What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

browser hijacking and trojan virus

47 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31 last edited
Hello JonTom I was able to go into BIOS (F1), but found out that I needed to use ESC key to enter the boot menu - did that, Saw the options hard drives or cruzer (UBS memory stick) choose cruzer. Saw some activity. XxPUD program poped up - chose FILE. went to MNT expanded it looked in sda1 and sda 2 and sdb1 all of the files were from a hard drive. I have added an extra hard drive about a year ago. The files in sbd1 looked to be those files. I looked in many other folders and could not find Dumpit in any. Where might be a good place to look considering that I added a extra hard drive. I tried the search file system for dumpit - but is started to look on my main hard drive, not the memory stick, so I canceled that. then I chose turn machine off. Restarted computer - it came back on as usual. I looked again through all folders on xPUD could not Dumpit. Could I put Dumpit on my Local Disk K: - which as far as i know has never been infected, and run dumpit from there, through xPUD? Would it produce the log file that you are interested in? What now? Boffo
Post #32
Hello boffo123

Lets try it manually:


  • Boot the infected computer with your USB drive as before.
  • Follow the prompts.
  • The Welcome to xPUD screen will appear.
  • Click on File.
  • Expand mnt.
  • sda1 or sda2 will usually correspond to your HDD.
  • Expand the folder that corresponds to your harddrive.
  • Press Tool on the top menu bar.
  • Choose Open Terminal
  • Type dd if=/dev/sda of=mbr.bin bs=512 count=1

This will place a back-up of your MBR on your harddrive. It will be called C:/mbr.bin


Now exit > Home > reboot (remove the USB drive so your computer will boot normally)


Now scan the MBR Dump at Virus total


  • Please scan the following


  • Please visit Virus Total by clicking here.
  • Use the browse button on that page to navigate to the location of the file to be scanned.
  • In the right hand panel,
  • click on the file C:/mbr.bin
  • Then click the open button.
  • The file will now be displayed in the submit box.
  • Scroll down a bit and click "send file", wait for the results
  • If you get a message saying File has already been analyzed: click Reanalyze file now
  • Once scanned, copy and paste the link to the results page in your next reply.
  • Also zip C:/mbr.bin and upload that file here.
Post #34
Hello boffo123

I am going to request that some experts check out your MBR uploads.

Thank you for your patience. I will get back to you as soon as I can.
Post #35
Hello boffo123

In the meantime, please do the following:


  • Please run the following batch file


  • Copy and Paste the text in the code box below into Notepad

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

  • Save this as flush.bat to your desktop.
  • You will see an icon on your desktop called flush.bat
  • Double click on it to run (Note: Vista and Win 7 users need to right click and choose to "Run as Administrator").
  • The computer will reboot itself.

After the reboot please let me know if you are stuill being redirected and post a new DDS log in your reply :)
Post #36 last edited
Hello JonTom I ran the flush.bat file. I did it twice, because my antivirus program popped open the first time and asked me about a one time change in something - I disabled it the second time. It produced a file called ALL. I went online and so far was not re-directed. I ran SAS afterward and it found nothing on quick scan. But, after being on the internet for a few minitues, I scaned with SAS again and found the same Rogue.agent/GEN - Nullo[dll] virus. Here is the DDS log DDS (Ver_10-12-12.02) - NTFSx86 Run by [removed] at 14:26:42.15 on Wed 02/09/2011 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3006.2493 [GMT -6:00] AV: McAfee VirusScan *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: Norton Internet Worm Protection *Disabled* FW: McAfee Personal Firewall *Enabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE svchost.exe C:\WINDOWS\arservice.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\Explorer.EXE C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\Rundll32.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe c:\Program Files\Microsoft Works\WksWP.exe c:\Program Files\Microsoft Works\WkDStore.exe c:\Program Files\Microsoft Works\wkgdcach.exe c:\PROGRA~1\mcafee\msc\mcshell.exe C:\Documents and Settings\HP_Administrator\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 uStart Page = hxxp://www.tvguide.com/listings/ uInternet Settings,ProxyOverride = 127.0.0.1 BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll BHO: UberButton Class: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll BHO: YahooTaggedBM Class: {65d886a2-7ca7-479b-bb95-14d1efb7946a} - c:\program files\yahoo!\common\YIeTagBm.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: hpWebHelper Class: {aaae832a-5fff-4661-9c8f-369692d1dcb9} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\WebHelper.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5825.1100\swg.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [P17Helper] Rundll32 P17.dll,P17Helper mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [McENUI] c:\progra~1\mcafee\mhn\McENUI.exe /hide mRun: [Google Quick Search Box] "c:\program files\google\quick search box\GoogleQuickSearchBox.exe" /autorun mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\docume~1\hp_adm~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\hp_adm~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\npjpi160_23.dll IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1195591567296 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} - hxxps://ediagnostics.lexmark.com/serval.cab DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ============= SERVICES / DRIVERS =============== R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-3-25 214664] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 66632] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-5-18 93320] R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-5-18 359952] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-5-18 144704] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-5-18 79816] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-5-18 35272] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-5 135664] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-5-18 34248] S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-5-18 40552] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872] S4 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2008-10-28 156968] S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-5-18 606736] =============== Created Last 30 ================ 2011-02-08 12:40:44 512 ——w- C:\mbr.bin 2011-02-05 16:26:21 0 –sh–w- c:\windows\SEFC0C0D5.tmp 2011-02-03 02:05:40 ——– d—–w- C:\_OTL 2011-02-02 18:24:27 ——– d-sha-r- C:\cmdcons 2011-02-02 18:19:22 98816 —-a-w- c:\windows\sed.exe 2011-02-02 18:19:22 89088 —-a-w- c:\windows\MBR.exe 2011-02-02 18:19:22 256512 —-a-w- c:\windows\PEV.exe 2011-02-02 18:19:22 161792 —-a-w- c:\windows\SWREG.exe 2011-02-01 15:50:53 ——– d—–w- C:\otl scanner antivirus 2011-02-01 00:02:02 ——– d—–w- C:\Combofix newest and documents and err message pics 2011-01-31 16:00:56 ——– d—–w- C:\DDS newest 2011-01-31 15:59:15 ——– d—–w- C:\gmer new 2011-01-31 02:06:29 ——– d—–w- C:\Anti-virus Hijackthis log analized pic 2011-01-30 22:33:25 ——– d—–w- C:\HiJackThis newest 2011-01-30 04:23:40 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-30 04:23:35 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-01-30 04:23:35 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-01-27 21:13:36 ——– d—–w- C:\K-lite codec pack 6.6.2 2011-01-27 21:07:18 ——– d—–w- c:\program files\common files\Data 2011-01-27 21:01:48 197632 —-a-w- c:\program files\common files\OnlineFilesManager.dll 2011-01-26 20:06:10 ——– d—–w- C:\RAW Workflow from Capture to Archives A Complete Digital Photographer's Guide to Raw Imaging extracted 2011-01-25 20:05:02 ——– d—–w- C:\7 zip software 2011-01-25 19:37:02 ——– d—–w- C:\Rar archive 2011-01-22 04:19:16 ——– d—–w- c:\windows\system32\XPSViewer 2011-01-22 04:18:50 89088 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll 2011-01-22 04:18:28 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2011-01-22 04:18:28 597504 ——w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe 2011-01-22 04:18:28 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2011-01-22 04:18:28 575488 ——w- c:\windows\system32\xpsshhdr.dll 2011-01-22 04:18:28 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll 2011-01-22 04:18:28 1676288 ——w- c:\windows\system32\xpssvcs.dll 2011-01-22 04:18:28 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll 2011-01-22 04:18:28 117760 ——w- c:\windows\system32\prntvpt.dll 2011-01-22 03:55:11 ——– d—–w- c:\windows\ie8updates 2011-01-22 03:29:23 974848 ——w- c:\windows\system32\dllcache\mfc42.dll 2011-01-22 03:29:23 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll 2011-01-22 03:26:18 81920 ——w- c:\windows\system32\dllcache\fontsub.dll 2011-01-22 03:26:18 119808 ——w- c:\windows\system32\dllcache\t2embed.dll 2011-01-22 03:24:21 617472 ——w- c:\windows\system32\dllcache\comctl32.dll 2011-01-22 03:24:02 40960 ——w- c:\windows\system32\dllcache\ndproxy.sys 2011-01-22 03:23:49 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe 2011-01-22 03:23:36 471552 ——w- c:\windows\system32\dllcache\aclayers.dll 2011-01-22 03:23:21 247808 ——w- c:\windows\system32\dllcache\ieproxy.dll 2011-01-22 03:23:21 12800 ——w- c:\windows\system32\dllcache\xpshims.dll 2011-01-22 03:23:19 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll 2011-01-22 03:20:59 153088 ——w- c:\windows\system32\dllcache\triedit.dll 2011-01-22 03:16:24 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe 2011-01-22 03:10:54 45568 ——w- c:\windows\system32\dllcache\wab.exe 2011-01-22 03:10:20 590848 ——w- c:\windows\system32\dllcache\rpcrt4.dll 2011-01-20 21:03:31 ——– d—–w- C:\ASPI Programs dvdfab out of date 2011-01-19 20:06:01 ——– d—–w- C:\Temp 2011-01-19 20:02:03 335872 —-a-w- c:\windows\system32\dvdauthor.ocx 2011-01-19 20:02:03 266240 —-a-w- c:\windows\system32\VideoEdit.ocx 2011-01-19 20:02:03 233472 —-a-w- c:\windows\system32\viscomdvdimg.dll 2011-01-19 20:02:03 2078952 —-a-w- c:\windows\system32\starburnx.dll 2011-01-19 20:02:01 ——– d—–w- c:\program files\Cheetah Burner 2011-01-19 16:32:09 ——– d—–w- C:\Pic Camera 9 2011-01-19 00:21:06 ——– d—–w- c:\windows\system32\wbem\repository\FS 2011-01-19 00:21:06 ——– d—–w- c:\windows\system32\wbem\Repository 2011-01-18 20:23:09 ——– d—–w- c:\program files\Nero 2011-01-18 20:22:43 ——– d—–w- c:\docume~1\alluse~1\applic~1\Nero 2011-01-18 20:22:12 ——– d—–w- c:\program files\Ask.com 2011-01-16 06:32:43 ——– d—–w- c:\program files\DVDFab 5 2011-01-16 01:44:51 ——– d—–w- c:\program files\Elaborate Bytes 2011-01-14 04:47:00 ——– d—–w- c:\docume~1\hp_adm~1\locals~1\applic~1\1Click DVD Copy 2011-01-14 04:39:26 ——– d—–w- c:\docume~1\alluse~1\applic~1\1click dvd copy 2011-01-14 04:38:54 ——– d—–w- c:\program files\LG Software Innovations 2011-01-14 02:59:20 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys 2011-01-14 02:59:20 47360 —-a-w- c:\docume~1\hp_adm~1\applic~1\pcouffin.sys 2011-01-14 02:59:14 65602 —-a-w- c:\windows\system32\cook3260.dll 2011-01-14 02:59:14 626688 —-a-w- c:\windows\system32\vp7vfw.dll 2011-01-14 02:59:14 217127 —-a-w- c:\windows\system32\drv43260.dll 2011-01-14 02:59:14 208935 —-a-w- c:\windows\system32\drv33260.dll 2011-01-14 02:59:14 176165 —-a-w- c:\windows\system32\drv23260.dll 2011-01-14 02:59:14 1645320 —-a-w- c:\windows\gdiplus.dll 2011-01-14 02:59:14 1184984 —-a-w- c:\windows\system32\wvc1dmod.dll 2011-01-14 02:59:13 ——– d—–w- c:\program files\VSO 2011-01-14 02:55:17 ——– d—–w- C:\Convert x to DVD 3.0 2011-01-13 17:21:36 ——– d—–w- c:\documents and settings\hp_administrator\.dvdcss 2011-01-13 01:47:20 ——– d—–w- c:\docume~1\hp_adm~1\applic~1\AnvSoft 2011-01-13 01:47:17 ——– d—–w- c:\program files\AnvSoft 2011-01-12 15:23:06 ——– d—–w- C:\Adobe Lightroom 3 book ==================== Find3M ==================== 2010-11-18 18:12:44 81920 —-a-w- c:\windows\system32\isign32.dll 2010-11-13 00:53:06 472808 —-a-w- c:\windows\system32\deployJava1.dll 2010-11-12 22:34:10 73728 —-a-w- c:\windows\system32\javacpl.cpl ============= FINISH: 14:27:44.59 =============== Boffo
Post #37
Hello boffo123

Lets try the following:

  • Open notepad again and copy/paste the text in the codebox below into it:

    ipconfig /all>log.txt
ping google.com>>log.txt
ping 74.125.47.103>>log.txt
route print>>log.txt
start notepad log.txt
  • Save this as peek.bat. Choose to "Save type as - All Files".
  • Double click on peek.bat & allow it to run.
  • A notepad file will open. Copy that information into your next reply, please.
Post #38 last edited
Hello JonTom I am still being re-directed, have to sign in everytime I go on the internet, even tho I check keep me signed in for weeks. Here is the peek.log Windows IP Configuration Host Name . . . . . . . . . . . . : your-4dacd0ea75 Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Local Area Connection: Media State . . . . . . . . . . . : Media disconnected Description . . . . . . . . . . . : Realtek RTL8139/810x Family Fast Ethernet NIC Physical Address. . . . . . . . . : 00-16-17-57-47-5A Ping request could not find host google.com. Please check the name and try again. Pinging 74.125.47.103 with 32 bytes of data: Destination host unreachable. Destination host unreachable. Destination host unreachable. Destination host unreachable. Ping statistics for [removed]: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), =========================================================================== Interface List 0x1 ……………………… MS TCP Loopback interface 0x2 …00 16 17 57 47 5a …… Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport =========================================================================== =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 255.255.255.255 255.255.255.255 255.255.255.255 2 1 =========================================================================== Persistent Routes: None _____ I was getting runtime errors messages sometimes when using windows media player and windows explorer would close, now media player sometimes just does not respond or freezes when trying to view some videos that work fine on my other computer. Right now as I type Windows explorer is giving a error message = "Windows explorer has encountered a problem and needs to close. If you were in the middle of something, the information you were working on might be lost" two boxes/choises debug or close. I see this a lot - sometimes when running SAS of McAfee scan. SAS still finds the same virus after being online. The virus seems to rejuvinate itself after I go on line everytime. Boffo
Post #39
Hello boffo123

Thank you for the logs.


  • Please work through the following steps


  • Reboot your machine and when the boot Menu flashes up, select "Microsoft Windows Recovery Console".
  • Note you will need to be very quick with the arrow key as you only have a couple of seconds before it defaults to the windows XP bootup.

[external image: Posted Image]

[external image: Posted Image]

  • When you get to the above screen, take note of the number that references your operating system.
  • If it's '1' like the picture above, type 1 and press Enter.

[external image: Posted Image]

  • Next, type FIXMBR

[external image: Posted Image]

  • If it asks if you're sure you want to write a new MBR, answer 'Y'.
  • Then type EXIT to reboot the machine.

Once you have completed the above let me know how the machine is running :)
Post #40
Hello JonTom



Everything went as you described it would in your instructions.
Right after the reboot the computers performance seemed to improve.
Win Media player did not freeze up.
But, as soon as I went online I was redirected, had to sign on/login every time I go online.
I ran SAS right after being online and same virus ( Rogue.agent/GEN - Nullo[dll] ) shows back up.


Now, on the infected computer I cannot access this web site: http://forums.whatthetech.com/index.php?showtopic=116902 This is new. I am posting this from my uninfected computer. I am able to go to other sites.

Boffo
Post #41
Hello JonTom



Everything went as you described it would in your instructions.
Right after the reboot the computers performance seemed to improve.
Win Media player did not freeze up.
But, as soon as I went online I was redirected, had to sign on/login every time I go online.
I ran SAS right after being online and same virus ( Rogue.agent/GEN - Nullo[dll] ) shows back up.


Now, on the infected computer I cannot access this web site: http://forums.whatthetech.com/index.php?showtopic=116902 This is new. I am posting this from my uninfected computer. I am able to go to other sites.

Boffo
Post #42 last edited
Hello JonTom

Everything went as you described it would in your instructions.
Right after the reboot the computers performance seemed to improve.
Win Media player did not freeze up.
But, as soon as I went online I was redirected, had to sign on/login every time I go online.
I ran SAS right after being online and same virus ( Rogue.agent/GEN - Nullo[dll] ) shows back up.


Now, on the infected computer I cannot access this web site: http://forums.whatthetech.com/index.php?showtopic=116902 This is new. I am posting this from my uninfected computer. This must have been a temporary thing, I am able to go there now. I was able to go to other sites.

Adobe reader just popped open for no reason.

The Windows Explored debug/close error box just popped open again.

The virus seems to rejunivate it self when I go online. I seem to hear more hard drive activity than I should when I go online

Boffo
______
Post #43
Hello boffo123

Well, this certainly is a tough one!

Are your machines networked together? If so please disconnect the infected machine from the network.

Please do the following:

  • Please download GooredFix by JPShortstuff


    • Please download GooredFix from one of the locations below and save it to your Desktop.

    Download Mirror #1
    Download Mirror #2

    • Ensure all Firefox windows are closed.
    • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista/Win7).
    • When prompted to run the scan, click Yes.
    • GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

  • Please run the following scan


    • Note: You will need to use Internet Explorer for this scan.
    • Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
    • Please disable your real time security programs before performing the scan.


    • Scan your system with Eset Online Scanner
    • Place a check mark in the box YES, I accept the Terms Of Use.
    • Click the [external image: Posted Image] button.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.


    • Check [external image: Posted Image]
    • Click the [external image: Posted Image] button.
    • Accept any security warnings from your browser.
    • Check [external image: Posted Image]
    • Make sure that the option to "Remove Found Threats" is UN checked.
    • Push the "Start" button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push [external image: Posted Image]
    • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • Push the [external image: Posted Image] button.
    • Push [external image: Posted Image]

    Please post the GooredFix log and the ESET log in your next reply.
Post #44 last edited
HelloJonTom My two computers are not networked or connected in any. I do use the same DSL connection. I cannot use ESET online scanner. I recieved an error message 1st time. Second time antivirus program stopped a malicious script. Even tho I disabled it. McAffe antivirus is a newer version that was downloaded ( I did not ask for it) a few days ago from my DSL provider. I am not very familiar with all the options - but I did turn it off. Is there an alternative program. I keep tring different options to get ESET online scanner to work - no luck Here is the log GooredFix by jpshortstuff (03.07.10.1) Log created at 13:20 on 10/02/2011 (HP_Administrator) Firefox version [Unable to determine] ========== GooredScan ========== ========== GooredLog ========== C:\Program Files\Mozilla Firefox\extensions\ (none) [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "{B7082FAA-CB62-4872-9106-E42DD88EDE45}"="C:\Program Files\McAfee\SiteAdvisor" [03:47 19/05/2009] "{20a82645-c095-46ed-80e3-08825760534b}"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [04:19 22/01/2011] "[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [16:13 03/04/2010] -=E.O.F=- Boffo
Post #45
Hello boffo123

Lets give this one a try:

  • Please perform the following scan(s)


  • Please perform this scan using Internet Explorer.
  • This scan can take up to an hour or longer, please be patient.
  • It is recommended that you disable your onboard antivirus program and antispyware programs while performing scans to eliminate software conflicts and to speed up scan time.
  • DO NOT surf the net while your resident protection is disabled!
  • Once the scan is finished remember to re-enable your resident antivirus protection along with whatever antispyware applications you use.


  • Please perform an online scan with Panda Active Scan 2.0 by clicking here.
  • Click on the "Scan Your PC Now" button.
  • Click on "Register".
  • Choose the option you like most, but we recommend "Free Active Scan 2.0 (requires registration)".
  • Click on "Register".
  • Enter your e-mail address and create a password.
  • Select "I do not want to receive any type of information" (unless you want to receive such information).
  • Click on "Send".
  • Confirm your registration and continue by entering your user name and password, then click on "Enter".
  • Select "Full Scan", then Click on "Scan Now".

  • Wait for the components to be loaded and installed. Don't close this window or go to another page while it is downloading.
  • If the scan finds any malware it can disinfect, the Disinfect button will be enabled. Click on Disinfect.
  • Please ignore the offer to buy the program.
  • Click on the "Export To" button to export the log and save it to your desktop.
  • Please provide the contents of the log in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI