What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] URGENT NEED OF HELP ! ASAP !

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

Please do the following:

  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\windows\system32\2d40c3ce.dll

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

Do the same for this file:

c:\windows\system32\1346e6fb.dll

NEXT


There are quite a number of randomly numbered folders in your C:\ drive:


C:\b396888e8efb1f82d5dbf972
C:\90992dab30b4c6aa50
C:\023929d22b5d977facb99b
C:\66d070a74d175702e2f9c909b75641
C:\1eca5aa21e3f21db9c1e9ce3d2454c
C:\69c0ef23a8b0fd618c96
C:\b91c9bb5d6740375cb40
c:\windows\system32\2d40c3ce.dll
c:\windows\system32\1346e6fb.dll
C:\016e542d71cc43e8c392
C:\cf4ab8911476893ea136986618e3191e
C:\e4883f89a4294536a81823bd04
C:\d6d7136eeb202a5d8bd3e52268ed9f
C:\df13a6ec3d8b0a55b63a710f027870b5
C:\189e0920529fce5027
C:\31dad707141606f800a5
C:\8a2e454bdc4dddcc1447e6
C:\111c9c889179d6726dc1
C:\9716aa70a285fa1bfd6c34eb27794a9d
C:\bc134a2a3b32596f824c8a873a
C:\3aa907f551931343c2b664
C:\9757662d5d71e266fb9179070cf5f30e
C:\88d329bd30fdeb8da0
C:\6e920d2ffbd97dc5f075b8c436dfd9
C:\f1d6e81042b7f9c98990
C:\093c30021b133087bd5e
C:\f2ae3c43587ec4fe7d8bb6
C:\0f88983144f378f0c9196da97a930eec
C:\2abc3de27138c7d2fe0c00


These are often created by windows updates, but I don't usually see so many, so I am suspicious of them.

Please navigate to a few of the folders and see if they contain files, what type of files (don't try and open anything - just look)and what size are the folders


if they are not too huge, I will use a tool that can take a look at the files inside, but sometimes if they are legit MS updates, they can be huge.
Post #17
Ok for the Copy To Clip Board thing I scanned then pressed copy to clip board but what is suppose to happen how do I get you the results ? And for the files in my C:\ they all contain files they look like they all contain the same exact one Maybe this can help about a week and a half ago my windows installed an update that made my cpu keep restarting I system restored and it solved the problem but those folders stayed I did not want to mess with them in fear it might mess up my PC hope that helps
Post #18 last edited
Hi, once you copy to clipboard…then you open a reply window like this one > right click and choose paste - the results should paste in could you please copy/paste the file that is in one of those folders, thanks
Post #19 last edited
c:\windows\system32\2d40c3ce.dll

VirSCAN.org Scanned Report :
Scanned time : 2010/04/16 18:00:05 (EDT)
Scanner results: Scanners did not find malware!
File Name : 2d40c3ce.dll
File Size : 82944 byte
File Type : PE32 executable for MS Windows (DLL) (console) Intel 80386 3
MD5 : 2ed0b7f12a60f90092081c50fa0ec2b2
SHA1 : 245c2caabb9ee68c8684e3b3578f527e0702da5e
Online report : http://virscan.org/report/1c5ab6de81bf5354…0b243f7109.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20100417000147 2010-04-17 4.66 -
AhnLab V3 2010.04.17.00 2010.04.17 2010-04-17 1.10 -
AntiVir 8.2.1.220 7.10.6.115 2010-04-16 0.25 -
Antiy 2.0.18 20100412.4183175 2010-04-12 0.12 -
Arcavir 2009 201004161824 2010-04-16 0.04 -
Authentium 5.1.1 201004161205 2010-04-16 1.56 -
AVAST! 4.7.4 100416-1 2010-04-16 0.02 -
AVG 8.5.720 271.1.1/2815 2010-04-17 0.23 -
BitDefender 7.81008.5656081 7.31241 2010-04-17 3.81 -
ClamAV 0.95.3 10753 2010-04-17 0.03 -
Comodo 3.13.579 4618 2010-04-16 0.86 -
CP Secure 1.3.0.5 2010.04.17 2010-04-17 0.05 -
Dr.Web 5.0.2.3300 2010.04.17 2010-04-17 11.52 -
F-Prot 4.4.4.56 20100416 2010-04-16 1.47 -
F-Secure 7.02.73807 2010.04.16.07 2010-04-16 10.81 -
Fortinet 4.0.14 11.702 2010-04-15 0.22 -
GData 19.11013/19.890 20100416 2010-04-16 7.10 -
ViRobot 20100416 2010.04.16 2010-04-16 0.43 -
Ikarus T3.1.01.80 2010.04.16.75646 2010-04-16 6.18 -
JiangMin 13.0.900 2010.04.15 2010-04-15 1.35 -
Kaspersky 5.5.10 2010.04.16 2010-04-16 0.13 -
KingSoft 2009.2.5.15 2010.4.16.18 2010-04-16 0.72 -
McAfee 5400.1158 5952 2010-04-15 0.02 -
Microsoft 1.5605 2010.04.16 2010-04-16 7.14 -
Norman 6.04.11 6.04.00 2010-04-16 6.01 -
Panda 9.05.01 2010.04.16 2010-04-16 2.46 -
Trend Micro 9.120-1004 7.106.05 2010-04-16 0.03 -
Quick Heal 10.00 2010.04.16 2010-04-16 1.55 -
Rising 20.0 22.43.04.04 2010-04-16 1.32 -
Sophos 3.06.0 4.52 2010-04-17 3.44 -
Sunbelt 3.9.2418.2 6184 2010-04-16 6.15 -
Symantec 1.3.0.24 20100416.003 2010-04-16 0.05 -
nProtect 20100416.01 8000093 2010-04-16 8.01 -
The Hacker 6.5.2.0 v00263 2010-04-16 0.40 -
VBA32 3.12.12.4 20100414.2102 2010-04-14 2.92 -
VirusBuster 4.5.11.10 10.124.15/2028071 2010-04-16 2.39 -


—————
c:\windows\system32\1346e6fb.dll


VirSCAN.org Scanned Report :
Scanned time : 2010/04/16 18:03:00 (EDT)
Scanner results: Scanners did not find malware!
File Name : 1346e6fb.dll
File Size : 82944 byte
File Type : PE32 executable for MS Windows (DLL) (console) Intel 80386 3
MD5 : 2ed0b7f12a60f90092081c50fa0ec2b2
SHA1 : 245c2caabb9ee68c8684e3b3578f527e0702da5e
Online report : http://virscan.org/report/4dbff895dcfaaff2…7d0a4b7f9b.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20100417060122 2010-04-17 5.85 -
AhnLab V3 2010.04.17.00 2010.04.17 2010-04-17 1.38 -
AntiVir 8.2.1.220 7.10.6.115 2010-04-16 0.27 -
Antiy 2.0.18 20100412.4183175 2010-04-12 0.12 -
Arcavir 2009 201004161824 2010-04-16 0.04 -
Authentium 5.1.1 201004161205 2010-04-16 1.47 -
AVAST! 4.7.4 100416-1 2010-04-16 0.01 -
AVG 8.5.720 271.1.1/2815 2010-04-17 0.23 -
BitDefender 7.81008.5656081 7.31241 2010-04-17 3.62 -
ClamAV 0.95.3 10753 2010-04-17 0.02 -
Comodo 3.13.579 4618 2010-04-16 0.88 -
CP Secure 1.3.0.5 2010.04.17 2010-04-17 0.05 -
Dr.Web 5.0.2.3300 2010.04.17 2010-04-17 6.72 -
F-Prot 4.4.4.56 20100416 2010-04-16 1.44 -
F-Secure 7.02.73807 2010.04.16.07 2010-04-16 10.75 -
Fortinet 4.0.14 11.702 2010-04-15 0.17 -
GData 19.11013/19.890 20100416 2010-04-16 6.68 -
ViRobot 20100416 2010.04.16 2010-04-16 0.41 -
Ikarus T3.1.01.80 2010.04.16.75646 2010-04-16 5.78 -
JiangMin 13.0.900 2010.04.15 2010-04-15 1.21 -
Kaspersky 5.5.10 2010.04.16 2010-04-16 0.12 -
KingSoft 2009.2.5.15 2010.4.16.18 2010-04-16 0.65 -
McAfee 5400.1158 5952 2010-04-15 0.02 -
Microsoft 1.5605 2010.04.16 2010-04-16 0.14 -
Norman 6.04.11 6.04.00 2010-04-16 4.01 -
Panda 9.05.01 2010.04.16 2010-04-16 2.50 -
Trend Micro 9.120-1004 7.106.05 2010-04-16 0.03 -
Quick Heal 10.00 2010.04.16 2010-04-16 1.52 -
Rising 20.0 22.43.04.04 2010-04-16 1.09 -
Sophos 3.06.0 4.52 2010-04-17 3.45 -
Sunbelt 3.9.2418.2 6184 2010-04-16 4.94 -
Symantec 1.3.0.24 20100416.003 2010-04-16 0.05 -
nProtect 20100416.01 8000093 2010-04-16 7.50 -
The Hacker 6.5.2.0 v00263 2010-04-16 0.39 -
VBA32 3.12.12.4 20100414.2102 2010-04-14 2.93 -
VirusBuster 4.5.11.10 10.124.15/2028071 2010-04-16 2.41 -

—-

And for the Copy/Pasting of the file where do you want me to copy/paste it to ?

EDIT : Theres something called hotfix installer
Post #20
Hi,

Please do the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.




NEXT



Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #22
No,

Actually, I would strongly suggest uninstalling IOBIT, it is considered a rogue security program:

IOBit has been accused by Malwarebytes of illegally using their intellectual property without permission.
Please see this for additional information on these allegations: http://www.malwarebytes.org/forums/index.php?showtopic=29681.
Additionally, both WOT and SiteAdvisor have flagged IOBit’s site.

A thread in the IOBit’s forum responded to the accusations from MalwareBytes.
It is noteworthy that several responses from users raising specific questions about IOBit’s response and finding it unsatisfactory were deleted and the thread was closed.
The bottom line from IOBit was:“No hard proof shows that IObit stole database of Malwarebytes.”

At least until the issues of possible database theft and spyware packaging is resolved, I would recommend against the use of IOBit products.
Post #24
Malwarebytes:

run this tool as well:

Download Security Check from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Post #25
Can I get a link to MalwareBytes please ?(:
Heres the log for security check

Results of screen317's Security Check version 0.99.3
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java™ 6 Update 7
Out of date Java installed!
Adobe Flash Player 10
````````````````````````````````
Process Check:
objlist.exe by Laurent
````````````````````````````````
DNS Vulnerability Check:
Request Timed Out (Wireless Internet connection/Disconnected Internet/Proxy?)

``````````End of Log````````````
Post #28
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3999

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

4/16/2010 7:41:40 PM
mbam-log-2010-04-16 (19-41-40).txt

Scan type: Quick scan
Objects scanned: 118605
Time elapsed: 2 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\andrew\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

———-

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, April 16, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, April 16, 2010 21:19:19
Records in database: 3948999
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Objects scanned: 41358
Threats found: 2
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 00:44:27


File name / Threat / Threats count
C:\Program Files\COMODO\COMODO Internet Security\Quarantine\ave.exe Infected: Packed.Win32.Katusha.j 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\iaStor.sys.vir Infected: Rootkit.Win32.Tdss.ai 1

Selected area has been scanned.

———-

My computer seems to be running as if there was never any virus , XP Secuirty virus hasnt showed up since yesterday when I ran the scans you told me to , everything sounds and is running normal no slow downs or anything (:
Post #29
Good,

Just some housekeeping to do now:

You need to update to the latest service pack (SP3) and the latest Internet Explorer (IE8) Please visit windows updates

NEXT

Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 20 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 20 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u20 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


NEXT


Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

If any logs/tools remain on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    It's normal after running TFC cleaner that the PC will be slower to boot the first time.



    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox, IE and chrome.


  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #30
I have a question last time I updated the Windows update kept restarting my computer after 20~30seconds being logged into an account will this do this ? And thank you very much CatByte for your very quick and fast replies they definitly helped

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI