#1
Member
Profile: Join Date: Mar 2008
Posts: 46
Computer Experience:
Computer virus, cant remove
I am trying to help my sister who seems to have gotten some kind of Virus on her computer, i have done many scans with many different programs but none of them seem to work. i am busy trying to find out the name of the virus on her computer but im not sure yet. SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)Ad -Aware 2007\aawservice.exehttp://runonce.msn.com/?v=msgrv75 http://www.yahoo.com/ http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://us.rd.yahoo.com/customize/ie/...ch/search.html http://www.yahoo.com/ http://zone.msn.com/binFrameWork/v10...I.cab55579.cab http://go.microsoft.com/fwlink/?linkid=39204 http://zone.msn.com/binframework/v10...t.cab55579.cab http://upload.facebook.com/controls/...toUploader.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://zone.msn.com/bingame/popcaploader_v10.cab http://chat.msn.com/controls/msnchat45.cab http://zone.msn.com/bingame/zpagames...p.cab56961.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Welcome to WindowsBBS AdmSirRed here , saving the file to your desktop.this link for your applicable programs.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.
#3
Member
Profile: Join Date: Mar 2008
Posts: 46
Computer Experience:
Ok i have done that and ran it an everything, it seems to have gone smoothly, how do i know it worked and things? do i have to post any kind of a log here again??
Last edited by AdmSirRed; 6th March 2008 at 06:26 .
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Quote:
Originally Posted by
noahdfear
Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply
Please post the C:\combofix.txt log and a new HijackThis log.
#5
Member
Profile: Join Date: Mar 2008
Posts: 46
Computer Experience:
Hijack listSP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)Ad -Aware 2007\aawservice.exehttp://runonce.msn.com/?v=msgrv75 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://www.yahoo.com/ http://zone.msn.com/binFrameWork/v10...I.cab55579.cab http://go.microsoft.com/fwlink/?linkid=39204 http://zone.msn.com/binframework/v10...t.cab55579.cab http://upload.facebook.com/controls/...toUploader.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://zone.msn.com/bingame/popcaploader_v10.cab http://chat.msn.com/controls/msnchat45.cab http://zone.msn.com/bingame/zpagames...p.cab56961.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
Code:
<pre>
----a-w 125,528 2008-01-29 22:23:34 C:\Program Files\Common Files\AOL\1166158722\EE\AOLHostManager .exe
----a-w 125,528 2008-01-29 22:24:06 C:\Program Files\Common Files\AOL\1166158722\EE\AOLHOS~1 .EXE
----a-w 79,448 2008-01-29 22:23:38 C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler .exe
----a-w 185,896 2008-01-29 22:23:39 C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w 30,208 2008-01-29 22:23:30 C:\Program Files\CyberLink\PowerDVD\PDVDServ .exe
----a-w 49,152 2008-01-29 22:23:31 C:\Program Files\CyberLink\PowerDVD\Language\Language .exe
----a-w 421,888 2008-01-29 22:23:28 C:\Program Files\Grisoft\AVG Free\avgcc .exe
----a-w 353,280 2008-01-29 22:23:31 C:\Program Files\Grisoft\AVG Free\avgemc .exe
----a-w 132,496 2008-01-29 22:23:34 C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe
----a-w 4,670,968 2008-01-21 17:50:31 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 968,696 2008-01-29 22:23:45 C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
----a-w 15,360 2008-02-14 03:04:37 C:\WINDOWS\system32\ctfmon .exe
</pre> http://www.gmer.net Ad -Aware 2007\aawservice.exe
#6
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Check the Add?remove programs list for and remove RegistryPowerCleaner by Winferno if listed.contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
File::
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
C:\WINDOWS\Tasks\rpc.job
RenV::
C:\Program Files\Common Files\AOL\1166158722\EE\AOLHostManager .exe
C:\Program Files\Common Files\AOL\1166158722\EE\AOLHOS~1 .EXE
C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler .exe
C:\Program Files\Common Files\Real\Update_OB\realsched .exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ .exe
C:\Program Files\CyberLink\PowerDVD\Language\Language .exe
C:\Program Files\Grisoft\AVG Free\avgcc .exe
C:\Program Files\Grisoft\AVG Free\avgemc .exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
C:\WINDOWS\system32\ctfmon .exe Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#7
Member
Profile: Join Date: Mar 2008
Posts: 46
Computer Experience:
ComboFix 08-03-05.1 - Tiffany 2008-03-07 15:35:54.2 - NTFSx86WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net Ad -Aware 2007\aawservice.exe
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"=-
Driver::
iMSPCLOj Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#9
Member
Profile: Join Date: Mar 2008
Posts: 46
Computer Experience:
Logfile of HijackThis v1.99.1SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)Ad -Aware 2007\aawservice.exehttp://runonce.msn.com/?v=msgrv75 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://www.yahoo.com/ http://zone.msn.com/binFrameWork/v10...I.cab55579.cab http://go.microsoft.com/fwlink/?linkid=39204 http://zone.msn.com/binframework/v10...t.cab55579.cab http://upload.facebook.com/controls/...toUploader.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://zone.msn.com/bingame/popcaploader_v10.cab http://chat.msn.com/controls/msnchat45.cab http://zone.msn.com/bingame/zpagames...p.cab56961.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net Ad -Aware 2007\aawservice.exe
#10
Member
Profile: Join Date: Mar 2008
Posts: 46
Computer Experience:
im sorry please ignore the first post i thought i already ran it but dident. heres the updated version.WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net Ad -Aware 2007\aawservice.exeHJT SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)Ad -Aware 2007\aawservice.exehttp://runonce.msn.com/?v=msgrv75 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://www.yahoo.com/ http://zone.msn.com/binFrameWork/v10...I.cab55579.cab http://go.microsoft.com/fwlink/?linkid=39204 http://zone.msn.com/binframework/v10...t.cab55579.cab http://upload.facebook.com/controls/...toUploader.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://zone.msn.com/bingame/popcaploader_v10.cab http://chat.msn.com/controls/msnchat45.cab http://zone.msn.com/bingame/zpagames...p.cab56961.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
#11
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Looks good. One of the infections you had disabled AVG AntiSpyware from starting with Windows. You can remedy that by Clicking Start>All Programs>AVG AntiSpyware. Once it opens, an icon for it will appear in your Notification area (down by the clock). Right click the icon and select Start with Windows. You can close the AVG AntiSpyware application.ATF Cleaner by Atribune and save it to your Desktop.Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of: Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
Recycle bin
The rest are optional - if you want it to remove everything check "Select All".
Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.
Reboot Kaspersky WebScanner Yes .The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Archives
Click OK
Now under select a target to scan:
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:
Save the file to your desktop.
#12
Member
Profile: Join Date: Mar 2008
Posts: 46
Computer Experience:
i clicked the link and followed it to the site howeever i was not prompted to download the active X contrl, and still was not prompted even after clicking the "scan now" button.
#13
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Lets run another tool then. Please download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select 'Perform Quick Scan ', then click Scan .
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked , and click Remove Selected .
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Post the entire report in your next reply along with a fresh HijackThis log.
#14
Member
Profile: Join Date: Mar 2008
Posts: 46
Computer Experience:
Malwarebytes' Anti-Malware 1.08MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
#15
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Now, in your Internet Explorer browser, click Tools>Internet Options on the menu. Select the Security tab. Make sure Internet Zone is selected then click Default Level, then Apply.
All times are GMT +1. The time now is 14:05 .
