[Resolved] Fraud.Sysguard malware, Sloe IE Startup Baseline

Hi

According to the last OTL log Teatimer should be running.

PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

We'll look at that in a bit.

IE was fine while browsing, but it hung when you reopened it? Is browsing speed still ok?

Next, Double click on OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
• Do Not copy the word CODE
• please note the fix starts with the :

:OTL
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found

:Commands
[Reboot]

Then click the Run Fix button at the top

• Let the program run unhindered

Thanks

I ran code you gave me, but tea timer still didi not appear. Now don't be mad at me. I did something on my own. I went into GLARY utilities and looked at the startup entries. TeaTimer was in there twice, once as enabled and once as disabled. I deleted the entry that said disabled and rebooted. Now I have TeaTimer in the Srartup tray. Hope wat I did was OK. What next?

Hi cherfxst, That's ok as long as you found the problem with Teatimer. It's strange that OTL reported it as running, unless it was just the tray icon that was disabled. No matter, you got it sorted. The fix wasn't for teatimer, it was for a possible search redirect. Your browsing speed still OK and no search redirects?

IE is still hanging quite a it. I had to do a reboot to get IE to work again. Now TeaTimer not in system tray again, but t shows enabled in Glary Utilities. ZoneAlarm was in system tray twice for awhile, but it is only there once now. ZoneAlarm shows up twice in Glary Utilities once as enabled and once a disabled. Don't know if this means anything? The real annoyance for me is IE hanging constantly and some times having to reboot to get IE working again. Also that my notifier in the EBAY toolbar is not working.

Hi cherxst,

You are using IE8. Did IE8 ever work properly or did the problems start after you installed it?

I'm not sure what's happening with your icons. I don't know enough about Glary to say if it could be a problem.


Let's see if we can get a better GMER log. Please run it in Safe Mode.


You may want to copy and paste this next set of instructions into a notepad as you will be in safemode without access to this thread.



Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

• Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop

Please post the log.

Thanks

Yes , I am running IE8 and have hated it ever since I installed it. Don't remember why I didn't like it. Maybe it is when the slow downn started. Really can't remember. I ran GMER in SAFE MODE, the first time, it did not give me a message about ROOTKIT and the log was empty. I ran GMER the second time. I got a pop up ox that stated "GMER hasn't found and System Modifications". The log (gmer.txt) file is blank.

Hi cherfxst, We could uninstall IE8 and see if the browser issues go away. Can you recall if you installed IE8 before you installed Service Pack 3? Thanks

Hi, I'm pretty sure I installed IE8 before SP3.

Hi cherfxst,

If you would like to try uninstalling IE8 to see if at least some problems are resolved, please follow these instructions.

Uninstalling IE8 will revert you back to the last version of IE that you had with your customizations. There is a very slight chance (very remote) that after the uninstall the previous version may not open. That is a fixable condition. Before doing the uninstall, you should download an alternative browser. You can get FireFox from HERE .

If you installed IE8 before you installed SP3, then SP3 will need to be uninstalled first. This can be determined by IE8 not being uninstallable, that is there is no option to uninstall Internet Explorer 8.

To uninstall IE8

• Close all programs.
• Click Start, and then click Control Panel.
• Click Add or Remove Programs.
• In the list of currently installed programs, click Windows Internet Explorer 8, and then click Remove.

If you need to uninstall SP3

• Click Start, and then click Control Panel.
• Click to select the Show Updates check box.
• Click Windows XP Service Pack 3, and then click Remove.
• Click Finish to restart the computer after the removal process is complete.

Sorry it's been so long. I've been very ill. Is all I need to do is down load "Firefox Setup 3.5.5.exe". Then if IE doesn't work double click the Firefox executable and it will be my internet connection?

Hi cherfxst, Hope you are feeling better. Yes, once you double click the Firefox Setup 3.5.5.exe it will install and you will have an alternate browser.

Hi Do you still need help? Thanks

Yes, I still need help. My slow boot seems have gotten better somewhere anlonf the way. Uninstalling IE8 didn't solve my Internet slowness/lock-up, actually they are just as bad if not worse. Should I reinstall IE8? If so, how do I do that? Thanks so much for all your help!

Hi cherfxst,

Hold off on reinstalling IE8, it's still a bit quirky. Let's see if any addons may be causing the problem.

Copy and paste these instructions into a notepad so you can refer to them as you will need to close all browsers.



Make sure all IE browsers are closed

• click the start button,
• highlight all programs,
• highlight accessories,
• highlight System Tools,
• click Internet Explorer (no add ons)

This will lauuch IE without any add ones. You will get a popup notifing you that add ons are disabled.

Any better?

Thanks

Turning off the add on did nothing to help the problem of IE hanging or just be very slow. Well I've walked away for around 5 minutes and come back to no progress, so in my opinion it hung.
Sometimes I can hit the stop button, then hit the refresh button and the page will display right away, not always, but sometimes.
Could the problem be in ZoneAlarm or AVG-Antivirus? Both are the free editions.

I hope you like a challange, because this one has me pulling my hair out.