What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] finding dakeyras.

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I am very new at this and hope you can help. I have had a large number of problems of late with my computer going slow. I have gone to registry smart who have come in through logmein and fixed problems, however some days later it goes back to the slow process. It used to always be fast and of late I am experiencing these problems. I have just done another Hijack this and hopefully I can work out how to attach to this for inspection. It might be pointed out that about the time I had a slow computer problem it was when I started the computer some weeks ago and I had and continue to get a screen full of directions but at the top it says "Hardware Profile. Conf….. Recovery menu" and then it asks to click on Profile 1 or 2 and further down there are insstructions re. press F something or similar. Could this be removed and the computer just open up to Dell and Windows as it normally did. I have a Dell optiplex GX 270 Windows Professional XP. Hoping someone can help, Many thank.s

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:41:36, on 17/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hiro-Media\HiroClient\HiroClient.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\RegistrySmart\RegistrySmart.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Hiro-Media Client.lnk = C:\Program Files\Hiro-Media\HiroClient\HiroClient.exe
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9f40b597695f2) (gupdate1c9f40b597695f2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 3500 bytes

Attachments:

Post #2
Hi. :)

Having read what you have posted specifically this:-

I have gone to registry smart who have come in through logmein and fixed problems

Plus what my research of the HijackThis Log provided. You have been conned and entirely possible now your computer is compromised. :(

My advice is you disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Although an attempt could be made to clean this machine, it could never be considered to be truly clean, secure, or trustworthy. We could not say definitively that unknown and unseen malware will have been removed, nor will your system be restored to its pre-infection state. We cannot remedy unknown changes the malware may likely have made in order to allow itself access, nor can we repair the damage it may possibly have caused to vital system files. Additionally, it is quite possible that changes made to the system by the malware may impact negatively on your computer during the removal process. In short, your system may never regain its former stability or its full functionality without a reformat. Therefore, your best and safest course of action is a reformat and reinstallation of the Windows operating system, and that is the course we strongly recommend.

Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

I can attempt to clean this machine but I can't guarantee that it will be at all secure afterwords.

Should you have any questions, please feel free to ask.

Please let myself know what you have decided to do in your next post.
Post #4 last edited
DAKEYRAS, was good enough to come into my post and give advice, but unfortunately I am still learning how to use this site. It was in relation to computer freezing and the fact that I have a very serious virus. Dakeyras was giving advice and attempting to help however I lost contact because of my lack of experience with this type of work, hoping I can get back to him and in turn he is prepared to agazin give me suitable advice. I would like to get rid of the virus, but I do not know how to remove my files to disc and safely storee and then re install windows XP. I do not even know if the disc I have will in fact reinstall after I have, if I can, cleaned my computer. This disc is labelled OPERATING SYSTEM ALREADY INSTALLED ON YOUR COMPUTER. Reinstallation CD Microsoft Windows XP Professional Including Service pack 1a Then down the side of the disc, (which is put out by DELL) are the words The software is already installed on your computer. Only use this CD to reinstall the software. Only use this CD to reinstalll the operating system on a Dell computer. This CD is not for reinstallation of programs or drivers. My computer is a Dell GX270 Pentrium 4 Microsoft Windows XP Professional. Version 2002 Service Pack 3. 2,8Ghz 512 mb. When I opened my computer, then properties the disc shows I still have 50% of available disc space. Hoping yhou can help. Many thanks. Norm
Post #6
Hi. :)

OK if not aware to post a reply to this topic:-

Click on ADD REPLY button, type what you wish to inform myself then click on the Add Reply button.

———

So we are clear from how I understand your last post. You would like to know how to create any backups of both files and documents.

Then specific advice how to perform the actual a reformat and reinstallation of the Windows operating system.

Afterwards how to install the drivers required and then update the system accordingly and advice on what security applications to install once completed?

Let myself know if this is indeed what you want and my prior advice about this being the most prudent course of action still stands.
Post #7
Dakeyras, I certainly am very keen to follow any suggestions you may have. I would really like to get rid of this problem and await your reply. Many thanks.
Post #8 last edited
Hi. :)

Dakeyras, I certainly am very keen to follow any suggestions you may have. I would really like to get rid of this problem and await your reply. Many thanks.

OK and you are very welcome!

It may prove beneficial if you print of the following instructions or save them to notepad.

If you have not done so please carry out my prior advice:-

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Backup Advice:

Any Documents, files, folders and Pictures etc I suggest you create copies of them and save the aforementioned to a form of removable media. Such as a USB Flash Drive and or a CDR/DVDR.

If you are going to use a Flash Drive as a precaution carry out the below first:-

Flash_Disinfector:
  • Please download Flash_Disinfector and save it to your desktop.
  • Double click to run it.
  • You will be prompted to plug in your flash drive. Plug it in.
  • Flash_Disinfector will start disinfecting your flash and hard drives. This takes a few seconds. Your desktop will disappear in the meantime.
  • When done, a message box will appear. Click OK. Your desktop should now appear. If it doesn't, press Ctrl + Shift + Esc to open Task Manager.
  • Click on File > New Task (Run…). Type in explorer.exe and press Enter. Your desktop should now appear.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

Next:

Now for the actual reformat and reinstallation of the Windows operating system. The below tutorial is very good and you should encounter no problems following the procedure:-

How to Reformat and Reinstall your Operating System

The above also includes backup advice also.

Next:

Install the Dell Drivers, hopefully you should have a CD called Dell OptiPlex(GX270) ResourceCD or similar.

This Dell tuturial explains in full how to use the aforementioned.

If you do not have a Resource CD, all relevant drivers for your machine make/modal can be found here, downloaded and installed.

Next:

Below is some advice about what to install/safety advice after the format and the reinstallation of the Windows operating system.

Reformat and Reinstallation Advice:

This is a excellent resource I recommend reading:-

How to prevent Malware

  • Use an Anti Virus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
    Here are some free Anti Virus programs which I recommend to use:
    • Antivir PersonalEditionClassic
      • Free anti-virus software for Windows.
      • Detects and removes more than 50,000 viruses. Free support.
    • avast! 4 Home Edition
        • Anti-virus program for Windows.
        • The home edition is freeware for noncommercial users.
    • Update your Anti Virus Software - It is imperative that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.
    • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly.
      Here are some free Firewalls which I recommend to use:
      (Use only one, and disable your Windows Firewall)
    Note: Only ever have installed/use one Anti-Virus application and Software Firewall. Otherwise a system conflict will occur and this also lessens overall online protection!
  • Keep your system updated- Microsoft releases patches for Windows and other products regularly:
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialise and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Malwarebytes' Anti-Malware - Download it from here
    The tutorial on how to use MBAM is located here
  • Install WinPatrol - Download it from here
    You can find information about how WinPatrol works here
  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
    Download it from here
    The tutorial on how to use Spyware Blaster is located here
  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Importance of Regular System Maintenance:

I advice you read both of the below listed topics as this will go a long way to keeping your Computer performing well after the format and the reinstallation of the Windows operating system.

Help! My computer is slow!

Also so is this:

What to do if your Computer is running slowly

Advised Optional update:

There is a new service pack for XP, namely SP3. I advise you download/install this as it will increase the security side of your system.

Download can be found here or the CD ordered for your country here <–scroll down to and click on 'How to obtain Windows XP Service Pack 3 on a CD'

Please read this Microsoft article before actually installing the aforementioned service pack.

Next:

Follow the above and the potential for your computer becoming infected again will reduce dramatically. Any questions feel free to ask OK!
Post #9
Dakeyras. Many many thanks for gettingback to me and all of the work you hve put into this. I really am very grateful. I will be attempting to do this in the next few hours and ask just one further favour. I do not know how to save and then move to a drive, or what size flash drive I need to store th majority of my files and folders. Sorry for my lack of computer knowledge but I can assure uyou Icertainly appreciate all you have done for me so far. Many thanks again. Hoping you can advise me on copyhing and storing to flash drive. Many thanks.
Post #10
Hi. :)

Dakeyras. Many many thanks for gettingback to me and all of the work you hve put into this. I really am very grateful.

You are very welcome!

I will be attempting to do this in the next few hours and ask just one further favour. I do not know how to save and then move to a drive, or what size flash drive I need to store th majority of my files and folders. Sorry for my lack of computer knowledge but I can assure you Icertainly appreciate all you have done for me so far. Many thanks again. Hoping you can advise me on copyhing and storing to flash drive. Many thanks.

OK no problem and no need to apologise I assure you. I am great advocate of the the adage(or similar) If you do not know something and or unsure……ask! :thumbup:

———-

Well I am guessing your machine does not have a CD Burner drive installed hence the option for Flash Drives.

The aforementioned are comparatively cheap these days to very expensive:-

USB Flash Drives <– There may be actual cheaper stores in your locale.

Capacity wise anything from 1GB to say 4GB may suffice and or a larger capacity drive and or a combination of several smaller drives to keep down the cost etc.

As to actually carry out the transfer the below article is well written:-

How to Use a Flash Drive to Transfer Files

This is also reasonably user friendly and provides similar tutorials also:-

How to Transfer Data Using a Flash Drive
Post #11
Dakeyras. I sincerely thank you for all you have done here. It all looks a little confusing, but as you have taken so much time to recommend so many sites for help on the way through, I think I can do it. Unfortunately because of work I will not be able to have a real go now for a few days, but I wincerely thank you for being so informative and extremely pleasant during all of this, even with a great deal of patience. Many Many thanks and please wish me luck. Thank you again,.
Post #12
Hi. :) OK, you are very welcome and a pleasure to be of assistance! I will leave this topic open for three days in-case you have any further questions. Good luck and stay safe!
Post #13
Dakeyras. I have spent quite a few hours looking over the invaluable information and sites you have relayed to me. I have discussed it with a mate and he too is a little lost as to how to follow. I have purchased a 8gb flash drive and inserted and did the disinfect site you suggested, however I dont believe I would be competent enough to do the full clean and reformat and reprogarm of this computer. I am sorry for any inconvenience I have caused you and do sincerely appreciate what you have done. I was hoping however, that maybe, as sstated in your first reply where you said "I can attempt to clean this machine but I cant guarantee that it will be at all secure afterwards". My friend tells me that because of the fact that nothing appears to have gone into my banking account and other sensitive sites, a clean might be all I would need at this present time and I am hoping you could let meknow how that is done. Many Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI