What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Multiple problems!

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
sinnead,

It's the "real time" componant of your AVG.

AVG
Please open the AVG Control Center program -> double-click on the "AVG Resident Shield" component (looks like this: [external image: Posted Image]) -> deselect the "Turn on AVG Resident Shield" checkmark and save the setting.
When we are done cleaning you will need to enable the AVG Resident Shield, ( I will let you know when) just open the AVG Control Center program -> double-click on the "AVG Resident Shield" component -> select the "Turn on AVG Resident Shield" checkmark and save the setting.
Post #17
Three things. When ComboFix initiated, it said there was an update for it, which I clicked. After that, all it said was "This handle is not legit", or something to that effect. It repeated this statement for 5 lines. I closed the window, because nothing was happened, and reinitiated the scan, which was successful, but did not reconnect to the internet. After 10 minutes, I rebooted manually. One problem- I forgot to save the scan :smack: . So I started over, this time saved the scan, which is below. I really hope this doesn't alter anything. I'm almost hopeless with anything like this! Sorry.

ComboFix 09-01-05.05 - sherrylynne 2009-01-06 18:03:02.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.446.166 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\sherrylynne\Desktop\CFScript.tst
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\documents and settings\MDG USER\out.0in
.

((((((((((((((((((((((((( Files Created from 2008-12-07 to 2009-01-07 )))))))))))))))))))))))))))))))
.

2009-01-05 21:55 . 2009-01-05 21:54 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-01-03 13:41 . 2009-01-03 13:41 d——– c:\documents and settings\sherrylynne\Application Data\HP
2009-01-02 21:09 . 2009-01-02 21:09 d——– c:\program files\Microsoft Silverlight
2009-01-01 10:30 . 2009-01-01 10:30 d——– c:\program files\NOS
2009-01-01 10:30 . 2009-01-01 10:31 d——– c:\documents and settings\All Users\Application Data\NOS
2008-12-30 14:27 . 2008-12-30 14:27 d——– c:\program files\Trend Micro
2008-12-30 14:18 . 2008-12-30 14:19 d——– c:\program files\ERUNT
2008-12-30 13:02 . 2008-12-30 13:02 dr——- c:\documents and settings\sherrylynne\Programs
2008-12-30 00:04 . 2008-12-30 00:04 d——– c:\documents and settings\sherrylynne\Application Data\Malwarebytes
2008-12-29 20:09 . 2008-12-29 20:10 d——– c:\documents and settings\sherrylynne\Application Data\Nikon
2008-12-28 21:27 . 2008-12-29 21:36 d——– c:\documents and settings\sherrylynne\Contacts
2008-12-28 21:14 . 2009-01-06 18:01 d——– c:\documents and settings\sherrylynne\Application Data\HPAppData
2008-12-28 21:14 . 2008-12-30 14:29 d——– c:\documents and settings\sherrylynne\Application Data\AVGTOOLBAR
2008-12-28 21:08 . 2008-12-28 21:08 d——– c:\documents and settings\sherrylynne\Application Data\eBay
2008-12-28 21:06 . 2009-01-05 20:15 d——– c:\documents and settings\sherrylynne
2008-12-25 22:23 . 2008-12-25 22:23 d——– c:\program files\Global ProBiz
2008-12-22 12:24 . 2008-12-22 12:24 d——– c:\documents and settings\cliff\Application Data\Malwarebytes
2008-12-21 20:32 . 2008-12-21 20:32 d——– c:\program files\IrfanView
2008-12-21 14:37 . 2008-11-06 02:03 d——– C:\SDFix
2008-12-20 18:18 . 2008-12-20 18:18 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-20 18:18 . 2008-12-20 18:18 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-20 18:18 . 2008-12-03 19:59 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-20 18:18 . 2008-12-03 19:59 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-13 11:39 . 2008-12-13 11:39 10,095 –a—— C:\logfile

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 04:54 410,984 —-a-w c:\windows\system32\deploytk.dll
2009-01-06 02:51 ——— d—–w c:\documents and settings\All Users\Application Data\WholeSecurity
2009-01-05 21:37 ——— d—–w c:\documents and settings\cliff\Application Data\HPAppData
2009-01-03 21:49 20 —h–w c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2008-12-31 18:30 ——— d—–w c:\program files\HP
2008-12-28 02:54 ——— d—–w c:\program files\Java
2008-12-26 05:23 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-18 13:17 ——— d—–w c:\program files\shaw
2008-12-13 18:41 ——— d—–w c:\program files\Kodak
2008-12-13 18:39 ——— d—–w c:\program files\Common Files\Kodak
2008-12-08 04:38 ——— d—–w c:\program files\Common Files\Nikon
2008-12-06 22:39 ——— d—–w c:\program files\Nikon
2008-12-06 22:39 ——— d—–w c:\program files\Common Files\muvee Technologies
2008-12-06 22:39 ——— d—–w c:\documents and settings\All Users\Application Data\Nikon
2008-12-06 22:35 ——— d—–w c:\documents and settings\All Users\Application Data\Ultima_T15
2008-12-06 22:35 ——— d—–w c:\documents and settings\All Users\Application Data\EnterNHelp
2008-12-06 22:34 ——— d—–w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-06 22:33 ——— d—–w c:\program files\ArcSoft
2008-11-30 23:10 ——— d—–w c:\program files\PopCap Games
2008-11-30 02:30 ——— d—–w c:\documents and settings\All Users\Application Data\MumboJumbo
2008-11-30 02:21 774,144 —-a-w c:\program files\RngInterstitial.dll
2008-11-30 02:21 ——— d—–w c:\program files\Real
2008-11-30 02:21 ——— d—–w c:\program files\Common Files\Real
2008-11-26 14:28 ——— d—–w c:\program files\iTunes
2008-11-26 14:28 ——— d—–w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-26 14:27 ——— d—–w c:\program files\iPod
2008-11-26 14:27 ——— d—–w c:\program files\Common Files\Apple
2008-11-26 14:22 ——— d—–w c:\program files\QuickTime
2008-11-26 13:26 ——— d—–w c:\program files\Safari
2008-11-09 07:01 ——— d—–w c:\documents and settings\All Users\Application Data\PopCap Games
2008-10-23 12:36 286,720 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 21:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 21:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 21:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 21:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 21:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 21:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 21:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 21:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 21:06 268,648 —-a-w c:\windows\system32\mucltui.dll
2008-10-16 21:06 208,744 —-a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 —-a-w c:\windows\system32\wininet.dll
2008-10-07 23:49 1,971,378 —-a-w C:\SetupImgBurn_2.4.2.0.exe
2008-05-07 23:01 0 —-a-w c:\documents and settings\cliff\Application Data\wklnhst.dat
2008-03-10 22:12 32 —-a-r c:\documents and settings\All Users\hash.dat
2008-03-03 02:46 2,696 —-a-w c:\documents and settings\MDG USER\Application Data\wklnhst.dat
2008-09-26 12:05 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008092620080927\index.dat
.

((((((((((((((((((((((((((((( snapshot@2009-01-05_19.01.39.64 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-09-07 22:16:28 136,512 —-a-w c:\windows\Downloaded Program Files\CONFLICT.1\popcaploader.dll
+ 2005-10-20 19:02:28 163,328 —-a-w c:\windows\ERDNT\AutoBackup\1-6-2009\ERDNT.EXE
+ 2009-01-07 00:46:47 2,273,280 —-a-w c:\windows\ERDNT\AutoBackup\1-6-2009\Users\00000001\NTUSER.DAT
+ 2009-01-07 00:46:48 159,744 —-a-w c:\windows\ERDNT\AutoBackup\1-6-2009\Users\00000002\UsrClass.dat
- 2009-01-03 20:49:01 141,048 —-a-w c:\windows\hpoins14.dat
+ 2009-01-06 03:24:55 141,048 —-a-w c:\windows\hpoins14.dat
- 2008-12-28 21:27:26 144,792 —-a-w c:\windows\system32\java.exe
+ 2009-01-06 04:54:51 144,792 —-a-w c:\windows\system32\java.exe
- 2008-12-28 21:27:26 144,792 —-a-w c:\windows\system32\javaw.exe
+ 2009-01-06 04:54:51 144,792 —-a-w c:\windows\system32\javaw.exe
- 2008-12-28 21:27:26 148,888 —-a-w c:\windows\system32\javaws.exe
+ 2009-01-06 04:54:51 148,888 —-a-w c:\windows\system32\javaws.exe
+ 2009-01-07 00:44:52 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_24c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Location Finder"="c:\program files\Microsoft Location Finder\LocationFinder.exe" [2005-08-24 101080]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-01 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"shawnotify"="c:\progra~1\shaw\update\siuloader.exe" [2008-07-15 378144]
"eBayToolbar"="c:\program files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-08-06 652528]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-05 136600]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-10 c:\windows\RTHDCPL.exe]

c:\documents and settings\sherrylynne\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ "autocheck autochk *"\0stera\0lsdelete

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [2006-04-29 4064]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-08-26 97928]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-26 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-26 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-08-26 76040]
S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-01 33752]
S4 ioloFileInfoList;iolo FileInfoList Service; [x]
S4 ioloSystemService;iolo System Service; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bfe92955-d8ab-11dd-88c0-00167617abca}]
\Shell\AutoRun\command - E:\autorun.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-01-07 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 14:21]

2009-01-01 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 14:21]

2008-12-28 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

2007-06-17 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

2008-12-28 c:\windows\Tasks\Uniblue SpyEraser Nag.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []

2007-06-17 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp:\\Start.shaw.ca
mStart Page = hxxp:\\Start.shaw.ca
IE: eBay Search - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\QuickTax 2007\ic2007pp.dll

c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder
hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

O16 -: {134F7664-943D-3BB9-65F5-70B91DF46C86} - hxxp://www.xxxcodec.com/xxxcodec-v3.508.exe

c:\windows\Downloaded Program Files\HPSWUpdate.ocx - O16 -: {EBF85371-A38F-485B-B28F-0B4C82D25937}
hxxp://update.hpphoto.com/download/HPSWUpdate.ocx
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-06 18:05:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\ASFWHide]
"ImagePath"="\??\c:\docume~1\LURLEE~1\LOCALS~1\Temp\ASFWHide"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\avgrsstx.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(708)
c:\windows\system32\avgrsstx.dll
.
Completion time: 2009-01-06 18:09:34
ComboFix-quarantined-files.txt 2009-01-07 01:09:31
ComboFix2.txt 2009-01-07 00:40:24
ComboFix3.txt 2009-01-06 02:02:28

Pre-Run: 227,564,130,304 bytes free
Post-Run: 227,548,594,176 bytes free

218 — E O F — 2008-12-18 10:04:56
Post #19
Seems ok. To be honest, the thing with the multiple windows doesn't happen all the time, just enough to be an irritant :lol: But so far, so good! Thank you so much!
Post #20
Just out of curiosity- do I keep everything I've downloaded on my desktop when we are finished? Or is it safe to delete the icons, but keep them in the computer?(I really don't know which icons are safe to delete, and which ones I have to leave there, lol)
Post #21
sinnead, We will get rid of almost everything. Take some time to give it a good test drive, if it seems good, we will clean up and let you go. If a problem re-occurs, you know where to find us. :P
Post #22
Hi, Tomk, the only problems that have cropped are the odd "page done with errors"(forgot to click on the yellow error sign- will do it next time), and the fact that my desktop just stays up. It doesn't go to the screensaver at all. If I don't hit the "switch user" at night, it's still on my desktop screen when I get up in the morning.
Post #23
sinnead,

I believe that your malware problems are cured. :thumbup:
You may still have a software problem. :o

Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.
Javara can be kept or deleted. Your choice. You shouldn't need it anymore but you can use it for updatiing.
Keep your Mbam. Update it and run a scan once a month.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

As far as your lingering problems, I suggest you post a questions to the Tech Team in the Windows forum. Post a link there back to this thread so they can get a little idea of what we've done.

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #24
Read and understood :D ! Will do the combofix this morning, the reading over the next couple of days. And thanks again! If the combofix doesn't solve everything, I will repost in the appropriate forums!
Post #26
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI