Virus: White Smoke Toolbar (aka WhiteSmoke) [Solved]

Hello, peteinmaine.

In order to offer you the best possible solutions, can you please clarify your issues for me?

Issue 1: When downloading AVG, you are not prompted for a licence.

Apparently, the licence issue in the free version is a very common and aggravating dilemma among AVG users. Even though you are not prompted for a licence, are you able to move forward and complete the installation? If not, let's try a few things.

1. Clean Up Temp Files

Please download TFC to your desktop.

• Close any open windows.
• Double click the TFC icon to run the program.
• TFC will close all open programs itself in order to run.
• Click the Start button to begin the process.
• Allow TFC to run uninterrupted.
• The program should not take long to finish.
• Once complete, it should automatically reboot your machine.
• If your computer does not automatically reboot, manually reboot to ensure a complete clean.

2. Clear Browsing History and Cookies

In Internet Explorer

• Open Internet Explorer.
• Select Tools > Internet Options.
• Click Delete Browsing History.
• Check mark the following boxes:

• Temporary Internet files
• Cookies
• History (and any other deletions you may want)

• Click Delete.
• Click OK to close the Internet Options window.
• Close and restart your browser.

In Firefox

• Open Firefox.
• Click Tools > Clear Recent History….
• In the Time range to clear pull-down menu, select Everything.
• Click Clear Now.
• Close and restart your browser.

3. Download AVG

Download AVG using a different installation file found HERE. Double click on AVG for Windows/AVG Online Installer to begin the download. Supposedly, the licence number is built into the program and therefore, the application should not be asking for a licence number. If you are still experiencing problems, try the next option.

4. Delete AVG File

• Go to Start > My Computer.
• Double click on Program Files > AVG > AVG (Version number).
• If it exists, locate the following file and click Delete.

Avg.snu

Try reinstalling AVG again.

5. Optional Free Anti-Virus Programs

If AVG is still difficult to download, you may want to consider other available free anti-virus programs. You can find a selection of excellent ones HERE.

Issue 2: When shutting down your computer, you receive the Turn off computer prompt.

In your next reply, can you please clarify the following for me?

• If I am understanding you correctly, each time you turn off your computer, Windows is asking you download 2 updates, or is AVG asking for the updates?
• When you say "this…apparently never actually happening," do you mean you are unable to shut down, or do you mean the updates do not download?
• Please let me know what the 2 updates are that you are being asked to install.
• Were you having this problem before your computer was infected?

Thank you for the clarifications.

Hello fbfbfb,

Re: Issue 1: When downloading AVG, you are not prompted for a licence. . . . are you able to move forward and complete the installation?
Yes. The AVG installation is complete.
📎AVG_protected.PNG

However, during the installation process, I was never prompted for a licence number.

Re: "Issue 2: When shutting down your computer, you receive the Turn off computer prompt. . . . Please let me know what the 2 updates are that you are being asked to install."
Yes, it is Windows asking me to download 2 updates.

Re: " When you say "this…apparently never actually happening," do you mean you are unable to shut down, or do you mean the updates do not download?"
I am able to shut down. My shutdown procedure produces this prompt from Windows every time. Right now, as I write this, if I proceed with shutdown, I am greeted with this prompt . If I were to press the center selection "Turn Off", to proceed with shut-down, I can predict with 100% certainty, that there will be 2 updates this time, again next time and every time.
📎Updates_not.PNG

Possible Conclusions?:
1- the updates never really are completed?
2- There are no updates at all. Instead, this could possibly be a behavior left over from the White Smoke virus?

Re: "Were you having this problem before your computer was infected?"
This occurrence was not a problem prior to being infected.

Hello, peteinmaine.

I am understanding that AVG has been completely and properly installed and is working fine despite not being prompted for a licence. Correct?

Let’s take another look at Windows repeatedly asking to update. This is sometimes caused by a corrupt update or the incomplete installation of an update, in which case, that update tries to reinstall. Here are some options to work through.

Option 1: Run Microsoft Windows Update Fixit Tool

• Download the Fixit Tool from HERE.
• Click Run now .
• Click Save File.
• Double click the saved file (MicrosoftFixit.wu.LB.13…Run.exe) to run it and follow the prompts.

Turn off your computer to see if this has resolved your issue? If not, continue to the next option.

Option 2: Turn Automatic Updates Off

If you choose to turn off Automatic Updates, your system will be vulnerable to exploits, so you will need to be vigilant for any new updates that need to be downloaded.

To turn off Automatic Updates:

• Click Start > Control Panel > double click Automatic Updates.
• Click Turn off Automatic Updates > Apply > OK.

Did this resolve your issue? If not, or if you prefer to leave Automatic Updates turned on, continue to the next option.

Option 3: Check Windows Update History for Pending or Failed Updates

• Open Internet Explorer.
• Click Tools > Windows Update.
• On the left side of the page, click Review your update history. This will bring up a page listing all downloaded updates.
• Check the Status column for any updates that have failed to install (X).
• For each failed update listed under the Update column, there will be a KB number (ex. KB2810047)
• Double-click the update to view more information.

In your next reply, please provide me with the KB number and any error messages for each failed update.

Hello fbfbfb,


Re: "I am understanding that AVG has been completely and properly installed and is working fine despite not being prompted for a licence. Correct?"
Correct . . . . . at least it appears that way. I do not see any issues.

Re: "Option 1: Run Microsoft Windows Update Fixit Tool"
At first this appeared to work. I completed this option and immediately saw that the update request had been removed. However, after I shut down & rebooted the update request returned repeatedly.
(For more info on this, please see edit added {May 24, 2013, 5:30 AM} below, at "My Discovery")

Option 2: Turn Automatic Updates Off
I turned off the automatic updates to find that the update request was removed. However, I do not wish to run in this mode.

Option 3: Check Windows Update History for Pending or Failed Updates

• Open Internet Explorer.
• Click Tools > Windows Update.

These previous two instructions were the only instructions which coincided with my browser.

• On the left side of the page, click Review your update history. This will bring up a page listing all downloaded updates.

I found no "Review your update history." selection or any other of the subsequent instructions. However, I will post what I did find:

Following, please see that I selected "Restore Hidden Updates" which shows as grayed out.
📎Windows_Updates.PNG
📎Windows_Updates_2.PNG
📎Windows_Updates_3.PNG

This third screen capture shows the successful completion of fixing 2 updates.
However, the problem has not been fixed & still persists.

{May 24, 2013, 5:30 AM}
My discovery:
1- Shut down machine via pressing "Turn Off" [apparently running 2 Windows updates]
2- Boot up
3- Immediately press "Start" > "Turn Off Computer" & view this:
📎Shut_down.PNG

4- Press "Cancel"
5- Open browser [or perform any task]
6- press "Start" > "Turn Off Computer" & view this:
📎Updates_not.PNG

Hello, peteinmaine. I have submitted some solutions for review and will forward them to you as soon as possible. So that we can offer you the best and most expedient solution, I would ask that any additional information or questions pertaining to your issue be sent through this thread instead of my personal mailbox. In this way, everyone involved will have full access to those important details. Thank you, peteinmaine. Have a good weekend.

Hello fbfbfb,

Idea / solution to update prob:
1- update prob did not exist before the virus
2- Virus made sure I could not do System Restore
3- Virus has been eliminated
4- What about now doing a System Restore back to a date PRIOR to the virus infection?

Checking the dates on the "Restore calendar, there ARE dates available prior to the virus date of May 4, 2013.
📎Restore_points.PNG

Hello, peteinmaine.

The 2 updates proving to be problematic are Microsoft updates KB2804576 and KB2804577. These are part of the Microsoft.NET Framework System.

It appears many people are experiencing the same repetitive update issue. Apparently, Microsoft does not have a definitive fix for this problem. We can try a variety of solutions, and hopefully we can find one that will work for you. Begin with the first option and work your way through.

Option 1: Manually Download Microsoft Updates KB2804576 and KB2804577

1. Update Microsoft Installer

First, let’s make sure you download the latest Microsoft Installer from HERE.

• Click the red download button.
• Using the scroll bar to the right, scroll to the last file named WindowsXP-KB942288-v3-x86.exe and place a check mark in the box. > Click Next.
• When the dialogue window opens, click Save File.
• Locate this file and double click it. When the dialogue window opens, click Run. This will automatically update the version of Windows Installer on your system to version 4.5.

2. Install Updates

Install update NDP40-KB2804576-x86.exe from HERE.

• Click the red download button.
• Place a check mark in the box next to NDP40-KB2804576-x86.exe. > Click Next.
• When the dialogue window opens, click Save File.
• Locate this file and double click it. When the dialogue window opens, click Run.

Install update NDP40-KB2804577-x86.exe from HERE.

• Click the red download button.
• Place a check mark in the box next to NDP40-KB2804577-x86.exe. > Click Next.
• When the dialogue window opens, click Save File.
• Locate this file and double click it. When the dialogue window opens, click Run.

3. Reset Windows Update Components

If it is still installed on your system, please run the Microsoft Fixit tool again to reset update components. If it has been deleted, please download it from HERE.

• Click Run now .
• Click Save File.
• Double click the saved file (MicrosoftFixit.wu.LB.13…Run.exe) to run it and follow the prompts.

Reboot your computer. Has this resolved the repeat update issue when you shut down your computer? If not, proceed to the next option.

Option 2: Download Microsoft .NET Framework Repair Tool

This tool detects and tries to fix some frequently occurring issues with the setup of or with updates to the Microsoft .NET Framework.

Download the Microsoft .NET Framework Repair Tool from HERE

• Click the red download button.
• Place a check mark in the box next to NetFxRepairTool.exe > Click Next.
• When the dialogue window opens, click Save File.
• Locate this file and double click it. When the dialogue box opens, click Run.

Reboot your computer. Has this resolved the issue? If not, proceed to the next option.

Option 3: Hide Update Downloads

By default, whenever Microsoft initiates a scan for updates and patches to Windows XP, it compiles a download list of every single missing patch or update. If you want to hide individual updates to prevent their installation, Microsoft allows you to do so.

Copy and paste the following link into your Internet Explorer browser. Using other browsers may not take you to this direct link.

http://catalog.update.microsoft.com/v7/site/Home.aspx

• Click the Custom button, and wait for the scan to complete.
• When the list of updates appears, look for Windows Update KB2804576, right click on it to show the details, then check mark Don’t show this update again .
• Repeat this process for Windows Update KB2804577.
• Exit and reboot your computer.

Has this resolved your issue? If not, we will try a few more options in the next reply.

I will review your suggestion in your last post and get back to you.

Hello, peteinmaine.

You are asking about using your System Restore to a date prior to being infected in order to resolve the issue of repeated update downloads.

When you first began this thread, you stated that you could “no longer do a System Restore to any previous date before this virus May 5, 2013.” Therefore, you have no restore points to access. Most likely, malware caused System Restore to be disabled.

Even if restore points were accessible, it is well worth noting that malware arrives on a system long before symptoms of infection appear. Given the dates that show on your screenshot, if you discovered that you were infected on May 5th, the malware on your system could have already been there waiting to cause problems, perhaps even as far back as April 4th. To avoid detection, malware also has the ability to manipulate its file date. Can we really be sure of a safe restore date?

So, although your suggestion sounds logical enough, and simple enough, there are no restore points for you to access, and if we could, we can't be sure that a System Restore would not reintroduce malware back into the system.

Hello fbfbfb,

Re: "You are asking about using your System Restore to a date prior to . . . . . Can we really be sure of a safe restore date?"

Answer: Yes! I am 100% certain that the following site produced the virus found on my system.
To read why I am able to answer this with 100% assurance, please refer to my original post (shown below):


Last eve I was shown a message from this site:
http://www.mplayertotal.com/flashplayer/up…p?uid=107404113

. . . telling that I had to update my flashplayer in order to view the site. Although the site seemed less than legit, [i.e. not a flashplayer site] much of the "update process" did appear legit. Turns out it this had NOTHING to do with updating ANYTHING!
=======================================================================

Option 1: Manually Download Microsoft Updates KB2804576 and KB2804577
Complete
Running the Microsoft Fixit tool produced this (i.e. no problems were detected):
📎No_fixes.PNG

Reboot your computer. Has this resolved the repeat update issue when you shut down your computer?
Answer: No proceeded to Option 2:


Option 2: Download Microsoft .NET Framework Repair Tool
Complete
At this juncture, (see pic below) I chose "Finish". (i.e. I could not determine at this point, if this was successful or not)
📎Net_Framework.PNG

Reboot your computer. Has this resolved the issue?
Answer: No proceeded to Option 3:


Option 3: Hide Update Downloads
http://catalog.update.microsoft.com/v7/site/Home.aspx
Attempting to arrive at this website was NOT successful. This produced only a Microsoft error as follows:
📎MS_Microst_site_NG.PNG

The problem still persists. Please advise.

Hello, peteinmaine.

I absolutely apologize for the delay. I thought I had sent you the next solution to try, but I obviously have not.

Let's see if the following tool will resolve the issue.

Please download Windows Repair (All in One) from HERE.

Install the program, then run it.

• Go to step 2, and allow it to run Check Disk.
• Once that is done, then go to step 3 and allow it to run SFC.
• Step 4 requires you to perform a backup and create a system restore point.
• Click Create for system restore and Backup for registry backup. Then click Next.
• On the Start Repairs tab > Click Start.
• Click on the unselect all and then select only Repair Windows Updates and click Start.
• Do not use the computer while each scan is in progress.
• Restart may be needed to finish the repair procedure.

Hello, peteinmaine. Are you still with me? Do you still need help?

Hello fbfbfb,

Yes, I am still here.

I have completed

• "Go to step 2, and allow it to run Check Disk."

This next step, I was not able to complete:

• "Once that is done, then go to step 3 and allow it to run SFC."

📎no_CD.PNG

I do not have the disk. I am not able to complete this operation.

I have been able to create a system restore point via the standard means using:
All Programs > Accessories > System tools > System Restore.

Please advise

Hello, peteinmaine.

Let's not worry about Check Disk, and let's try to run System File Checker without the required CD.

SFC validates that all of Windows' system files are correct and fixes those that are not. If you have no installation disk, a copy of the installation media can be located in the i386 folder. Confirm if this folder is present at this location, then continue below to run SFC:

Start > Windows > Driver Cache > i386

Run System File Checker (SFC)

• Click Start > Run.
• In the Open field, type: sfc /scannow. Note: There is a space between sfc and /.
• Press Enter.
• If you are prompted to insert the installation CD, click OK, allowing it to fail since there is no disk, and let SFC continue.
• When you are asked to provide the location of the CD-ROM, type in the full path of the i386 directory, and wait for SFC to complete:

C:\WINDOWS\Driver Cache\i386

Hello fbfbfb,

Frustrated


Start > Windows > Driver Cache > i386
Confirmed: this folder is present at this location

Re: Run System File Checker (SFC)

• Click Start > Run. Done
• In the Open field, type: sfc /scannow. Note: There is a space between sfc and /. Done
• Press Enter. Done
• If you are prompted to insert the installation CD, click OK, . . .

The only available response buttons at this prompt are:
[Retry] [More Information] [Cancel]

To press [Retry], brings an [OK] box with the message: "The CD you provided is the wrong CD. Please insert .. . . . CD-ROM Drive." [OK]
Note: I would provide a screen capture, but apparently this is not available while SFC is running.

Pressing [OK] brings me back to the original box with [Retry] - [More Information] - [Cancel]

Pressing [More Information] yields an [OK] box with the message "Possible reasons for this problem . . . "
Press [OK]

Press [Cancel] yields a [Yes][No] box with the message:
"If you cancel, Windows might require you to insert a CD later. Are you sure you want to skip this file?
Pressing [Yes] yields a return to SFC running until the next file shows the [Retry] - [More Information] - [Cancel] box yet again.

I completed running SFC in this manner, skipping every file.
The entire exercise did not appear to run as expected or hoped for.

Please advise

Hello, peteinmaine.

Thank you for trying to run SFC. Not all solutions will work with all systems, so let's forgo SFC, and let's move ahead and try some alternatives.

Option 1: Hide Update Downloads

• Click Start > All programs > Windows Update.
• Click the Custom button, and wait for the scan to complete.
• When the list of updates appears, look for Windows Update KB2804576, right click on it to show the details, then check mark Don’t show this update again.
• Repeat this process for Windows Update KB2804577.

Note: If a list of updates does not immediately appear, do this: on the left side under Select by Product, click Windows XP and then, look for those updates.

• Exit and reboot your computer.

If this has not resolved the issue, continue with the next option.

Option 2: Turn off Automatic Updates and Download Updates Manually

These updates may be "stuck" during the download process. First, turn off Automatic Updates, then reinstall these updates manually as previously instructed in Post 22, Option 1: Manually Download Microsoft Updates KB2804576 and KB2804577 (#2, Install Updates). When finished, turn Automatic Updates back on.

Move on to the next option if this has not resolved the issue.

Option 3: Clean Update Cache in Windows XP

• Click Start > Run > cmd .
• In the command prompt, type the following commands:

net stop wuauserv
cd /d %windir%
rd /s SoftwareDistribution

• Restart your PC to purge the update cache.
• After rebooting, open the command prompt again and type the following to enable the Windows update service back.

net start wuauserv

Has this resolved the issue? If not, continue with the next option.

Option 4: Uninstall and Reinstall Windows Updates in XP

Uninstalling updates will not harm your computer, but it is important that Automatic Updates is turned on in order for updates to reinstall.

• Click Start > Run and type services.msc into the Open field > Click OK.
• From the list, right-click on Automatic Updates and click Stop.
• Right-click Background Intelligent Transfer Service > click Stop > Close out of the dialog box.
• Click Start > My Computer > Local Disk C: > Windows.
• Right-click the SoftwareDistribution folder> Click Delete > Close out of the dialog box.
• Click Start > Control Panel > Automatic Updates > Select the Automatic (recommended) option.
• Click OK and the automatic updates will reinstall for your computer.

Has this resolved the issue? If not, I have a few final options we can try in my next reply.