What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Yeah, I Got Big Problems....

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Yes, it's indeed the Sound Blaster Live I saw from your Combofixlog, but wanted to be sure:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E]
Shell\AutoRun\command E:\ctrun\ctcdrun.exe

We'll look at the sound issue afterwards. Good to hear your CD-RW works now.
Let's deal with malware first.
Post #32
Ok, Vundo Fix Log.


VundoFix V6.3.23

Checking Java version…

Scan started at 5:08:21 PM 5/16/2007

Listing files found while scanning….

C:\WINDOWS\MICROS~1.NET\barolg.dll
C:\WINDOWS\MICROS~1.NET\glorab.bak1
C:\WINDOWS\MICROS~1.NET\glorab.bak2
C:\WINDOWS\MICROS~1.NET\glorab.ini
C:\WINDOWS\MICROS~1.NET\glorab.ini2
C:\WINDOWS\MICROS~1.NET\glorab.tmp
C:\WINDOWS\SYSTEM32\eymycnwt.exe
C:\WINDOWS\SYSTEM32\gsvkqooe.exe
C:\WINDOWS\SYSTEM32\hacfsljt.exe
C:\WINDOWS\System32\knejlfxl.dll
C:\WINDOWS\SYSTEM32\naooacwl.exe
C:\WINDOWS\SYSTEM32\uifefkjj.exe

Beginning removal…

Attempting to delete C:\WINDOWS\MICROS~1.NET\barolg.dll
C:\WINDOWS\MICROS~1.NET\barolg.dll Has been deleted!

Attempting to delete C:\WINDOWS\MICROS~1.NET\glorab.bak1
C:\WINDOWS\MICROS~1.NET\glorab.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\MICROS~1.NET\glorab.bak2
C:\WINDOWS\MICROS~1.NET\glorab.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\MICROS~1.NET\glorab.ini
C:\WINDOWS\MICROS~1.NET\glorab.ini Has been deleted!

Attempting to delete C:\WINDOWS\MICROS~1.NET\glorab.ini2
C:\WINDOWS\MICROS~1.NET\glorab.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\MICROS~1.NET\glorab.tmp
C:\WINDOWS\MICROS~1.NET\glorab.tmp Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\eymycnwt.exe
C:\WINDOWS\SYSTEM32\eymycnwt.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\gsvkqooe.exe
C:\WINDOWS\SYSTEM32\gsvkqooe.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\hacfsljt.exe
C:\WINDOWS\SYSTEM32\hacfsljt.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\naooacwl.exe
C:\WINDOWS\SYSTEM32\naooacwl.exe Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\uifefkjj.exe
C:\WINDOWS\SYSTEM32\uifefkjj.exe Has been deleted!

Performing Repairs to the registry.
Done!
Post #33
New HJT log.

Logfile of HijackThis v1.99.1
Scan saved at 5:26:15 PM, on 5/16/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {82E1B850-0609-4E11-8406-9CFC1BC1CF29} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
Post #34
That worked. :)

Malware should be gone now - as well as the popups - let me know.

Check and fix next leftover in HijackThis:

O2 - BHO: (no name) - {82E1B850-0609-4E11-8406-9CFC1BC1CF29} - (no file)

Then, Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6u1.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6u1".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation, Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    - Examples of older versions in Add or Remove Programs:
    • Java 2 Runtime Environment, SE v1.4.2
    • J2SE Runtime Environment 5.0
    • J2SE Runtime Environment 5.0 Update 6
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.
Concerning your sound. Can you tell me exactly what problems you are having with your sound?
Do you hear any sound at all? Also not the Windows sounds like logging off or logging in?
Do you get any errors?
Post #35
By the way, I just spotted something in your Combofixlog - so perform next step again: * Go to start > control panel > Display properties > Desktop > Customize Desktop… > Web tab Select C:\Program Files\XEROX\popokyc.html you find in there and press the delete button on the right. Hit ok below > apply in previous window.
Post #36
Ok, I'll do that right now. As for the sound, it's like it never even loads on initial startup. I can never hear anything on my speakers, and some video won't even play because I get Windows Media error message that says "Windows Media Player cannot play the file because there might be a problem with your sound or video device. Try installing an updated device driver."

I'll get a beep every now and again from the computer when I click on something though. Is this a driver not loading?
Post #37
Hi,

Here are some excellent Troubleshootings for your DVD (since you're also having problems with this) and your sound:

DVD + Sound Troubleshooting:

http://support.microsoft.com/kb/308012
http://www.tigerdirect.com/static/html/audio-trouble.html
http://tech.yahoo.com/gd/pc-troubleshootin…udio-cds/166316
http://www.smartcomputing.com/editorial/ar…1.asp&guid=

Specific SOUND Troubleshooting:

http://www.computerhope.com/issues/ch000208.htm
http://support.microsoft.com/kb/307918
http://www.5starsupport.com/faq/sound.htm
http://wahiduddin.net/troubleshooting/trouble_sound.htm (skip the step there about Mac Computers)
Post #38
Ok, it won't let me delete the Java from Add/Remove programs. It tells me "…Windows installer service could not be accessed. This can occur if your running windows in safe mode, or if the windows installer is not correctly installed. Contact your support personnel for assistance."
Post #40
Ok, I got the old Java off, and went to install the updated version, but it says my OS is not a supported version because it doesn't have SP2. Should I install SP2 and then update Jave? Sound note: My device manager is empty. Does that mean anything?
Post #41
So, device manager shows an empty blank page?

Do next please..

Go to Start > run and type: services.msc
Search in the list for Plug and Play.
If you receive a Configuration Manager message, click OK.
In the Startup Type list, select Automatic, and then click OK.
Then reboot your computer.

Let me know if that displays Device Manager afterwards.
Post #42 last edited

Should I install SP2 and then update Jave

Yes, you definitaly should install SP2, because that may also already fix a lot of problems and make your system more secure.
Keep in mind, in case you're having a pirated version of XP, you won't be able to update.
So, perform the update as a first step.

It's already really late here, so I am going to log off now, so I'll answer tomorrow.
In anyway, we removed the malware now…
Post #43
Unbelievable. That's the first time I've heard my computer log on in god knows how long. I'm acutally listening to iTunes right now. THANK YOU SO MUCH SIR. I can watch the video I saved on my desktop, but no music plays and I don't have the little speaker in the system tray (lower right corner next to clock).
Post #44 last edited
AWSOME, nevermind, the video plays music now too. Still no speaker icon though… And the device manager is loaded with everything now.
Post #45 last edited
Are you still there? Should I install SP2 and follow up with new Java and be done with it? Thanks again for all your help, I can't tell you how much I appreciate it. EDIT: I got the speaker icon now. Should I turn the tea timer back on through Spybot, and also create a system restore?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI