PC infected by malware
#1
Posted 17 June 2006 - 12:49 AM
Register to Remove
#2
Posted 18 June 2006 - 02:56 PM
http://service1.syma...000031316555206 and Microsoft:
"Microsoft recommends that you have only one anti-virus program installed on your computer."
So many issues can be caused by the conflictions as these programs run at the same time it is impossible to troubleshoot other issues. I suggest you uninstall one of them completely, then if you are still having issues, post a new HJT log and I will take a look.
This information may also help once you have removed one of the av programs:
http://www.microsoft...s/IEtopten.mspx
http://vlaurie.com/c...s/runbetter.htm
http://www.linkgrind...rs_article.html
http://www.techbuild...ecipes/59201471
Thanks...pskelley
TomCoyote forum
Expert Member
#3
Posted 19 June 2006 - 06:26 AM
#4
Posted 19 June 2006 - 10:26 AM
#5
Posted 19 June 2006 - 11:51 AM
The problem is to many logs and not enough volunteers to helpYour reply was very timely because I was feeling quite ignored, wondering whether I did anything wrong. Novice in forum
Let's discuss McAfee/Ave first. If I had only seen this:
d:\progra~1\mcafee\mcafee antispyware\massrv.exe I would not have mentioned it because the antispyware program should not have caused issues with AVG antivirus. I was however seeing this:
d:\program files\mcafee.com\agent\mcdetect.exe
d:\PROGRA~1\mcafee.com\agent\mctskshd.exe
D:\PROGRA~1\mcafee.com\agent\mcagent.exe
D:\progra~1\mcafee\MCAFEE~1\masalert.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - d:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - d:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
and that sure looked like two antivirus programs running to me. I can see no reason why you can't run the McAfee Antispyware program if you wish.
I believe you should contact your ISP and ask them to check, to make sure your settings are right because that could be your problem. The kind of issues you describe are usually ISP related.
Make sure you review this information in case it have something to do with your browser:
http://www.microsoft...s/IEtopten.mspx
I would also like you to run system file checker to make sure a corrupt or mising file is not the problem, make sure you have your Windows CD handy in case you are asked for it.
Click Start > Run, type in sfc /scannow, hit Enter.
Note: there is a space between sfc and /scannow
This should replace any corrupted/missing system files and will hopefully fix things.
You still have a couple of items in a TEMP folder that look like McAfee, lets do a good cleaning and remove those items unless you can see a reason for them.
ewido scan:
Please download Ewido Security Suite it is a trial version of the program.
- Install ewido security suite
- Launch ewido, there should be an icon on your desktop double-click it.
- The program will now go to the main screen
- On the left hand side of the main screen click update
- Then click on Start Update
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates
Once the updates are installed do the following:
- Click on scanner
- Click on Complete System Scan and the scan will begin.
- NOTE: During some scans with ewido it is finding cases of false positives.**
- You will need to step through the process of cleaning files one-by-one.
- If ewido detects a file you KNOW to be legitimate, select none as the action.
- DO NOT select "Perform action on all infections"
- If you are unsure of any entry found select none for now.
- Once the scan has completed, there will be a button located on the bottom of the screen named Save report
- Click Save report.
- Save the report .txt file to your desktop.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")
Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
F3 - REG:win.ini: run=
O4 - HKLM\..\Run: [msci] D:\DOCUME~1\b\LOCALS~1\Temp\2006619235018_mcinfo.exe /insfin
Close all programs but HJT and all browser windows, then click on "Fix Checked"
Enable hidden files&folders..reverse the process when finished.
http://www.xtra.co.n...1916458,00.html
RIGHT Click on Start then click on Explore. Locate and delete these items:
D:\DOCUMENTS & Settings~1\b\LOCALS~1\Temp\2006619235018_mcinfo.exe <<< delete everything in that TEMP folder (not the folder)
C:\Windows\Prefetch\ >>> delete the contents (NOT THE FOLDER)
Prefetch info: http://www.windowsne...refetch-XP.html
Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions http://www.ccleaner.com/help/tour1.asp
Run CCleaner, Windows & Applications when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do.
Restart the computer and post the ewido scan results and a new HJT log. My gut feeling is this is an issue with your Service Provider or your Browser. Please let me know about any changes in performance when you try the suggestions posted above. Your ISP given the information about the problem, should be able to check to see if there is a problem with your settings. I see no malware, and this cleaning can not hurt.
Thanks...Phil
Edited by pskelley, 19 June 2006 - 11:54 AM.
#6
Posted 20 June 2006 - 11:25 AM
#7
Posted 22 June 2006 - 01:58 PM
http://boards.cexx.o...topic.php?t=957
http://russelltexas....re/allclear.htm
http://forum.malware...wtopic.php?t=14
http://www.bleepingc...topict2520.html
http://cybercoyote.o...not-admin.shtml
Thanks...pskelley
#8
Posted 22 June 2006 - 01:58 PM
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.
Coyote's Installed programs for prevention:
http://forums.tomcoy...showtopic=31418
The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.
Visit the CoyoteStore http://TomCoyote.org/coyotestore.php
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users