Think this computer is in virus overload

Hi UrMyStar,

Please open OTL

• Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, click the None button near the top (it may looked greyed out)
  
• In the window under Custom Scans/Fixes copy and paste the following
  
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioEndpointBuilderRpcSs /s
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ralhnoki /s
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BJDEMB /s
  /md5start
  bxhyjstl.sys
  /md5stop
  
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.

Hi UrMyStar,

One more scan to check our handiwork.

As a Vista user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

• Do not use this instance of your browser for anything besides doing this scan
• When the scan is complete and the results saved, close that instance of your browser
• Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
• Click Start
• Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
• Click Scan.
• Wait for the scan to finish.
• Re-enable your Antivirus software.
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.

Please post back with the ESET log.

Hi, apologies for the late reply. This is the log ESETSmartInstaller@High as downloader log: all ok # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6425 # api_version=3.0.2 # EOSSerial=732ccf1596c77a4e94b9618fc5181b91 # end=stopped # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-03-05 01:41:23 # local_time=2011-03-05 01:41:23 (+0000, GMT Standard Time) # country="United Kingdom" # lang=9 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=769 16774142 0 1 51032771 51032771 0 0 # compatibility_mode=1024 16777215 100 0 51032126 51032126 0 0 # compatibility_mode=4864 16777215 100 0 0 0 0 0 # compatibility_mode=5892 16776573 100 100 55077 136821312 0 0 # compatibility_mode=8192 67108863 100 0 3781 3781 0 0 # scanned=34248 # found=1 # cleaned=0 # scan_time=700 C:\Program Files\Acer Arcade Live\Acer HomeMedia Trial Creator\Export\SoftDMA_Trial\Autorun.inf INF/Autorun.gen trojan (unable to clean) 00000000000000000000000000000000 I # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6425 # api_version=3.0.2 # EOSSerial=732ccf1596c77a4e94b9618fc5181b91 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-03-08 08:42:23 # local_time=2011-03-08 08:42:23 (+0000, GMT Standard Time) # country="United Kingdom" # lang=9 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=769 16774142 0 1 51355708 51355708 0 0 # compatibility_mode=1024 16777215 100 0 51355063 51355063 0 0 # compatibility_mode=4864 16777215 100 0 0 0 0 0 # compatibility_mode=5892 16776573 100 100 30338 137144249 0 0 # compatibility_mode=8192 67108863 100 0 326718 326718 0 0 # scanned=308503 # found=10 # cleaned=0 # scan_time=5422 C:\Program Files\Acer Arcade Live\Acer HomeMedia Trial Creator\Export\SoftDMA_Trial\Autorun.inf INF/Autorun.gen trojan (unable to clean) 00000000000000000000000000000000 I C:\Program Files\Registry Easy\Recoveryer.dll Win32/Adware.RegistryEasy application (unable to clean) 00000000000000000000000000000000 I C:\Program Files\Registry Easy\RegEasyCleaner.exe a variant of Win32/Adware.RegistryEasy application (unable to clean) 00000000000000000000000000000000 I C:\Program Files\Registry Easy\RegEasyCleanerUpdate.exe Win32/Adware.RegistryEasy application (unable to clean) 00000000000000000000000000000000 I C:\Program Files\Registry Easy\RegEasyUpdate.exe Win32/Adware.RegistryEasy application (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Users\Deception\AppData\Roaming\74E2806FC6069F21FF8F68B24FB99F35\enemies-names.txt.vir Win32/Adware.AntimalwareDoctor.AE.Gen application (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Users\Deception\AppData\Roaming\74E2806FC6069F21FF8F68B24FB99F35\local.ini.vir Win32/Adware.AntimalwareDoctor.AE.Gen application (unable to clean) 00000000000000000000000000000000 I C:\Users\Deception\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8YZSK09Z\der93_info[1].htm HTML/Iframe.B.Gen virus (unable to clean) 00000000000000000000000000000000 I C:\Users\Deception\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\974d443-3b97da73 probably a variant of Java/TrojanDownloader.Agent.AB trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Deception\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\22d9236b-6653bd92 probably a variant of Java/TrojanDownloader.Agent.AB trojan (unable to clean) 00000000000000000000000000000000 I

Hi UrMyStar,

One ESET detection is program bundled on Acer computers and most of the others are files we have quarantined. The quarantined files will be removed when we remove the tools.

What do you know about this program, Registry Easy? ESET flagged it as containing adware.

We'll take care of the java exploit that was detected and the temporary files.

Next, Right click on OTL.exe and chose Run as Administrator to run it

• Under the Custom Scans/Fixes box at the bottom, paste in the following
• Do Not copy the word CODE
• please note the fix starts with the :

:Services

:Commands
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

• Let the program run unhindered
• Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.


Next

I don't see an antivirus program installed on this computer. Please download and install one of these free antivirus programs.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found here Avira Personal Support Forum
Microsoft Security Essentials
Support


Next

• Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt


Please post back with

• OTL fix log
• OTL.txt

If all is well we'll clean up the tools and send you on your way after you post back.

Thanks

Hiya, I don't know anything about Registry Easy, sorry. I installed Avast I've attached both the OTL Fix Log and the OTL.txt

Hi UrMyStar,

Registry Easy at one time was flagged as a rogue. They may have cleaned up their act lately. It's up to you if you want to keep it but you really dont's need a registry cleaner nor are the recommended.
http://forums.spybot.info/showthread.php?t=30113

It can be uninstalled if you wish.

Depending on your setings, either

• click on the Uninstall a program option under the Programs category.
• If you are using the Classic View of the Control Panel, then you would double-click on the Programs and Features icon instead.

The moment you have been waiting for.

From your desktop, please delete, if present

• any notepads/logs that we created
• GMER (ic0l8zmy.exe)
• MBRCheck.exe
• DDS.scr
• myfix.bat

Next

Click the Start button, click Run. [Vista users, go Start>"Start search"] Copy and paste the following line into the run box and click OK
Combofix /uninstall


Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep it updated and use it regularly.


ESET online scan can be removed via add/remove programs.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Just add a firewall to what you have.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for links and tutorials to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Make sure you have reset Automatic Updates to your chosen optionClick your start button > Control Panel > System


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE

- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

Please post back if you have any problems.

Take care

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.