What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Desperate Housewife Needs Help!

35 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi awells,

I don't think there's any problem caused by the quarantine files, those files are encrypted so cannot re-infect you, I was just cleaning them out as a matter of tidiness. Unfortunately AdWatch looks like being the problem.

Looks like you're going to have to uninstall AdAware (you're not the first person who's had to do this) to enable us to remove those registry settings.

Go to Control panel > Add/Remove Programs and uninstall AdAware.

Reboot your computer

Disable your Anti-Virus.

Run a scan with HJT and check the following items.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

O4 - HKLM\..\Run: [n1] C:\documents and settings\owner\local settings\temp\n1.exe
O4 - HKLM\..\Run: [jUyV] C:\documents and settings\owner\local settings\temp\jUyV.exe
O4 - HKLM\..\Run: [tylcvcn] C:\WINDOWS\tylcvcn.exe
O4 - HKLM\..\Run: [clfb] C:\WINDOWS\crvwafj.exe
O4 - HKLM\..\Run: [fohorn4c] C:\WINDOWS\system32\fohorn4c.exe
O4 - HKLM\..\Run: [Rweibc] C:\Program Files\Tpprqfk\Dvyl.exe
O4 - HKLM\..\Run: [msci] C:\DOCUME~1\Owner\LOCALS~1\Temp\200584113827_mcinfo.exe /insfin
O4 - HKCU\..\Run: [Pyvoyvsv] C:\WINDOWS\system32\l?gonui.exe


Close all open windows and click Fix Checked to remove them.

Re-install AdAware. (you should not be prompted, but if you are allow everything).

Re-Enable your Anti-Virus.

Run a new HJT scan and post me the log please.
Post #17
Well, I did everything and all went smoothly, except I can't find my Ad Aware cd so I had to download the free version. I don't have Ad Watch now, so I can't tell if it still detects those registry modifications. Does that matter?

Logfile of HijackThis v1.99.1
Scan saved at 3:43:12 PM, on 4/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TiVo\Desktop\TiVoNotify.exe
C:\Program Files\TiVo\Desktop\TiVoServer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\KODAK\KODAK Picture Transfer Software\PTS.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Documents and Settings\Owner\My Documents\HijackThis\HijackThis.exe
C:\PROGRA~1\Yahoo!\YUM\yum.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us6.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us6.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://att.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [P3000x_S2P] C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" /service /registry /auto:TivoTransfer
O4 - HKCU\..\Run: [TivoNotify] "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" /service /registry /auto:TivoNotify
O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /registry /auto:TivoServer
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: KODAK Picture Transfer Software.lnk = C:\Program Files\KODAK\KODAK Picture Transfer Software\PTS.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1134528794326
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1134529242185
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak06.pictures.aol.com/ygp/aol/plug…US.9.1.6.18.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/sbc/TrueInstallSBC.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: QuickBooksDB - Intuit, Inc. - C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgrN.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - Unknown owner - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe" /service (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Post #18
The free version does not have AdWatch, so you don't have the Real Time protection that that offered, any "on demand" scans that you do use the same definitions and scan engine so they will be just as effective as the paid version.

The registry entries are gone, otherwise they would show in your HJT log.

What was happening was that AdAware creates a copy of your Registry when it is created and notifies you of any changes to it so that you can allow or forbid them. This is fine, but it doesn't seem to stop the bad guys getting things onto your machine (as can be seen by the fact that your computer got infected). However when it came to us trying to remove the bad registry entries it was the very process set up to protect you that was preventing their removal.

Normally it's just a matter of switching off AdWatch, making the changes and then allowing them when prompted, however occasionally (more often than I'd like) there are problems with AdWatch and it doesn't work properly necessitating that we uninstall it.

If you find your AdAware disc it should be OK to re-install it, if you need the assurance of Real Time Protection you might consider installing Spybot S&D, it comes with a Real Time Protection known as Teatimer (needs to be checked upon install), I'll post details below.

Are you still noticing any problems?, because it appears your system is now all clean. If not, it's time to secure your system to prevent against further intrusions.

THESE STEPS ARE VERY IMPORTANT

Lets reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to clean the restore points.
  • Turn off System Restore.
    • On the Desktop, right-click My Computer.
    • Click Properties.
    • Click the System Restore tab.
    • Check Turn off System Restore.
    • Click Apply, and then click OK.
  • Reboot.
  • Turn ON System Restore.
    • On the Desktop, right-click My Computer.
    • Click Properties.
    • Click the System Restore tab.
    • UN-Check *Turn off System Restore*.
    • Click Apply, and then click OK.
  • NOTE: only do this ONCE, NOTon a regular basis
We need to re hide system files.

To do so, please follow the steps below:
  • Double-click My Computer.
  • Click the Tools menu, and then click Folder Options.
  • Click the View tab.
  • Put a check by "Hide file extensions for known file types."
  • Under the "Hidden files" folder, select "Do not show hidden files and folders."
  • Check "Hide protected operating system files."
  • Click Apply, and then click OK.

Updating Windows and Internet Explorer

IMPORTANT: You need to update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you're running Microsoft Office, or any portion thereof, go to Microsoft's Office Update site and make sure you have at least all the critical updates installed. (Free at Microsoft Office Update).

Make your Internet Explorer more secure
  • From within Internet Explorer click on Tools > Options > Security > Internet > Custom Level.
  • Make sure these options are set as follows:
    • Download signed ActiveX controls to Prompt
    • Download unsigned ActiveX controls to Disable
    • Initialize and script ActiveX controls not marked as safe to Disable
    • Installation of desktop items to Prompt
    • Launching programs and files in an IFRAME to Prompt
    • Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Press the Apply button and then the OK to exit the Internet Properties page.
The following are free programs that are designed to keep your computer clean. A brief description is included with each item, click on name to go to download site.
  • Adaware SE Personal
    Adaware is a free program. It scans for known spyware on your computer. These scans should be run at least once every two weeks. For more information, see this tutorial
  • Spybot S & D
    Spybot is a scanner like Adaware. It scans for spyware and other malicious programs. It is important to have both Adaware and Spybot on your computer because each program provides unique detection and protection measures. Spybot has preventitive tools that stop programs from even installing on your computer.
    To see how to set this up as well as more spybot features, see here
  • SpywareBlaster
    Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes "kill bits" in the registry, so that certain activex controls can't install.
    If you don't know what activex controls are, see here
  • IE Spyad
    It puts many bad webpages on your restricted zones LIST. This means that you can still view the "bad" webpages, but the webpages can't do certain things (such as use javascripts and cookies). Use IE Spyad for single account computers, and IE Spyad 2 for multi account computers.
  • Hosts file:
    • Every version of windows has a hosts file as part of them.
    • In a very basic sense, they are used to locate webpages.
    • We can customize a hosts file so that it blocks certain webpages.
    • However, it can slow down certain computers.
    • This is why using a hosts file is optional!!
    • Make sure you read the instructions on how to install the hosts file, here.
  • If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
    • Click the start button (at the lower left hand corner of your screen)
    • Click run
    • In the dialog box, type services.msc
    • hit enter, then locate dns client
    • Highlight it, then double-click it.
    • On the dropdown box, change the setting from automatic to manual.
    • Click ok
  • Use an Anti Virus Software - It's very important that your computer has an anti-virus software running. This alone can save you a lot of trouble with malware in the future. See this link for a LISTing of some, on line & their stand-alone anti virus programs:
    Computer Safety On line - LIST of free Anti virus programs
  • Use a Firewall - I cannot stress enough how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.
    See here to choose one.
  • Site Advisor This is a utility that can be downloaded and installed. It loads an icon to the taskbar of your browser (versions for IE and Firefox), indicating the trustworthiness of the site you are on. Green for safe, Red for suspicious. Click on the icon to access details that SiteAdvisor has about the site.

Just a final reminder for you.
  • UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
  • Run Spybot and Adaware regularly. (Once a week minimum)
  • It is important that you visit http://www.windowsupdate.com regularly. This will ensure you always have the latest security updates installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Once again, please post and tell me how things are going with your system… problems etc.

Gary R

The above is a general post I give when someone's computer is clean. Obviously you have already taken care of some of the issues mentioned, but it is important that you read through them, and address any that you may have missed.

Keep secure.

Gary R
Post #19
Gary, You've been extremely helpful!!! Thank you, thank you, thank you!!! I don't seem to notice anymore problems. Initially, I didn't really notice anything other than the computer running slowly and those registry modification notices at startup. I did regular scans with Ad Aware and would quarantine anything it found so I thought I was fixing any potential problems. My internet browser (At&t Yahoo DSL) offers its own internet security protection so I have been using that for my virus and spyware protection. However, about a week ago a notice popped up that said it detected the Nilage trojan. I wasn't given any options on how to deal with it. The little pop up notice only allowed me to click on "Ok". It was at that point that I decided to seek help. The computer seems to be running fine now, but I do have a few additional questions for you. 1) Is it bad to have more than one spyware or antivirus program running at the same time? When I switched over to the internet security package offered by my browser, I was advised to uninstall any other software. 2) I have 3 computer networked in my home via a wireless router, in addition to 2 Tivo boxes that use the router. I thought that I had set up my firewall settings to protect myself, but I'm not sure that I have done it correctly. Although my router is encrypted, could this be where I am at risk? Perhaps I didn't set up the router correctly and now I am vulnerable to attacks? 3) The most important question I have for you is…My husband's business files are kept on the computer that was infected. With the problems that were just on that computer, how likely is it that someone was able to get ahold of that info? Again, thank you so much for your help! ~awells
Post #20
Hi awells, Glad things are running well for you. You must not have more than one Anti-Virus or Firewall running Real Time protection on your computer. However you can have several anti-malware programmes in addition (only use one with "active" protection). It's the Real Time/Active protection systems that suffer from conflicts, as they all tend to hook into the same core system resources. Most anti-malware programmes can be run on a demand basis only (by which I mean they only scan when you ask for one) so it's OK to have more than one. The router should protect you from incoming infections, but will not stop infections that have got through from "phoning home", which is why we recommend a personal firewall is installed on your computer. It's often the first indication of an infection when your firewall starts asking you to allow outgoing processes you don't recognise, so is an absolute must. I don't have too much experience with routers as I have a stand alone system myself, so am probably not the best person to seek advice from with regards to router settings. However, having a router or firewall will not keep you completely safe, that is also determined by your browsing and other computer habits. Your infection most probably came via something you downloaded, an e-mail you recieved and opened, or something else that required some interaction from yourself (or someone who uses your computer). Firewalls/Routers are unable to block things of this kind as they are entering by "normal" means and not on unexpected ports, your Anti-Virus will of course pick up some of these items, but there are new infection varieties produced every day and AV companies are always playing catch up. The best way to remain clean is to be a suspicious sort of person. I don't wish to be alarmist, and I'm certainly not suggesting you get paranoid about being online, just be careful about what you click on. Don't download from sources you don't know and trust, don't ever open e-mail attachments (even if they appear to be from someone you know) until you've checked with the sender. Delete unopened any unsolicited e-mails (no matter how interesting they may seem). The hosts file I recommended in my last post will block you from going to many sites which are known sources of Malware infections so you can't end up on them accidentally, currently there's about 16,000 entries in the MVPS hosts file and it is updated regularly (usually about once a month). Lastly, there was nothing to indicate any sort of keylogger or backdoor trojan with the infection you had, it seems to have been an Adware attack, I would have warned you had there been any indication of a danger to sensitive information, but it was wise of you to ask. I'll leave this thread open for another couple of days in case there's any other questions you wish to ask.
Post #21
OMG!! Gary, help!! I just tried to restart my computer after downloading Spybot Search & Destroy and now I get a message that says "Windows could not start because the following file is missing or corrupt: \system32\hal.dll. Please re-install a copy of the above file. I have no idea what happened! I don't have a copy of Windows XP. It was pre-installed on my computer. I don't know what to do. Can you help? I tried to restart into Safe Mode, but that doesn't work either. ~awells
Post #22 last edited
Hi awells,

Not sure quite what's happened here, installing Spybot should not have caused this.

Are you able to see the Safe Boot menu when you hit F8 on boot up, if so try selecting Last known good configuration from the menu and then hit enter.

Let me know if this enables you to boot up.


Should you not be able to boot after selecting Last known good configuration and you can see the boot menu, try the following.
  • Hit F8 on power up.
  • From the boot menu select Safe Mode with Command Line
  • You should get a Command Screen.
  • Type the following C:\Windows\System32\restore\rstrui.exe then hit Enter
  • This should bring up System Restore screen.
  • Select Restore my computer to an earlier time and hit Next
  • Select a Restore Point from before you installed Spybot and click through the nexts till the restore process starts.
Lets hope one of these gets you going, because if the Hal.dll file is actually damaged or your Boot.ini file has somehow got corrupted I don't know offhand if we can recover the situation without recourse to Recovery Console (which is on Windows install disk).

I'll wait to see whether the suggestions above work before I ask to see if any of the other helpers has any solution to your problem.
Post #23
I can press F8 and get to the black screen, but when I choose Last Known Configuration it tries to reboot and then I get a message that says "When trying to update a password, this return status indicates that the value provided as the current password is not correct". Then the computer shuts down and tries to reboot. The message keepscoming up and it goes by so fast that I had to read it a few times to see the entire message. At the top of the message it says "lsass.exe-System Error". I am really panicking over this!
Post #24
Try the command line option described in my last post (I added it later so you may not have seen it), if that doesn't work I'm going to have to refer to colleagues who may have experienced something similar, it's a new one to me.
Post #25
I can't get to the command line. I tried every option and the only thing it does is reboot itself and give me the same message. :wall: I really don't want to lose my photos and business files (assuming I haven't already).
Post #26
I've posted your problem at the site where I trained (I'm more familiar with the system there than here at TC), however it's likely to be a while before I get any replies so it'll probably be the morning before I get back to you. It's just coming up to 11.15 pm here, so I'll be around for another hour or so, and if I get anything positive I'll get back to you ASAP. Sorry you're having this trouble. Gary
Post #28
Yes. It will definitely recover your system (provided the original cause of the corruption was not hardware instigated), but you will lose all your files. The symptoms are very like to those of the Sasser worm, but you definitely had no signs of that on any of your logs earlier. The same symptoms however can come from a corrupted Boot.ini file or a corrupted hal.dll file and this is much more likely (though why they should have got corrupted is not clear). Had you a "Genuine" windows disk we could have corrected either incidence using Recovery Console, but with an OEM installation that's just not possible. I fear at this stage a reformat and re-install may be your only option, but I'd prefer to wait till the morning and hope that some of the experts at MRU get back to me with some constructive way forward.
Post #29
OK, got some feedback, and a possible avenue of action. You're obviously using another computer to communicate with me, is this machine near to the faulty machine, if so we may be able to slave your faulty system and thereby be able to repair your faulty Boot.ini/Hal.dll files. I don't have experience of slaving drives, so I'll try to get someone to advise who's done this.
Post #30
Gary, I was able to get my computer back up and running, but I seem to have lost some of my files. I didn't lose all of them though, isn't that weird? I'm not quite sure what to do now. I just have this feeling that my files are in there somewhere, I just don't know how to get to them. I do have 2 other computers near the troubled one…one is a laptop though, so I'm not sure if that will work to do the slave thing that you mentioned. I'd really like to try to recover those files if possible. Is this something that you know how to do or should I ask someone else? Thanks, awells

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI