfd371e97c39502e93fbc54ee607611e432 ssdeep: 3072:Emgz9T5pSmXOiftXpMyyl1EBd/KLILO0trwX8ciou4LyOUCx:kz9T1XV5pX eWz0IBrwXfG4hFx PEiD..: WinZip 32-bit SFX v6.x module TrID..: File type identification Win32 Executable MS Visual C++ 4.x (61.8%) Win32 Executable MS Visual C++ (generic) (17.3%) Winzip Win32 self-extracting archive (generic) (10.5%) Win32 Executable Generic (3.9%) Win32 Dynamic Link Library (generic) (3.4%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x37c5 timedatestamp…..: 0x362891d3 (Sat Oct 17 12:47:15 1998) machinetype…….: 0x14c (I386) ( 6 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x466e 0x4800 6.28 26ca67109ba2440a21fb765c7c36cac9 .rdata 0x6000 0x92 0x200 1.80 dc5108ec7ec67bc28d6d0a76fa9dc66e .data 0x7000 0x16f5 0xe00 6.80 fc969a2fdeddc65b6902e74ce891a7cc .idata 0x9000 0xa00 0xa00 5.17 f5997461133f074b6f6c3cd36357ab03 .rsrc 0xa000 0x504 0x600 2.93 5b6a1585c569fb4071f190a780379bca .reloc 0xb000 0x922 0xa00 5.99 6642066c3cdf475d2037c767e186af21 ( 5 imports ) > SHELL32.dll: ShellExecuteA, FindExecutableA > USER32.dll: ShowWindow, DefWindowProcA, BeginPaint, GetSysColor, GetClientRect, SetRect, EndPaint, SetWindowWord, GetWindowWord, RegisterClassA, OemToCharA, CharToOemA, OemToCharBuffA, LoadCursorA, DestroyWindow, SetWindowTextA, SendMessageA, EnableWindow, PostMessageA, GetLastActivePopup, SetWindowPos, CharNextA, SetTimer, KillTimer, DialogBoxIndirectParamA, GetWindowRect, GetSystemMetrics, GetKeyState, PeekMessageA, TranslateMessage, DispatchMessageA, GetParent, SetDlgItemTextA, SendDlgItemMessageA, GetDlgItem, InvalidateRect, UpdateWindow, wsprintfA, MessageBoxA, SetCursor, GetDlgItemTextA, EndDialog > KERNEL32.dll: CreateDirectoryA, _lclose, _lopen, GlobalHandle, RtlUnwind, lstrcmpA, GetCommandLineA, GetModuleHandleA, ExitProcess, SetErrorMode, GetVersion, LoadLibraryA, GetProcAddress, GetModuleFileNameA, FreeLibrary, lstrcmpiA, GetWindowsDirectoryA, GetEnvironmentVariableA, LocalAlloc, LocalFree, GlobalUnlock, lstrcpyA, GlobalFree, GlobalAlloc, GlobalLock, WinExec, _llseek, GetDriveTypeA, _lread, _lwrite, GetVolumeInformationA, FindClose, FindFirstFileA, GetCurrentDirectoryA, SetCurrentDirectoryA, lstrlenA, lstrcatA, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, _lcreat > GDI32.dll: SetTextColor, SetTextAlign, GetTextExtentPoint32A, GetBkColor, DeleteObject, SetBkColor, ExtTextOutA, CreateDCA, GetDeviceCaps, CreateFontIndirectA, DeleteDC, SelectObject > ADVAPI32.dll: RegQueryValueA ( 0 exports ) PDFiD.: - RDS…: NSRL Reference Data Set - packers (F-Prot): ZIP I went to the page you gave about showing hidden files, and as I have said, the options mentioned there about folder views are not the same on my machine. I have attached a screenshot .gif to show you what I mean, I have options that say "Super Hidden", "NOHIDDEN", and "SHOWALL" The computer seems to be better now, but I am only going to the web sites you mention. I have not had the "fail to initialize" error yet, but also I have not tried to install SpyBot again. Anyway, can you explain why I have the different options/settings in folder view? [attachment removed: screenshot.gif]

That file looks ok, you ran it just fine. Not sure on the folder view, the instructions where for windows 2000, even though the wording was a bit different they basically did the same thing. Maybe 2000 Pro is different from 2000. How are things running now?

Seems to be OK, although I still will have to try to install SpyBot. By the way, can you explain the difference between NOHIDDEN and SHOWALL in the folder options. They sound to me like the same thing. Also today I did a little google research on these 2 terms and found some bb discussions about these being the effects of a virus, but the solutions, involving registry keys, seemed to be inconclusive. If you think nothing more needs to be done, then I will download SpyBot tomorrow and try to see if it works OK I read L D Tate's page on why some computers are "naturally" slow, and I will see about making some changes as suggested, especially malware defending programs that run "light". You said that some Microsoft pages would explain or fix the Fail to initialize error, the last one I got was for mobsync.exe, I think. Also, what about the things Kaspersky found?

You can keep Malwarebytes, open it , check for updates and run the Quick scan now and then/

You can delete Rooter and DDS.

You can post in our windows forum for help with your other issues.

Windows Tech Support Forums

• Windows Support <– Our own forum
• PcPitStop <– You can take your system in for a checkup here.

It's Not Always Malware

• Slow Computer
• Microsoft
  

Speedup Windows

• TechBuilder

Windows Tips

• Techruler
• Kellys Korner

Combofix <—Is not a general cleaning tool, just run it with supervision or you can bork your system

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  
  
  • [external image: Posted Image]
  
  
• When shown the disclaimer, Select "2"

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

• How did I get infected in the first place ?
  Read these links and find out how to prevent getting infected again.
• Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
• WhattheTech
• Grinler BleepingComputer
• GeeksTo Go
• Dslreports

Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster and Spyware Guard, they will conflict with the TeaTimer in Spybot , you can still install Spybot Search and Destroy but do not enable the TeaTimer .

Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community

• Spybot Search and Destroy 1.6
  Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
  
• Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
  
• Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
  
• IE-Spyad
  IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  
• Firefox 3 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.

Safe Surfn
Ken

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.