This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Don't Know What This Is...help Please

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I'm hoping somebody can help me…when I turn on the computer, the whole desktop page turns black with a big WARNING notice that says that I'm in danger from spyware etc. etc… Basically it's an ad to buy their anti-spyware product, but I can't get it off my desktop. When I clicked on the "removal instructions" it just takes me to their web site which says: ____________________________________________________________________ YOU'RE LOGGED! IP: 69.139.67.212 | PROVIDER: pcp05068575pcs.potsvl01.pa.comcast.net | BROWSER: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Bank's chief quits in porn scandal Guardian, UK - May 29, 2004 The millionaire chief executive of the Bank of Ireland Group resigned yesterday after he admitted using his office computer to view pornography and access an escort agency website. Michael Soden, 57, issued a statement yesterday afternoon admitting that he had entered websites forbidden under bank policy. He said that the websites visited were not illegal, but did contain links to material of an adult nature. Soden's activities are believed to have been reported by a Bank of Ireland employee who was routinely servicing his computer. The nature of the sites visited is thought to be similar to the content of popular men's magazines. It does indeed seem an absurdly high price. During a quiet five minutes between Irish banking deals, Soden took an idle browse through the offerings of some Vegas prostitutes, his eyes misting as he explored the charms of Shawna, 22, who enjoys “good conversation and listening to music and exploring physical pleasures” – and he thinks about how he hasn’t had a really good conversation in years – and the next thing you know, he’s typing his letter of resignation and packing his stapler and pot plants in a cardboard box. Defence lab in Net porn scandal BBC News, UK An inquiry is under way following the discovery of vast numbers of pornographic images in computers at a leading British defence establishment. Military investigators are reported to have found 170,000 pornographic images downloaded from the Net during a routine security check. A member of staff at the Ministry of Defence research laboratory has been suspended for downloading the material. The worker is based at the Defence Evaluation and Research Agency, Dera, at Malvern, Worcestershire. The MoD confirmed the suspension of its employee together with those of four employees from another company who were carrying out work at the laboratory. The matter is almost certain to be raised in the parliament on Monday, when the defence minister faces MPs. Liberal Democrat foreign affairs and defence spokesman, Menzies Campbell, said: "The real issue here is not the fact that it was porn that was downloaded but the fact that the MoD computer system could be manipulated so easily. "So far as we know, security was not compromised on this occasion but it is absolutely essential that suitable procedures be put in place to prevent abuse of this kind in the future." Kentucky punishes workers over porn The Courier-Journal Twenty-three state transportation employees have been fired or forced to resign or retire for using state computers to look at pornography. Twenty other workers were suspended, but the FBI has not concluded its investigation into whether pornography had been viewed, according to the April 22 letter to state Auditor Crit Luallen from cabinet Inspector General Robert L. Russell. The actions stem from a state auditor's report last summer which said that cabinet computers were used to view pornography and that European hackers had hijacked a computer server to host a chat room and trade pirated movies, video games, medical textbooks and other material. In the days following the report, the FBI seized 11 Transportation Cabinet computers believed to have been used to view pornography. 23 employees have left state government as a result of an investigation. Four were fired, and 19 resigned or retired when confronted with evidence of the improper computer use. Child porn arrest stuns community The Bay City Times, MI - Apr 29, 2004 A magistrate arraigned Webb, a 38-year-old Farwell High School coach, teacher and former Freeland Community Schools administrator, in Isabella County District Court on charges of possessing child pornography on his personal computer. He remains jailed in Isabella County on a $40,000 cash or surety bond. A preliminary exam is set for May 6. "We just knew police were going through his car," which Webb had left at the school, and some students "were guessing it was drugs," said freshman Loran Eichhorn. Monday, a tipster touched off a swift raid on Webb's Mount Pleasant home, Mount Pleasant Police Officer Charles D. Morrison said. There, police confiscated a personal computer and computer discs. At the high school, they carried off Webb's work computer and arrested him around 4 p.m. Monday afternoon, Morrison said. Investigators said they found evidence of Internet downloading of kiddie porn, but nothing that would connect Webb to local activities, such as the international child porn ring linked to Midland, Morrison said. Magistrate Sandra Strauss arraigned Webb on a single felony count of possession of child sexually abusive material. A conviction carries a maximum of four years in prison, Isabella County Prosecutor Larry J. Burdick said. When you clear your web browser cache, or clear your visited sites history manually - data is still stored in your computer. There exists a lot of special undelete programs, available to public, that could open deleted files, restore removed histories, and so on… Forensics are even more advanced. If school boy once got undelete program will have to dig very big piles of removed files, forensics will use special, advanced hardware, which will restore files pretty fast, and build correctly gathered electronic evidences, no matter whether you deleted file or not, whether you deleted history or not. Authorities may use such tools to proof that you are visiting sites that THEY think you should not. You may have a trojan horse installed in your computer which will send SPAM, and forensics will find evidences that you have been sending SPAM… So you should protect and remove Spyware as well, as any traces it did. Unfortunately, nowadays, even if you are not doing illegal activities, electronic evidences found on your computer could put you in absolutely ugly situation. Even if you will be released by authorities, your reputation will be damaged for your boss or family members. Are you sure that you do not have enemies ? Maybe your wife is seeking for anything to divorce and take everything from you… Maybe some crooks are going to steal your private info or use your computer for illegal actio ns to make you and not them responsible for these actions. All files saved in your computer will make life eas ier for them, but not for you!!! Very often you open sites that you have not expected to open. With many bugs in your operating system and your browser - even malicious software like spyware and viruses could download. Usually that viruses are not intended to harm you specifically. But imagine, what will happen - if you will download something offending and illegal… And it will be stored in your computer forever… You will NEVER prove that you were not doing that… And even if you clean histories and files without special software, forensics software and hardware will be still able to collect electronic evidences against you!!! SECURE YOURSELF RIGHT NOW! Maybe your information security specialists have already shown logs to your boss and he have a cause to dismiss you… Undeleted computer files and logs can tell EVERYTHING about you, even more than you can imagine. Every move, every click, every step is logged. As well, as date and time when you did that. Hundreds are loosing their jobs because of using corporate equipment for personal needs, not approved by bosses. It will be hard to find a new job if you are fired this way. You, a good friend, graduated specialist, have a good family. Imagine what will happen if your enemies dig into the files stored in your computer and bring it to the public ? Everybody will whisper: "He's watching porno, instead of doing job!", or "he has additional money because he's sending porno SPAM right from his working place!". And you will not be able to disprove anything - people trust electronic evidences gathered from your computer more than your word! You could be accused of everything - pedophilia, zoophilia, spamming, homosexuality, drugs, rape, racism, extremism and EVEN TERRORISM (if somehow you opened spam often sent out by terrorist organization and you opened it accidentally)! What if your wife finds out what sites you visited? Even if you opened a site by a misleading link from spam or popup in search engine? What will happen if she finds a file on your computer containing girls photos and written "escort services"?! Will she believe you? The court will be on her side in this case! Many people around the globe have already lost everything in this way! Do you want to be among smart people or among losers? Do you think about your future? Do you know, that your computer can be used against you? Everything that computer "speaks" can be used against you. SECURE YOURSELF RIGHT NOW! Right now, criminals can use your personal files in the other way. For example, they can steal your credit card information right when you type it in some good-standing online shop, or pay bills online. Paypal accounts accesses can be stolen, just like any other online account. Online banking access can be stolen too. Or your private accounts can be used by criminals to pass illegal money. Your money, and in some cases your reputation or freedom can be in danger. That's why it is extremely important to secure yourself! Never give away, dispose or sell your hard disk without WIPING all data with our software, because all your personal data can be still undeleted and analyzed. Simple deletion of drive C contents, and even formatting - will not help. SECURE YOURSELF RIGHT NOW! ____________________________________________________________________ Can't get this off my desktop. Somebody please help. Do I need to run Hijack this or is that only for browser hijacks?
Greetings and welcome to TomCoyote.org!

To get your desktop back, please try this:

Go to: Start > Control Panel > Appearances and Themes > Display, click the "Desktop" tab, click "Customize Desktop", click the "Web" tab, and clear anything checked in there.

If you want your machine checked for malware, please do this:

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Download HijackThis into this folder.

If required a tutorial is here = Hijackthis Folder Tutorial

Links to Hijack This! v 1.98.2:

http://tools.radiosplace.com/HijackThis.exe
http://spywarewarrior.com/files/HijackThis.exe

Run it from that folder.

Click "Scan".

DO NOT "FIX" ANYTHING WITH IT YET!!!
FIXING THE WRONG THING COULD RENDER YOUR SYSTEM INOPERABLE!!!

Click "Save log".

Reply to this thread, and "copy/paste" the ENTIRE CONTENTS of the log file into this thread.
:)
THANK YOU HERE IS MY HIJACK THIS LOG


Logfile of HijackThis v1.98.2
Scan saved at 2:58:47 PM, on 12/1/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mustek 1200 UB Plus\Driver\WATCH.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8PARO5QN\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gatewaybiz.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [5smP39l] faucnv32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [KB5FRVJpi] fmioclc.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Watch.lnk = C:\Program Files\Mustek 1200 UB Plus\Driver\WATCH.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1101572220315
Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
MOVE HijackThis into this folder.

If required a tutorial is here = Hijackthis Folder Tutorial

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [5smP39l] faucnv32.exe

O4 - HKCU\..\Run: [KB5FRVJpi] fmioclc.exe

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

faucnv32.exe <— file

fmioclc.exe <— file

(Use windows explorer to find these files)

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)

Did you regain control of your desktop yet? :unsure:
Thank you so much for your insight that took care of the problem. Actually when we went through the control panel that did it, but I still went through hijack this. and thank's again for your assis :wavey: scp
Glad we could help.
:)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link

(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI