#1
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
Virus affecting Ctrl Alt Del, IE, and Mcaffee if not more:(
Hi everyone,SP2 (WinNT 5.01.2600)HJT \HijackThis.exehttp://www.dallascowboys.com/ http://edits.mywebsearch.com/toolbar...p=ZSzim001YYUS http ://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptophttp://h50203.www5.hp.com/HPISWeb/Cu...ataManager.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab http://update.microsoft.com/windowsu...?1163371869890
Didn't find the information you thought to find?Similar Threads
#2
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
oops - more to report
I forgot this info...........
#3
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Hello and welcome to WindowsBBS Forums.Subratam Bleeping Computing Next , then Install , make sure "Run fixit" is checked and click Finish.
Quote:
Check for missing files
Go here and run the fix appropriate to your version of Windows: http://www.tech-forums.net/computer/topic/29806.html
#4
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
Info asked
Thank you so much for helping to guide me through thisSP2 (WinNT 5.01.2600)HJT \HijackThis.exehttp://edits.mywebsearch.com/toolbar...p=ZSzim001YYUS http ://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptophttp://h50203.www5.hp.com/HPISWeb/Cu...ataManager.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab http://update.microsoft.com/windowsu...?1163371869890
#5
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
OK, that didn't really yeild what I was looking for, but thats ok. We can move on from there.ALL instructions carefully BEFORE proceeding.HJT .Options tab, then the Program Options tab and uncheck load at windows startup .shields tab and uncheck home page shield and automatically restore default without notification Killbox .Delete on Reboot ", and then select "All files ".c:\windows\system32\ldcore.dll Paste from Clipboard ".Delete File " button. Click "Yes " at the Delete on Reboot prompt. Click "No " at the Pending Operations prompt.click here combofix.exe Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply
Note: check the boxes next to them and press the "Fix Checked" button with HijackThis . When you are doing this, make sure you have No IE windows, or other browsers open , including this one. Reboot if I have specified below, and post a fresh HijackThis log.R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = :0http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab HJT
#6
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
New Logs
TeMerc,SP2 (WinNT 5.01.2600)HJT \HijackThis.exehttp://edits.mywebsearch.com/toolbar...p=ZSzim001YYUS http ://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptophttp://h50203.www5.hp.com/HPISWeb/Cu...ataManager.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://update.microsoft.com/windowsu...?1163371869890
#7
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Ok, very good work. I'd like you to DL and run another anti-spyware scanner. It will eliminate some of what was in the ComboFix file along with some registry additions, which would be hard to do manually.AVG Anti-Spyware 7.5 formerly Ewido Anti-Spyware from HERE This is a 30 day trial of the program Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need run ewido and update the definition files.
On the main screen select the icon "Update " then select the "Update now " link.
Next select the "Start Update " button, the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner " icon at the top of the screen, then select the "Settings " tab.
Once in the Settings screen click on "Recommended actions " and then select "Quarantine ".
Under "Reports "
Select "Automatically generate report after every scan "
Un-Select "Only if threats were found "
safe mode , this way:Turn on the computer
Immediately begin tapping the <F8 > key.
Use the arrow keys to highlight Safe Mode and press the <Enter > key.
IMPORTANT: Select the "Scanner " icon at the top and then the "Scan " tab then click on "Complete System Scan ".
ewido will now begin the scanning process, be patient this may take a little time.Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions "
Next select the "Reports " icon at the top.
Select the "Save report as " button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan.(Please edit out any cookie, Recyler and System Volume Information Folder references )
HJT and post those logs along with the Ewido log.
#8
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
New Logs
Here are the three logs you asked for. The virus scan you had me download and run found 28 different issues and I ran the fixes, but still stuff is ******* upSP2 (WinNT 5.01.2600)HJT \HijackThis.exehttp://edits.mywebsearch.com/toolbar...p=ZSzim001YYUS http ://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptophttp://h50203.www5.hp.com/HPISWeb/Cu...ataManager.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://update.microsoft.com/windowsu...?1163371869890
#9
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
OK, lets proceed with what remains.ALL instructions carefully BEFORE proceeding.Killbox .Delete on Reboot ", and then select "All files ".C:\WINDOWS\system32\_000910_.tmp.dll Paste from Clipboard ".Delete File " button. Click "Yes " at the Delete on Reboot prompt. Click "No " at the Pending Operations prompt.Note :If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here HJT and post both logs back here for me to review, thanks.
#10
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
New Logs Again
TecMerc,SP2 (WinNT 5.01.2600)HJT \HijackThis.exehttp://edits.mywebsearch.com/toolbar...p=ZSzim001YYUS http ://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptophttp://h50203.www5.hp.com/HPISWeb/Cu...ataManager.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://update.microsoft.com/windowsu...?1163371869890
#11
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
OK, just a few minor items remain, how is the machine performing at this point, please let me know._000910_.tmp.dll<<<--this one Easy Internet signup<<<--this one HJT logs, so you can delete the folders:MyWebSearch<<<<---this folder FunWebProducts<<<<---this folder
#12
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
Update
TecMerc,
#13
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Try uninstalling the McAfee software, reboot and then re-install it. Sometimes these apps get a little corrupted from the malwares.
#14
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
Still acting funning
TecMerc,http://us.mcafee.com/apps/vsh10/en-u...true&subid=48%
#15
Inactive
Profile: Join Date: Nov 2006
Posts: 12
Computer Experience:
I don't think that whol url posted - it is belowhttp://us.mcafee.com/apps/vsh10/en-us/vsh10/
All times are GMT +1. The time now is 05:49 .
I wish I knew more. If there is anything else you can help with, ot would greatly apprecita it. THank you!
