Rorschach112

Managers
 View Profile  See their activity

  • Content Count

    425

  • Joined

  • Last visited

 Content Type 

Posts posted by Rorschach112

  3. Need Control Of Computer (hijackthis)[INACTIVE]

    in Malware Removal

    Posted

    Try this

    Please click here to download AVP Tool by Kaspersky.

    • Save it to your desktop.
    • Reboot your computer into SafeMode.

      You can do this by restarting your computer and continually tapping the
      F8
      key until a menu appears.

      Use your up arrow key to highlight SafeMode then hit
      enter
      .


    • Double click the setup file to run it.
    • Click Next to continue.
    • It will by default install it to your desktop folder.Click Next.
    • Hit ok at the prompt for scanning in Safe Mode.
    • It will then open a box There will be a tab that says Automatic scan.
    • Under Automatic scan make sure these are checked.


    • System Memory

    • Startup Objects

    • Disk Boot Sectors.

    • My Computer.

    • Also any other drives (Removable that you may have)

    • Then click on Scan at the to right hand Corner.
    • It will automatically Neutralize any objects found.
    • If some objects are left unneutralized then click the button that says Neutralize all
    • If it says it cannot be Neutralized then chooose The delete option when prompted.
    • After that is done click on the reports button at the bottom and save it to file name it Kas.
    • Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.

      Note: This tool will self uninstall when you close it so please save the log before closing it.

  4. Avg Wont Update After Being Hit By Trojan[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Download ComboFix from one of these locations:

    Link 1

    Link 2

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    • Double click on ComboFix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    RcAuto1.gif

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    whatnext.png

    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

  5. Need Control Of Computer (hijackthis)[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Please download the OTMoveIt3 by OldTimer or from here.

    • Save it to your desktop.
    • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
      :Processes
      explorer.exe

      :Services
      msmsnkd

      :Reg

      :Files
      c:\windows\system32\msmsn.exe

      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]


    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt3

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    Please download ATF Cleaner by Atribune.

    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.

    If you use Firefox browser

    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser

    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main menu to close the program.

    Please download Malwarebytes' Anti-Malware from Here or Here

    Double Click mbam-setup.exe to install the application.

    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.

    Extra Note:

    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

    Go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases

    [*]Click on My Computer under Scan.

    [*]Once the scan is complete, it will display the results. Click on View Scan Report.

    [*]You will see a list of infected items there. Click on Save Report As....

    [*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

  6. Need Control Of Computer (hijackthis)[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Download ComboFix from one of these locations:

    Link 1

    Link 2

    Link 3

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    • Double click on ComboFix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    RcAuto1.gif

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    whatnext.png

    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

  8. Trojan Fake Alert Virus (hijackthis Log)[INACTIVE]

    in Malware Removal

    Posted

    Do these steps in normal mode

    While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.

    Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

    • Open Spybot Search & Destroy.
    • In the Mode menu click "Advanced mode" if not already selected.
    • Choose "Yes" at the Warning prompt.
    • Expand the "Tools" menu.
    • Click "Resident".
    • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
    • In the File menu click "Exit" to exit Spybot Search & Destroy.

    1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

    O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

    O2 - BHO: (no name) - {4EB727B3-2FC9-418B-A557-B006BF1D05BF} - (no file)

    O2 - BHO: (no name) - {7F4FF6D5-E71D-4B1A-AD0B-A660C1FD1837} - (no file)

    O2 - BHO: (no name) - {89A9EFED-25F7-4866-995D-169F32321972} - (no file)

    O2 - BHO: (no name) - {bfc1cbf4-eee8-446d-b6d9-8a1144a6fe29} - (no file)

    O20 - AppInit_DLLs: cqvxsu.dll,avgrsstx.dll zycthq.dll

    2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

    Please click here to download AVP Tool by Kaspersky.

    • Save it to your desktop.
    • Reboot your computer into SafeMode.

      You can do this by restarting your computer and continually tapping the
      F8
      key until a menu appears.

      Use your up arrow key to highlight SafeMode then hit
      enter
      .


    • Double click the setup file to run it.
    • Click Next to continue.
    • It will by default install it to your desktop folder.Click Next.
    • Hit ok at the prompt for scanning in Safe Mode.
    • It will then open a box There will be a tab that says Automatic scan.
    • Under Automatic scan make sure these are checked.


    • System Memory

    • Startup Objects

    • Disk Boot Sectors.

    • My Computer.

    • Also any other drives (Removable that you may have)

    • Then click on Scan at the to right hand Corner.
    • It will automatically Neutralize any objects found.
    • If some objects are left unneutralized then click the button that says Neutralize all
    • If it says it cannot be Neutralized then chooose The delete option when prompted.
    • After that is done click on the reports button at the bottom and save it to file name it Kas.
    • Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.

      Note: This tool will self uninstall when you close it so please save the log before closing it.

    Also post a new HJT log

  9. My First Infection

    in Windows 10, 8, 7, Vista, and XP

    Posted

    Its a password stealer

    Looking at your system now, one or more of the identified infections is a backdoor Trojan.

    If this computer is ever used for on-line banking, I suggest you do the following immediately:

    1. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

    2. From a clean computer, change ALL your on-line passwords for email, for banks, financial accounts, PayPal, eBay, on-line companies, any on-line forums or groups you belong to.

    Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.

  14. Need Help With Trojan.zlob[INACTIVE]

    in Malware Removal

    Posted

    Hello

    1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

    O4 - HKLM\..\Run: [Windows Service] service.exe

    O4 - HKLM\..\RunServices: [Windows Service] service.exe

    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

    O20 - AppInit_DLLs:

    2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

    Please download the OTMoveIt3 by OldTimer or from here.

    • Save it to your desktop.
    • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
      :Processes
      explorer.exe

      :Services

      :Reg

      :Files
      C:\WINDOWS\service.exe

      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]


    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt3

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    Also post a new HJT log

  15. Zlob.g Trojan Infection[INACTIVE]

    in Malware Removal

    Posted

    Hello

    • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

  17. Zlob.g Trojan Infection[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.

    Download SDFix and save it to your Desktop.

    Double click SDFix.exe and it will extract the files to %systemdrive%

    (Drive that contains the Windows Directory, typically C:\SDFix)

    Please then reboot your computer in Safe Mode by doing the following :

    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    • Instead of Windows loading as normal, the Advanced Options Menu should appear;
    • Select the first option, to run Windows in Safe Mode, then press Enter.
    • Choose your usual account.

    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to Clipboard ready for posting back on the forum).
    • Finally paste the contents of the Report.txt back on the forum.

  18. Zedo.com Pop-ups[INACTIVE]

    in Malware Removal

    Posted

    Open notepad, click Format, uncheck wordwrap

    Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.

    Download SDFix and save it to your Desktop.

    Double click SDFix.exe and it will extract the files to %systemdrive%

    (Drive that contains the Windows Directory, typically C:\SDFix)

    Please then reboot your computer in Safe Mode by doing the following :

    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    • Instead of Windows loading as normal, the Advanced Options Menu should appear;
    • Select the first option, to run Windows in Safe Mode, then press Enter.
    • Choose your usual account.

    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to Clipboard ready for posting back on the forum).
    • Finally paste the contents of the Report.txt back on the forum.

  19. Trojan Fake Alert Virus (hijackthis Log)[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Please download ATF Cleaner by Atribune.

    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.

    If you use Firefox browser

    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser

    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main menu to close the program.

    Please download Malwarebytes' Anti-Malware from Here or Here

    Double Click mbam-setup.exe to install the application.

    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.

    Extra Note:

    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

    Go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases

    [*]Click on My Computer under Scan.

    [*]Once the scan is complete, it will display the results. Click on View Scan Report.

    [*]You will see a list of infected items there. Click on Save Report As....

    [*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

  20. Need Help With Trojan.zlob[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Please download the OTMoveIt3 by OldTimer or from here.

    • Save it to your desktop.
    • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
      :Processes
      explorer.exe

      :Services

      :Reg

      :Files
      C:\Documents and Settings\Administrator\javaplugin.exe

      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]


    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt3

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

  21. Need Help With Trojan.zlob[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Please download ATF Cleaner by Atribune.

    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.

    If you use Firefox browser

    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser

    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main menu to close the program.

    Please download Malwarebytes' Anti-Malware from Here or Here

    Double Click mbam-setup.exe to install the application.

    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.

    Extra Note:

    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

    Go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases

    [*]Click on My Computer under Scan.

    [*]Once the scan is complete, it will display the results. Click on View Scan Report.

    [*]You will see a list of infected items there. Click on Save Report As....

    [*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

  22. Need Help With Trojan.zlob[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Start OTScanIt2. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

    [Kill Explorer]

    [unregister Dlls]

    [Processes - Safe List]

    YN -> aawservice.exe -> %ProgramFiles%\Lavasoft\Ad-Aware 2007\aawservice.exe

    YN -> avgamsvr.exe -> %ProgramFiles%\Grisoft\AVG7\avgamsvr.exe

    YN -> avgcc.exe -> %ProgramFiles%\Grisoft\AVG7\avgcc.exe

    YN -> avgemc.exe -> %ProgramFiles%\Grisoft\AVG7\avgemc.exe

    YN -> avgupsvc.exe -> %ProgramFiles%\Grisoft\AVG7\avgupsvc.exe

    YN -> superantispyware.exe -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe

    YN -> teatimer.exe -> %ProgramFiles%\Spybot - Search & Destroy\TeaTimer.exe

    [Registry - Safe List]

    < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

    YN -> {D18E08C5-AC41-43AE-B754-ADCA921BDDB4} [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]

    YN -> {D8ED03EE-A95D-4062-80AC-B824BCFD80FD} [HKLM] -> %SystemRoot%\system32\awtsQKbx.dll [Reg Error: Value does not exist or could not be read.]

    < Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    YN -> "AVG7_CC" -> [C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP]

    YN -> "PDM Agent" -> %ProgramFiles%\PDM\PDM.exe [C:\Program Files\PDM\PDM.exe]

    < AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

    *AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls

    YN -> cbawxe.dll ->

    YN -> rnxkpv.dll ->

    < AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

    < LSA Authentication Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages

    *LSA Authentication Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages

    YY -> C:\WINDOWS\system32\awtsQKbx ->

    < LSA Authentication Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages

    [Files/Folders - Created Within 90 Days]

    NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp

    NY -> 3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp

    NY -> HijackThis.lnk -> %UserProfile%\Desktop\HijackThis.lnk

    NY -> VirtumundoBeGone.exe -> %UserProfile%\Desktop\VirtumundoBeGone.exe

    NY -> VundoFix Backups -> %SystemDrive%\VundoFix Backups

    NY -> xfjodmwv.ini -> %SystemRoot%\System32\xfjodmwv.ini

    NY -> hdngslrk.ini -> %SystemRoot%\System32\hdngslrk.ini

    NY -> xbKQstwa.ini2 -> %SystemRoot%\System32\xbKQstwa.ini2

    NY -> xbKQstwa.ini -> %SystemRoot%\System32\xbKQstwa.ini

    [Empty Temp Folders]

    [start Explorer]

    [Reboot]

    The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

    I will review the information when it comes back in.

  23. Need Help With Trojan.zlob[INACTIVE]

    in Malware Removal

    Posted

    Hello

    Download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.

    • Open the OTScanIt2 folder and double-click on OTScanIt.exe to start the program. Make sure you close all other programs and don't use the PC while the scan runs.
    • Under File Age at the top, change it from 30 days to 90 days
    • Under Additional Scans check the boxes beside Reg - ColumnHandlers, Reg - Desktop Components, Reg - Disabled MS Config Items, Reg - File Associations, Reg - NetSvcs, Reg - Protocol Filters, Reg - Protocol Handlers, Reg - SafeBoot Minimal, Reg - SafeBoot Network, Reg - Session Manager Settings, Reg - Winsock2 Catalogs, File - Lop Check, File - Purity Scan, Files - Signature Check, and Evnt - EventViewer Logs ( Last 10 Errors).
    • Under Rootkit Search change it to Yes
    • Under the Custom Scans box at the bottom left paste the following in
      %systemroot%\Prefetch\*.* /s
      %systemroot%\system32\drivers\*.dat
      %systemroot%\Temp\bca4e2da.$$$
      %systemroot%\Temp\ed47fa.$
      %systemroot%\Temp\fa56d7ec.$$$
      %systemroot%\System32\antiwpa.dll
      %PROGRAMFILES%\*crack*.
      %PROGRAMFILES%\*keygen*.
      %SYSTEMDRIVE%\*crack*.
      %SYSTEMDRIVE%\*keygen*.
      %SYSTEMDRIVE%\*.zip
      %SYSTEMDRIVE%\*.rar
      %SYSTEMDRIVE%\*.exe
      %systemroot%\*.zip
      %systemroot%\*.rar
      %systemroot%\system32\*.zip
      %systemroot%\system32\*.rar
      %PROGRAMFILES%\*.zip
      %PROGRAMFILES%\*.rar
      %PROGRAMFILES%\*.exe
      %DESKTOP%\*.zip
      %DESKTOP%\*.rar
      %DESKTOP%\*.exe
      %PROGRAMFILES%\Common Files\*bak*.
      %systemroot%\SYSTEM32\*bak*.
      %PROGRAMFILES%\*bak*.
      %USERNAME%\*.zip
      %USERNAME%\*.rar
      %USERNAME%\*.exe
      %USERPROFILE%\*.zip
      %USERPROFILE%\*.rar
      %USERPROFILE%\*.exe
      %ALLUSERSPROFILE%\*.zip
      %ALLUSERSPROFILE%\*.rar
      %ALLUSERSPROFILE%\*.exe
      %APPDATA%\*.zip
      %APPDATA%\*.rar
      %APPDATA%\*.exe
      %ALLUSERSSTARTMENU%\*.zip
      %ALLUSERSSTARTMENU%\*.rar
      %ALLUSERSSTARTMENU%\*.exe
      %ALLUSERSSTARTUP%\*.zip
      %ALLUSERSSTARTUP%\*.rar
      %ALLUSERSSTARTUP%\*.exe
      %ALLUSERSPROGRAMS%\*.zip
      %ALLUSERSPROGRAMS%\*.rar
      %ALLUSERSPROGRAMS%\*.exe
      %ALLUSERSAPPDATA%\*.zip
      %ALLUSERSAPPDATA%\*.rar
      %ALLUSERSAPPDATA%\*.exe
      %APPDATA%\*.zip
      %APPDATA%\*.rar
      %APPDATA%\*.exe
      %QUICKLAUNCH%\*.zip
      %QUICKLAUNCH%\*.rar
      %QUICKLAUNCH%\*.exe
      %STARTUP%\*.zip
      %STARTUP%\*.rar
      %STARTUP%\*.exe
      %STARTMENU%\*.zip
      %STARTMENU%\*.rar
      %STARTMENU%\*.exe
      %MYDOCUMENTS%\*.zip
      %MYDOCUMENTS%\*.rar
      %MYDOCUMENTS%\*.exe
      %PROGRAMFILES%\Mozilla Firefox\plugins\*.*
      %PROGRAMFILES%\Internet Explorer\*.*
      %PROGRAMFILES%\Mozilla Firefox\*.zip /s
      %PROGRAMFILES%\Mozilla Firefox\*.rar /s
      %PROGRAMFILES%\Mozilla Firefox\*.exe /s
      %PROGRAMFILES%\Internet Explorer\*.zip /s
      %PROGRAMFILES%\Internet Explorer\*.rar /s
      %PROGRAMFILES%\Internet Explorer\*.exe /s
      %SYSTEMDRIVE%\*.dat
      %SYSTEMROOT%\*.dat
      %SYSTEMROOT%\*.sys
      %systemroot%\system32\drivers\*.exe /s
      %systemroot%\system32\drivers\*.zip /s
      %systemroot%\system32\drivers\*.rar /s
      %APPDATA%\*.sys
      %systemroot%\system32\serauth1.dll
      %systemroot%\system32\serauth2.dll
      %systemroot%\system32\sysaudio.sys
      %PROGRAMFILES%\*TinyProxy*.

    • Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
    • When the scan is complete Notepad will open with the report file loaded in it.
    • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

    Use the Add Reply button and post the information back here in an attachment. I will review it when it comes in. The last line is < End of Report >, so make sure that is the last line in the attached report.

    Make sure you attach the report in your reply. If it is too big to upload, then zip the text file and upload it that way

  24. Trojan Fake Alert Virus (hijackthis Log)[INACTIVE]

    in Malware Removal

    Posted

    Helllo

    Please download the OTMoveIt3 by OldTimer or from here.

    • Save it to your desktop.
    • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
      :Processes
      explorer.exe

      :Services
      F111230803DEBA54

      :Reg

      :Files
      c:\program files\Webtools

      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]


    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt3

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.