What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Conteneur ActiveX [Solved]

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
A friend brought me his computer with the complaint that it only boots to a white screen. Well I was able to determine that it has been hijacked by Conteneur ActiveX. I've tried booting to safe mode but it just gives me the BSOD. I've tried to make a bootable CD from my PC but I haven't had any luck. The PC in question is a DELL XPS with Windows XP Pro SP2. That's all I know about it at this point. Is there any help you can offer? Thanks in advanced for your help. Wow. 13 days without even so much as an acknowledgment of my post. Have I presented such a difficult issue that I've stumped the best? I have used this site a couple of times before and had great help and service. What's going on here?
Post #2 last edited
Here we are 16 days after my original post with no reply. I know it's been at least seen by someone because my thread was moved to the Windows forum. Which I don't understand why since this my problem is malware related. But hey, I'm not the expert here. I did however obtain more info from my friend about what happened to his machine. He said he was surfing the web and clicked a link for a video. When he did he got a screen that had an "FBI" warning demanding to follow a like to pay his "fine". So he just turned off his computer. When the computer is booted up, it loads up normally. I actually get to the desktop for about 10 seconds. Then conteneur ActiveX starts and loads a blank web page with all functionality disabled. No close or minimize buttons. Alt F4 doesn't close the window and the right click menu will open and immediately close rendering it useless. I do not have this maching connected to my network so there is no internet connectivity. So I don't know where the web page is pointing to. I would appreciate it if someone here would at least acknowledge my delima. My post has been moved and subsequent posts have been merged into the original post. But not one person has at least said "hey, we're checking into it". I know you guys and gals are busy and volunteers. But come on already.
Post #3
I moved it here.

In order for our Malware Team to help, it requires logs for them to look at.

You show this as being a XP with only SP2 installed which is way outdated.
You should be XP SP3



Also the FBI virus.

I'd suggest try booting in Safe Mode and running System Restore,
1.
Click Start.

2.
Point to All Programs.

3.
Point to Accessories.

4.
Point to System Tools.

5.
Click System Restore.

6.
Follow the instructions on the wizard.

See if you can find a date the the PC worked.


If you can get that far:


You need to apply Service Pack 3 for Windows XP. Without this update, you're wide open to re-infection. Click here:

Apply the update, reboot, and let me know how it's running.
Post #4
As stated in the original post. I am unable to boot to safe mode. Every time I try I get the blue screen of death. As for what version of XP this machine has, I have no way of knowing for sure since I can't get in to anything. My friend isn't the most computer literate and his info is all I have to go on. Is there a way I can boot to a CD that will allow me to run the recovery console? And Thank you very much for your response. I greatly appreciate it.
Post #5
If you have a XP Windows OS CD then yes, you can use the recover console. Also Dell pc's have a recovery partition if you have to do that but this will take it back to the day he bought it. To access the recovery partition on your Dell computer for recovery, follow the steps listed below. 1. Power on the computer 2. At the Dell logo, hold the Ctrl key and press the F11 key simultaneously. 2. The Dell PC Restore screen will come up. 3. Select Restore or use the Tab key to highlight it and press Enter. 4. if you wish to continue, click Confirm, or use the Tab key to highlight it and press Enter. 5. When the utility is finished, click Finish, or use the Tab key to highlight it and press Enter. You might try this first. Hit F11 to access the boot menu. Select "Repair my PC" from the menu that follows. You will boot into an environment with diagnostic and repair tools
Post #9
Apparently this machine has no recovery partition. Neither of those solutions worked for me. I attempted to run system restore from the recovery console but I am denied access to the c:\system~1\_resto~1 folder. When I attempt to enter safe mode I get the BSOD the only info it gives is that a problem has been detected and windows shut down to prevent damage. The technical info it gives is… STOP: 0x0000007B (0xF7c6e524, 0xc0000034, 0x00000000, 0x00000000)
Post #11
Well, so far none of those suggestions helped. However. I found another suggestion and tried it. I made a Vista Boot disk. Booted to a command prompt using that and then ran check disk, spybot search and destroy and hijackthis.
It was able to clear up enough issues to let me boot to windows.

So, here is the new hijackthis log.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:13:52 PM, on 3/20/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\dllhost.exe
G:\HijackThis.exe

O3 - Toolbar: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-3388265211-2254926783-3567689907-500\..\RunOnce: [spchecker] "C:\Program Files\AVG\AVG10\Notification\SPCheckerTE.exe" (User 'Administrator')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MI1933~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://activation.rr.com/install/downloads/tgctlcm.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Extern/RoadRunner…an/pestscan.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 5842 bytes
Post #12
Now that we've made it this far, I'm moving it to the Malware Removal forum

HijackThis isn't used much any longer, but I'm not seeing anything bad.

If you think there's an infection, try Malwarebytes.

http://www.malwarebytes.org/products/malwarebytes_free/

Also a online scan.

Go here to run an online scannner from ESET.
http://www.eset.eu/online-scanner

Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control…Click here to install…". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Make sure that the option "Remove found threats" is Unchecked
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.
Post #13 last edited
Malwarebytes is always running on this machine. I did a full scan with it and it found nothing. Eset however found 3 items. Here is the contents of the Eset log file. ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=8 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=4138a85ffa1c9245acd707a63b319789 # engine=13453 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-03-22 04:37:43 # local_time=2013-03-21 11:37:43 (-0600, Central Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=771 16777213 100 90 34580233 139715335 0 0 # compatibility_mode=3074 16777214 0 13 39169638 52611359 0 0 # compatibility_mode=6143 16777215 0 0 0 0 0 0 # scanned=117427 # found=3 # cleaned=0 # scan_time=4914 sh=CDE798A5C3BCDF898EFE952E7AF805B61CF7F827 ft=1 fh=b8ece18989fa3c5a vn="a variant of Win32/Injector.ABKY trojan" ac=I fn="C:\Documents and Settings\Paul\frxpsrxclrmsghb.exe" sh=791C5E0AB45183FCDB2672C8354D07ACAE956A9C ft=1 fh=41c203bc7de59690 vn="a variant of Win32/Injector.ABKY trojan" ac=I fn="C:\Documents and Settings\Paul\yfllekyvnubykphqhf.exe" sh=1DBB3F5A8FCBDF8B8050E8471B5DC8C94BAA725F ft=1 fh=0620fcc1e6b2b998 vn="a variant of Win32/Redyms.AB trojan" ac=I fn="C:\Documents and Settings\Paul\zxccitoaawbov.exe"
Post #14
I'd delete those 3 and run Combofix.

Let's try the following program which will help us figure out more of what's going on with your computer and go from there.
Combofix will scan the computer for various types of threats.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from this link
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

IMPORTANT !!! Save ComboFix.exe to your Desktop


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.
If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : http://forums.whatthetech.com/How_to_Disab…216#entry494216


Double click on ComboFix.exe & follow the prompts.

Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.


Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Click on Yes, to continue scanning for malware.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


When the tool is finished, it will produce a report for you.
Please attach the C:\ComboFix.txt log on your next reply so that we can continue checking and cleaning the system.


Please save using the default Notepad format,
DO NOT USE WORD or any other office type of software.
DO NOT COPY & PASTE the log, send it as an attachment.
Reply to THIS ticket, DO NOT create a new one.

Also please describe how your computer behaves at the moment.


Support requests which have received no customer response within 3 days will be closed automatically.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI