sarahw
-
Content Count
424 -
Joined
-
Last visited
Content Type
Profiles
Forums
Calendar
Posts posted by sarahw
-
-
While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
- Open Spybot Search & Destroy.
- In the Mode menu click "Advanced mode" if not already selected.
- Choose "Yes" at the Warning prompt.
- Expand the "Tools" menu.
- Click "Resident".
- Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
- In the File menu click "Exit" to exit Spybot Search & Destroy.
Please download Malwarebytes' Anti-Malware from Here or Here
Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish,so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
- Open Spybot Search & Destroy.
-
Hi,
Can you please reboot your computer and rescan with Hijack This. Post the log in a reply.
-
Hi,
If you got infected from that program, you should uninstall it.
Check this item in Hijack This:
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
then delete this file:
c:\Windows\SYSTEM32\ALCMTR.EXE
Please do an online scan with Kaspersky WebScanner
Click on Accept
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT
- Now click on Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Extended (if available otherwise Standard)
- Scan Options:
- Scan Archives
Scan Mail Bases
[*]Click OK
[*]Now under select a target to scan:
- Select My Computer
[*]This will program will start and scan your system.
[*]The scan will take a while so be patient and let it run.
[*]Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
[*]Save the file to your desktop.
[*]Copy and paste that information in your next post.
- Scan using the following Anti-Virus database:
- The program will launch and then begin downloading the latest definition files:
-
hi,
1.
Open notepad again. Copy and paste the following.
@ECHO off
sc stop roytctm
sc stop solewxte
sc stop soxpeca
sc stop tdydowkc
sc stop wsldoekd
sc stop noytcyr
sc stop mabidwe
sc stop afisicx
sc delete roytctm
sc delete solewxte
sc delete soxpeca
sc delete tdydowkc
sc delete wsldoekd
sc delete noytcyr
sc delete mabidwe
sc delete afisicx
exitIn Notepad click on the "File" menu > Save As... Under "File name" type fix.bat and Change "Save as type" to All Files, save it to your desktop.
2.
Please download Malwarebytes' Anti-Malware from Here or Here
Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish,so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
-
Hi
Sorry about the delay.
Download SDFix and save it to your Desktop.
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in Safe Mode by doing the following :
- Restart your computer
- After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
- Instead of Windows loading as normal, the Advanced Options Menu should appear;
- Select the first option, to run Windows in Safe Mode, then press Enter.
- Choose your usual account.
- Open the extracted SDFix folder and double click RunThis.bat to start the script.
- Type Y to begin the cleanup process.
- It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
- Press any Key and it will restart the PC.
- When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
- Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum). - Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
Please download Malwarebytes' Anti-Malware from Here or Here
Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish,so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Post back with both logs.
- Restart your computer
-
-
Basically, an administrator is an account that has full privilages on the computer. Other types of accounts are Guest, and restrictied. If you are the computer owner, it is most likely an administrator.
The account you first entered when installing windows is an administrator account.
-
1. Log on as Administrator or as a member of the Administrators group.
2. Click Start, click Control Panel, and then double-click Add or Remove Programs.
3. Click Add/Remove Windows Components. The Windows Components Wizard starts.
4. In the Components list, click to clear the check box next to Internet Explorer.
5. Click Next.
6. In the Completing the Windows Components Wizard screen, click Finish.
7. Recheck the box next to Internet Explorer.
8. Follow the prompts, insert the disk if needed.
Tell me how the computer is running.
-
1.
Please download Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan (Full scan is optional. According to the program's creator Quick Scan will do just fine.).
Click Scan.
When the scan is complete, click OK, then Show Results to view the results.
If Malware is found...
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad.
Please save it to your desktop.
NOTE: Logs can be retrieved at a later date from the Malwarebytes' Anti-Malware main screen:
Launch Malwarebytes' Anti-Malware.
Click the Logs tab.
Double-click log-mm.dd.yyyy [xxxxxx].txt.
In your next reply post the Malwarebytes' Anti-Malware log.
2.
- Open HiJackThis
- Click on the "Config..." button on the bottom right
- Click on the tab "Misc Tools"
- Check off the 2 boxes next to the Box that says "Generate StartupList log"
- Click on the button "Generate StartupList log"
- Copy and past the StartupList from the notepad into your next post
- Open HiJackThis
-
1.
Updating Java and Clearing Cache
- Go to Start > Control Panel double-click on the Java Icon (coffee cup) in the Control Panel.
- It will say "Java Plug-in" under the icon.
Please find the update button or tab in the Java Control Panel. Update your Java then reboot. - If you are unable to update you can manually update by going here:
http://www.java.com/en/download/manual.jsp
[*]After the reboot, go back into the Control Panel and double-click the Java Icon.
[*]Under Temporary Internet Files, click the Delete Files button.
[*]There are three options in the window to clear the cache - Leave ALL 3 Checked
- Downloaded Applets
Downloaded Applications
Other Files
[*]Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
[*]Click OK to leave the Java Control Panel.
2.
Please download Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan (Full scan is optional. According to the program's creator Quick Scan will do just fine.).
Click Scan.
When the scan is complete, click OK, then Show Results to view the results.
If Malware is found...
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad.
Please save it to your desktop.
NOTE: Logs can be retrieved at a later date from the Malwarebytes' Anti-Malware main screen:
Launch Malwarebytes' Anti-Malware.
Click the Logs tab.
Double-click log-mm.dd.yyyy [xxxxxx].txt.
In your next reply post the Malwarebytes' Anti-Malware log.
3.
Click HERE and run an online scan with Kaspersky WebScanner
- Click on Kaspersky Online Scanner
- You will be promted to install an ActiveX component from Kaspersky, Click Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT
- Now click on Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard) - Scan Options:
Scan Archives
Scan Mail Bases
- Scan using the following Anti-Virus database:
[*]Click OK
[*]Now under select a target to scan:
- Select My Computer
[*]This will program will start and scan your system.
[*]The scan will take a while so be patient and let it run.
[*]Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
[*]Save the file to your desktop.
[*]Copy and paste that information into your next post.
- The program will launch and then begin downloading the latest definition files:
- Go to Start > Control Panel double-click on the Java Icon (coffee cup) in the Control Panel.
-
Hi,
Welcome to the site
I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.
I want you to show hidden files. There are instructions HERE to help you do this.
You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in Safe Mode so you will be unable to access this thread at that time.
Please dont use any of the tools without specific instructions. Some of them are dangerous (and could leave your computer in worse condition that it is when infected) if used incorrectly.
These instructions should be read first, then followed. If you do not understand something, don't be afraid to ask, or see if I'm on chat.
-
Hi,
Welcome to the site
I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.
I want you to show hidden files. There are instructions HERE to help you do this.
You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in Safe Mode so you will be unable to access this thread at that time.
Please dont use any of the tools without specific instructions. Some of them are dangerous (and could leave your computer in worse condition that it is when infected) if used incorrectly.
These instructions should be read first, then followed. If you do not understand something, don't be afraid to ask, or see if I'm on chat.
-
1.
Updating Java and Clearing Cache
- Go to Start > Control Panel double-click on the Java Icon (coffee cup) in the Control Panel.
- It will say "Java Plug-in" under the icon.
Please find the update button or tab in the Java Control Panel. Update your Java then reboot. - If you are unable to update you can manually update by going here:
http://www.java.com/en/download/manual.jsp
[*]After the reboot, go back into the Control Panel and double-click the Java Icon.
[*]Under Temporary Internet Files, click the Delete Files button.
[*]There are three options in the window to clear the cache - Leave ALL 3 Checked
- Downloaded Applets
Downloaded Applications
Other Files
[*]Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
[*]Click OK to leave the Java Control Panel.
2.
Please download Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan (Full scan is optional. According to the program's creator Quick Scan will do just fine.).
Click Scan.
When the scan is complete, click OK, then Show Results to view the results.
If Malware is found...
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad.
Please save it to your desktop.
NOTE: Logs can be retrieved at a later date from the Malwarebytes' Anti-Malware main screen:
Launch Malwarebytes' Anti-Malware.
Click the Logs tab.
Double-click log-mm.dd.yyyy [xxxxxx].txt.
In your next reply post the Malwarebytes' Anti-Malware log.
3.
Click HERE and run an online scan with Kaspersky WebScanner
- Click on Kaspersky Online Scanner
- You will be promted to install an ActiveX component from Kaspersky, Click Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT
- Now click on Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard) - Scan Options:
Scan Archives
Scan Mail Bases
- Scan using the following Anti-Virus database:
[*]Click OK
[*]Now under select a target to scan:
- Select My Computer
[*]This will program will start and scan your system.
[*]The scan will take a while so be patient and let it run.
[*]Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
[*]Save the file to your desktop.
[*]Copy and paste that information into your next post.
- The program will launch and then begin downloading the latest definition files:
- Go to Start > Control Panel double-click on the Java Icon (coffee cup) in the Control Panel.
-
Hi,
Welcome to the site
I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.
I want you to show hidden files. There are instructions HERE to help you do this.
You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in Safe Mode so you will be unable to access this thread at that time.
Please dont use any of the tools without specific instructions. Some of them are dangerous (and could leave your computer in worse condition that it is when infected) if used incorrectly.
These instructions should be read first, then followed. If you do not understand something, don't be afraid to ask, or see if I'm on chat.
-
Ok, great.
-
There doesn't seem to be anything sinister in your logs but we can remove this one:
Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below:
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.
Copy the following line into OTMoveIt2 and click MoveIt!
C:\Windows\system32\ALCMTR.EXE
- Open HiJackThis
- Click on the "Config..." button on the bottom right
- Click on the tab "Misc Tools"
- Check off the 2 boxes next to the Box that says "Generate StartupList log"
- Click on the button "Generate StartupList log"
- Copy and past the StartupList from the notepad into your next post
- Open HiJackThis
-
Is that AVG error gone?
-
Ok, We'll run a antivirus and antimalware scan to see if theres anything lurking around that would cause that:
1.
Please download Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan (Full scan is optional. According to the program's creator Quick Scan will do just fine.).
Click Scan.
When the scan is complete, click OK, then Show Results to view the results.
If Malware is found...
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad.
Please save it to your desktop.
NOTE: Logs can be retrieved at a later date from the Malwarebytes' Anti-Malware main screen:
Launch Malwarebytes' Anti-Malware.
Click the Logs tab.
Double-click log-mm.dd.yyyy [xxxxxx].txt.
In your next reply post the Malwarebytes' Anti-Malware log.
2.
Click HERE and run an online scan with Kaspersky WebScanner
- Click on Kaspersky Online Scanner
- You will be promted to install an ActiveX component from Kaspersky, Click Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT
- Now click on Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard) - Scan Options:
Scan Archives
Scan Mail Bases
- Scan using the following Anti-Virus database:
[*]Click OK
[*]Now under select a target to scan:
- Select My Computer
[*]This will program will start and scan your system.
[*]The scan will take a while so be patient and let it run.
[*]Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
[*]Save the file to your desktop.
[*]Copy and paste that information into your next post.
- The program will launch and then begin downloading the latest definition files:
- Click on Kaspersky Online Scanner
-
Looks like its gone.
Are you having any other problems?
-
Hi,
Lets see what the fix has done.
Can you post another Hijack This log please.
-
Please download OTCleanIt from HERE to your desktop.
Double click to run it. It will clean up the assortment of tools used during malware removal. When it has finnished, it will ask you to reboot so it can remove itself.
You can now Rehide your system files by using the reversal of these instructions HERE
Congratulations, your log is now clean.
A well protected computer should have at least an Anti Virus and Firewall, an Anti Spyware is also great addition to your computers security. Here is a list of tools I like to recommend to people that will help ensure safe surfing on the internet, and to help you from getting infected again.
Note: DO NOT install more than one antivirus or Firewall program. They will conflict, and provide less protection, not more. Uninstall any existing Anti Virus\Firewall programs if you're going to install a new one.
Free Online Scans:
Free Active X and Java based online scans. You can use these scans from other companies and it will not interfere with your current Anti Virus. If you find that you are infected, post a Hijack This log in the forums.
- Kapersky online scan
- Panda Online Scan
- F-Secure Online Scan
- TrendMicro HouseCall online scan
- Bit Defender online scan
Free Temp Cleaners:
Use these tools to clean temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. ATF cleaner recommended.
Free Firewall Downloads:
You must have a Firewall installed on your computer. This helps stop anything from leaving or entering your computer without your permission.
Free Anti Spyware Downloads:
An Antispyware is a great tool that can help remove infections along side your Anti Virus. Some include real time protection, scheduled scans and automatic definition updates.
- AVG Antispyware
- A-Squared Antispyware
- SpywareGuard
- SpywareBlaster
- SpywareTerminator
- Spybot Search & Destroy
- Ad Aware
Free Anti Virus Downloads:
A must have for all computers. Avast! recommended.
- SpywareTerminator With ClamAV Enabled.
- AntiVir
- Avast!
- Grisoft AVG
- Bit Defender Free
- a² Free
- Comodo BOClean
- SuperAntiSpyware
Other Free Tools:
- SpywareGuard
Works as a Spyware "Shield" to protect your computer from getting malware in the first place. - IE-SpyAd
This tool puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. - Memtest86
Great memory testing software. - CPU-Z
This application gives detailed information about your system in a nice layout - Speedfan
Returns and monitors system temperatures. - Windows Updates
It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
Useful Reading:
Slow Computer? HERE are some tips to speed it up.
Where do infections come from? How did I get an infection? Click HERE for some tips on preventing future infections.
If you have any other problems or questions be sure to ask.
- Kapersky online scan
-
Ok, read the instructions on this page. There is a tool you can use:
-
That is an Environment variable.
%WinDir% Specifies the path where windows is installed.
So replace %WinDir% with the location of Windows (looking at your log, it is C:\Windows)
to translate again:
Delete C:\Windows\system32\$sys$filesystem\aries.sys
Along time ago computers only had disks, these were 5 1/4" disks called A: and B:. When hard drives came into the picture, it was called C: then disks dies out so we only had A: and C: then D: for other hard drives and cd drives. That no longer applies these days as you can have any drive as any letter (but this can cause problems if particular software is written to look for a particular drive). By using enviromental variables, programmers would write: %windir% instead of C:\Windows so that the user or program can identify the correct location.
Here are some more examples:
%SystemDrive% would be the main system drive (in your case C:)
%ProgramFiles% would generally be C:\Program Files
%APPDATA% on your computer would be C:\Documents and Settings\{username}\Application Data
-
Download and scan with SUPERAntiSpyware Free for Home Users
- Double-click SUPERAntiSpyware.exe and use the default settings for installation.
- An icon will be created on your desktop. Double-click that icon to launch the program.
- If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
- Under "Configuration and Preferences", click the Preferences button.
- Click the Scanning Control tab.
- Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
[*]Click the "Close" button to leave the control center screen.
[*]Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
[*]On the left, make sure you check C:\Fixed Drive.
[*]On the right, under "Complete Scan", choose Perform Complete Scan.
[*]Click "Next" to start the scan. Please be patient while it scans your computer.
[*]After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
[*]Make sure everything has a checkmark next to it and click "Next".
[*]A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
[*]If asked if you want to reboot, click "Yes".
[*]To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
[*]Click Close to exit the program.
- Close browsers before scanning.
- Double-click SUPERAntiSpyware.exe and use the default settings for installation.
My Hijack This Logs[RESOLVED]
in Malware Removal
Posted
Hi,
Please download Malwarebytes' Anti-Malware from Here or Here
Double Click mbam-setup.exe to install the application.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.