I have been working on this for a few days, but to no avail. Called Symantec and they charged me $40 for an email that contained links for Ad-Aware, Spybot, and HijackThis. I already used these prior to calling those idiots. I can't install their anti virus on a client's computer because of a trojan.
Can anyone help? Below is the most recent HijackThis Logfile.
Logfile of HijackThis v1.99.1
Scan saved at 8:44:38 PM, on 6/4/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
I am really sorry for the delay, we are so busy here at TC, there are more people writing this garbage than there are people to fix it.
If you have not resolved your problem and need my help, please do this…
DO THIS FIRST
Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.
Easy to fix,
* just go to MY COMPUTER > YOUR C:\ DRIVE and create a new folder and name it HIJACKTHIS .
* Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
* Now open the new folder you just created and right click within that folder and select PASTE .
* Now HJT should reside in C:\HIJACKTHIS\HIJACKTHIS.EXE
Then post a new HJT log and lets see if anything has changed since you originally posted.
I did as you instructed. Note: I removed Symantec AV last week so the log file did change.
By the way, other than donating, does anyone here instruct others how to defeat these Trojans/Malware/Spyware. I'm computer savy and I would love to learn and help.
=====================
New Logfile as of June 12, 2005:
Logfile of HijackThis v1.99.1
Scan saved at 7:30:03 PM, on 6/12/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Try either emailing daveai or sending him a private message giving him some of your past experiences with computers and your desire to join the classroom to learn how to become a moderator. Just go to My Controls and you can send him a PM from there.
Are you posting the entire contents of Hijackthis?? When you run it, it will save a log file, make sure that you go to EDIT/SELECT ALL/ COPY and paste the entire log into this forum.
You have a trojan or two, what I would like you to do is to run HJT (Scan Only ) and put a checkmark in the following entries, close all open windows and browsers and click on FIX CHECKED.
I would like you to run some free online virus scanners, run them all and have them set to AUTO CLEAN or to REPAIR what it finds. Please post the results of what they could not fix. http://www.pandasoftware.com/activescan/
http://housecall.trendmicro.com/
Now go and download and install the 30 DAY evaluation copy of TROJAN HUNTER , update the program and run a scan, post the results of what it found in this thread. http://www.trojanhunter.com/
Dissenter, I am going to hang with you until we get you clean, but please be advised that we are all volunteers here and if I am busy at work tomorrow I may not get back to you until the evening, but like the line in the TERMINATOR "I'LL BE BACK"
ken545,
Sorry about the delay in getting back with you, I have had a ton of projects to do!
Ok, I checked what you had suggested, ran the online AV programs (which found a few trojans and fixed those), but it also found Spyware inwhich they weren't able to remove.
I haven't downloaded Trojan Hunter yet, however, I will do that tomorrow evening.
**Sidenote**
I tried sending daveai an email *and* a pm, but an error message states that I can't use those features.
By the way…..I realize the moderators are volunteers and your help is greatly appreciated. Again, this is why I would like to learn and help!
After running Trojan Hunter (it found and removed four possible trojans), I attempted to install Symantec's AV program again, which I have no problem doing, but I can't open the AV program to run a full system scan without getting an error message.
I then did an online scan at Symantec's web site and it found the following:
c:\NULL is infected with Adware.Websearch
c:\WINDOWS\cfgmgr51.dll.tcf is infected with Adware.Bookedspace
c:\WINDOWS\Temporary Internet Files\Content.IE5\UXGBMLG9\website[1].ocx is infected with Download.Adware
c:\WINDOWS\TEMP\pcs_0002.exe is infected with Download.Adware
c:\WINDOWS\TEMP\wrapperouter.exe is infected with Adware.VirtualBouncer
c:\WINDOWS\TEMP\GLBB324.TMP is infected with Adware.VirtualBouncer
c:\WINDOWS\TEMP\SSK3_B5 Seedcorn 4.exe is infected with Adware.SurfSideKick
c:\WINDOWS\TEMP\GLB60E3.TMP is infected with Adware.VirtualBouncer
c:\WINDOWS\TEMP\GLB8382.TMP is infected with Adware.VirtualBouncer
c:\WINDOWS\TEMP\UNIA0E4.TMP.exe is infected with Adware.WeirdOnTheWeb
c:\WINDOWS\SYSTEM\Ksyesy.exe.tcf is infected with Adware.DealHelper
c:\WINDOWS\SYSTEM\scrsvc.exe.tcf is infected with Trojan.StartPage
c:\WINDOWS\SYSTEM\GSM3-0511.exe is infected with Adware.AFAEnhance
c:\WINDOWS\SYSTEM\Uhdrlu.exe is infected with Adware.DealHelper
c:\WINDOWS\SYSTEM\bs51-eginwl51-vb.exe is infected with Adware.Bookedspace
c:\WINDOWS\SYSTEM\cxtpls_loader.exe is infected with Spyware.Apropos
c:\WINDOWS\SYSTEM\btnetw-ventura-hot_246765.exe is infected with Adware.BigTrafficNet
c:\WINDOWS\SYSTEM\weirdontheweb_ventura.exe is infected with Adware.WeirdOnTheWeb
My question is this: Why isn't Adaware SE (all updates are recent) and HijackThis finding these Spyware and Malware programs?
Below is the updated Logfile from HijackThis:
Logfile of HijackThis v1.99.1
Scan saved at 12:52:59 AM, on 6/16/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Dissenter,
After you have a total of 5 posts, you should be able to PM or Email, so give it another try.
All adware removal programs do a pretty fair job of cleaning your system, but they are not foolproof. Most times we need to run a program, reboot, run the program again, reboot, run another program, reboot, run it again. There is more of this garbage being written as we speak. What one program doesn't find, another will. Usually after we run these programs then we have to fix stuff manually.
I am going to look over your log and get back to you later on today.
In the meatime, go to START/ CONTROL PANEL/ ADD-REMOVE PROGRAMS and see if you have an entry for VIRTUAL BOUNCER, SurfSideKick , WeirdOnTheWeb. If you do, remove them.
Sometimes when a program is removed, it leaves behind little bits and pieces. I need you to clean out your temp files and your temporary internet files. Instructions here..
This process will clean out your TEMP FILES and your TEMPORARY INTERNET FILES. Please do both steps:
Step 1 - DELETE TEMP FILES
* This procedure should be run from SAFEMODE for better results.
* click on START/ RUN and type %temp% and press the ok button.
This should open up the temp directory that your machine uses. You should do this for each user on your system. Please delete all
files that are found there. If you get an error when deleting a file, skip that file and delete all the others.
* Do this same process for %windir%\temp.
NOW RE-BOOT NORMALLY
Step 2 - DELETE TEMPORARY INTERNET FILES
* Now I want you to open up INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB, (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
When it is done, your Temporary Internet Files will now be deleted.
Now download and run CCleaner , this is a good safe program that will clean up a ton of garbage on your drive. It will also remove all your cookies. So if there are some that you want to keep, open the program, go to OPTIONS/COOKIES and all your cookies will load in the left window, just move the ones you want to keep to the right window. http://www.ccleaner.com/
What exactly is the error message that you are getting when you try to run Norton, this could be a windows issue and not related to malware. Post it here and let me research it.
I completed all of your suggestions and there was a ton of stuff in the Temp Folder. Also, I ran CCleaner and it removed a bunch of garbage.
In the Add/Remove dialogue window, there were no signs of the three programs you stated that I was to look for and delete.
I did another attempt to install Norton's AV (it installed somewhat ok), but when I try to open the program to run a full system scan I get the following error message:
"Norton AntiVirus has encountered an internal program error: Uninstall and re-install Norton AntiVirus. 3029,27"
I thought it may be a Window's related issue, however, the ironic part about this happens to be that my client's computer is the same computer my girlfriend has and I installed Norton AntiVirus 2005 on hers without any problems.
The 2 computers may be identical to a degree, but the software and hardware on both could make a difference. I have never been a big fan of Windows Me, it was one of Microsofts worst operating systems. if you can swing it, you may try upgrading to Xp.
According to the Symantec site, there could also be one of your spyware programs stopping it from running properly. Try to disable Trojan Hunter, matter of fact, it is only a 30 trial so if your done with it, remove it.
Try opening Norton and look through all the settings, they all have default settings. Try disableing each function one by one and try running a scan and see if it will let you scan without the error message.
Try running the scan in Safemode and see what happens, if you can run it than it is banging heads with another program.
Here is a link to Castle Cops that has a Symantec user forum for posting questions. Post there and see if someone else with the same problem has found an answer. http://castlecops.com/c19-Symantec.html
Well, your log is clean, there isn't anything else I can do for you
Here is a couple of other windows tech support sites, windows bbs is great, I had a problem with my video, lived with it for a month or so, posted in there forum and it was resolved in a couple of hours.
Try posting in this forum under "OTHER COMPUTER PROBLEMS "
Be sure to tell them you posted here and that your log is clean. They most likely won't need your log, just explain your problem in detail.
I hope you find the help you need, I will keep this thread open for a few days in case anything else related to this problem in the form of Malware comes up.
ken545,
I decided to skip Norton's AV and go with McAfee. Well, McAfee installed without any problems and I am scanning the computer now for viruses/malware/spyware.
I'm baffled as to why Norton wouldn't install? I will check out the links that you provided and I would like to help out as much as possible. I have tried to email "Daveai," but I keep getting the same message that I don't have permission to use that feature.
Any thoughts?
Again, thanks for your help. It is greatly appreciated and my client will be happy to have her computer returned.
~Dissenter
I PMd daveai and am waiting for a link to send you to contact him. Will reply to you when I get it.
I had a lady I work with bought the Mcafee Security suite, it caused more problems than you could imagine, we uninstalled it, and installed Norton and all is well. Who knows what a certain PC will accept and will not. I installed Diskeeper Lite on a bunch of computers where I work, they all worked well except for one that caused problems with a program that we use. Go Figure,
Here are some suggestions for keeping your computer clean and safe.
Now that your clean, we need to erase all possible older infected files that may still be lurking on your system. clean out your TEMP FILES
* This procedure should be run from SAFEMODE for better results.
To Enter SAFEMODE
* Go to START/ SHUT OF YOUR COMPUTER/ RESTART
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
* Then press the ENTER KEY ON YOUR KEYBOARD
Now, while in SAFEMODE,
* click on START/ RUN , and type %temp% and press the ok button.
This will open up the temp directory that your machine uses. GO TO EDIT/ SELECT ALL and delete all the contents of that folder.
* Do this for each user of your computer.
* Do this same process for %windir%\temp.
NOW RE-BOOT NORMALLY
DELETE TEMPORARY INTERNET FILES
* Open INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB, (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
* When it is done, your Temporary Internet Files will now be deleted.
Now we need to TURN OFF and then TURN BACK ON SYSTEM RESTORE.
This will remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent
any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points
which are likely to be infected)
Turn off System Restore.
* On the Desktop, right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* Check Turn off System Restore.
* Click Apply, and then click OK.
Reboot your System
Turn ON System Restore.
* On the Desktop, right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* UN-Check Turn off System Restore.
* Click Apply, and then click OK.
* Now while in System Restore, create a new Restore Point.
* Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.
* If you want to use a free program, try this one –> http://free.grisoft.com/doc/1
* Run SPYBOT SEARCH AND DESTROY/ CHECK FOR UPDATES/ IMMUNIZE and run a full system scan on a regular basis.
* Run AD-AWARE SE PERSONAL/ CHECK FOR UPDATES and run a FULL SYSTEM SCAN on a regular basis.
* Download and run SPYWARE BLASTER,
http://www.javacoolsoftware.com/
* Check for updates and enable all protection. This program will just sit in the background and help keep all the bad guys out.
* Download and install WINPATROL
http://www.winpatrol.com/download.html
* This program will warn you when any changes are being made to your system and give you the option to deny the change.
* WINDOWS UPDATES - Enable Automatic Updates
Right click on MY COMPUTER/ GO TO PROPERTIES/ AUTOMATIC UPDATES and put a mark in the radio button DOWNLOAD UPDATES FOR ME BUT LET ME CHOOSE WHEN TO INSTALL THEM.
* Consider surfing the net with the FireFox Browser You can download via my signature.It has more features and is a lot
more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.
When it asks you if you want it to be your default browser, say NO and take the checkmark out of the box to ask you again. After you
use this for awhile, you will want to make it your default.
* There companion THUNDERBIRD MAIL program was highly favored in PCWorld Magazine,, this to has a good spam filter
and is more secure than Outlook Express. http://www.mozilla.org/products/thunderbird/
Download and run CCleaner , it is a very safe program and will keep your system nice and spiffy. It will also remove your cookies, so when you run the program, go to OPTIONS/ COOKIES and move any cookies you want to keep from the left window to the right one. http://www.ccleaner.com/
As this topic has been resolved, the thread will be closed.
If you need this topic reopened, please request this by sending an email to us at the following link:(Click for address) Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.
If this is not your thread please start a New Topic.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
