#1
Senior Member
Profile: Join Date: Jan 2002
Posts: 434
Computer Experience:
[Resolved] Computer Virus Problems
Several months ago, my grandaughter had a problem with her computer. HJT Report ===============AMD Athlon(tm) 64 X2 Dual Core Processor 4600+ | Socket AM2 | 2405/308mhzwww.getantivirusplusnow.com www.secure-plus-payments.com www.getavplusnow.com www.securesoftwarebill.com pr ms www.google.ae www.google.as www.google.at www.google.az www.google.ba www.google.be www.google.bg www.google.bs www.google.ca www.google.cd www.google.com.gh www.google.com.hk www.google.com.jm www.google.com.mx www.google.com.my www.google.com.na www.google.com.nf www.google.com.ng www.google.ch www.google.com.np www.google.com.pr www.google.com.qa www.google.com.sg www.google.com.tj www.google.com.tw www.google.dj www.google.de www.google.dk www.google.dm www.google.ee www.google.fi www.google.fm www.google.fr www.google.ge www.google.gg www.google.gm www.google.gr www.google.ht www.google.ie www.google.im www.google.in www.google.it www.google.ki www.google.la www.google.li www.google.lv www.google.ma www.google.ms www.google.mu www.google.mw www.google.nl www.google.no www.google.nr www.google.nu www.google.pl www.google.pn www.google.pt www.google.ro www.google.ru www.google.rw www.google.sc www.google.se www.google.sh www.google.si www.google.sm www.google.sn www.google.st www.google.tl www.google.tm www.google.tt www.google.us www.google.vu www.google.ws www.google.co.ck www.google.co.id www.google.co.il www.google.co.in www.google.co.jp www.google.co.kr www.google.co.ls www.google.co.ma www.google.co.nz www.google.co.tz www.google.co.ug www.google.co.uk www.google.co.za www.google.co.zm www.google.com www.google.com.af www.google.com.ag www.google.com.ar www.google.com.au www.google.com.bn www.google.com.br www.google.com.by www.google.com.bz www.google.com.cu www.google.com.ec www.google.com.fj www.google.com www.bing.com www.search.yahoo.com www.googleads.g.doubleclick.net www.pubads.g.doubleclick.net www.partner.googleadservices.com www.partner.googleadservices.com SP1 (KB953595)SP1 (KB958484)SP1 SP2 )SP2 )SP2 (KB927978)SP2 (KB936181)SP2 (KB954430)SP2 (KB973688)SP1 (KB963707)Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001731F8243A. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP ) server.Dhcp [1002] - The IP address lease 70.45.10.209 for the Network Card with network address 001731F8243A has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
Didn't find the information you thought to find?Similar Threads
#2
Administrator
Profile: Join Date: Dec 2001
Location: 35⁰ 53'55.1" N, 14⁰ 28'37.5" E
Posts: 3,977
Computer Experience:
I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etc… ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page here , and here .I would strongly recommend that you uninstall them, Note:
#3
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 9,959
Computer Experience:
Download HostsXpert ( http://www.majorgeeks.com/Hoster_d4626.html ) and then follow the steps below:HostsXpert.zip HostsXpert.exe by double clicking on it.Restore MS Hosts File and then click OK.X to exit the programHere Here **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop** Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Very Important! disable your anti-virus , script blocking and any anti-malware real-time protection before "unpredictable results" .Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. NOTE1. Recovery Console NOTE 2. always do so .Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it startsPlease do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall** Make sure, you re-enable your security programs, when you're done with Combofix. DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!! HijackThis :http://www.trendsecure.com/portal/en...kthis/download Installer under Version 2.0.2 Do NOT attempt to fix anything! NOTE. If you're using Vista, or 7, right click on HijackThis , and click Run as Administrator
#4
Senior Member
Profile: Join Date: Jan 2002
Posts: 434
Computer Experience:
Hi broni, i was unable to restore MS Hosts File when running HostsXpert.zip. I received a message as folows:ad ,f0,23, \ad ,f0,23, \SP3 (WinNT 5.01.2600)http://www.yahoo.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 www.getantivirusplusnow.com www.secure-plus-payments.com www.getavplusnow.com www.securesoftwarebill.com pr ms http://www.imgag.com/kiw/toolbar/dow...lerControl.cab http://download.netmarble.com/web/nm...MStarter24.cab http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab http://upload.facebook.com/controls/...oUploader5.cab http://www.nvidia.com/content/Driver...sysreqlab3.cab http://s.nx.com/activex/public_new/nxpm.cab http://security.symantec.com/sscv6/S...in/AvSniff.cab http://community.webshots.com/html/atx/wsaxcontrol.cab http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab http://upload.facebook.com/controls/...oUploader3.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab https://webdl.symantec.com/activex/symdlmgr.cab https://mpsnare.iesnare.com/StmOCX.cab http://www.lineage.co.kr/common/ocx/ncweb.cab http://upload.facebook.com/controls/...Uploader55.cab http://user.buddybuddy.co.kr/cab/BBNPort.cab http://fs1.us.cyworld.com/common/activex/CyGlobal.cab
#5
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 9,959
Computer Experience:
1. Please open Notepad Click Start , then Run
Type notepad .exe in the Run Box.
copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\system32\B564D2D05B.sys
Folder::
Driver::
Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"=-
[-HKEY_CLASSES_ROOT\clsid\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
[-HKEY_CLASSES_ROOT\agcore.AGUtils]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
RegLockDel:: Save the above as CFScript.txt drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.http://users.pandora.be/bluepatchy/m...s/CFScript.gif Combofix.txt A new HijackThis log .
#6
Senior Member
Profile: Join Date: Jan 2002
Posts: 434
Computer Experience:
broni, as requested:Vb .CodeDOMProcessor\8.0.0.0__b03 f5f7f11d50a3a\Microsoft.Vsa.Vb .CodeDOMProcessor.dllVb .CodeDOMProcessor\8.0.0.0__b03 f5f7f11d50a3a\Microsoft.Vsa.Vb .CodeDOMProcessor.dllhttp://www.gmer.net ad ,f0,23, \ad ,f0,23, \SP3 (WinNT 5.01.2600)http://www.yahoo.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 www.getantivirusplusnow.com www.secure-plus-payments.com www.getavplusnow.com www.securesoftwarebill.com pr ms http://www.imgag.com/kiw/toolbar/dow...lerControl.cab http://download.netmarble.com/web/nm...MStarter24.cab http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab http://upload.facebook.com/controls/...oUploader5.cab http://www.nvidia.com/content/Driver...sysreqlab3.cab http://s.nx.com/activex/public_new/nxpm.cab http://security.symantec.com/sscv6/S...in/AvSniff.cab http://community.webshots.com/html/atx/wsaxcontrol.cab http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab http://upload.facebook.com/controls/...oUploader3.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab https://webdl.symantec.com/activex/symdlmgr.cab https://mpsnare.iesnare.com/StmOCX.cab http://www.lineage.co.kr/common/ocx/ncweb.cab http://upload.facebook.com/controls/...Uploader55.cab http://user.buddybuddy.co.kr/cab/BBNPort.cab http://fs1.us.cyworld.com/common/activex/CyGlobal.cab
#7
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 9,959
Computer Experience:
Uninstall Combofix :Start > Run [Vista users, go Start>"Start search"]Combofix /Uninstall Note the space between the "Combofix" and the "/Uninstall" Print these instructions out. NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe scanner.exe ***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scans.***STEP 1. Malwarebytes' Anti-Malware : http://www.malwarebytes.org/mbam.php to your desktop.(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes) mbam-setup.exe and follow the prompts to install the program.Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish .Perform Quick Scan , then click Scan .Show Results to view the results.Remove Selected .Post the log back here .log-date.txt log-date.txt RESTART COMPUTER! STEP 2. Post fresh HijackThis log. NOTE. If you're using Vista, right click on HijackThis , and click Run as Administrator DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
#8
Senior Member
Profile: Join Date: Jan 2002
Posts: 434
Computer Experience:
broni, as requested:SP3 (WinNT 5.01.2600)http://www.yahoo.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 www.getantivirusplusnow.com www.secure-plus-payments.com www.getavplusnow.com www.securesoftwarebill.com pr ms http://www.imgag.com/kiw/toolbar/dow...lerControl.cab http://download.netmarble.com/web/nm...MStarter24.cab http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab http://upload.facebook.com/controls/...oUploader5.cab http://www.nvidia.com/content/Driver...sysreqlab3.cab http://s.nx.com/activex/public_new/nxpm.cab http://security.symantec.com/sscv6/S...in/AvSniff.cab http://community.webshots.com/html/atx/wsaxcontrol.cab http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab http://upload.facebook.com/controls/...oUploader3.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab https://webdl.symantec.com/activex/symdlmgr.cab https://mpsnare.iesnare.com/StmOCX.cab http://www.lineage.co.kr/common/ocx/ncweb.cab http://upload.facebook.com/controls/...Uploader55.cab http://user.buddybuddy.co.kr/cab/BBNPort.cab http://fs1.us.cyworld.com/common/activex/CyGlobal.cab
#9
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 9,959
Computer Experience:
Let's try to run HostsXpert again.
#10
Senior Member
Profile: Join Date: Jan 2002
Posts: 434
Computer Experience:
Sorry, broni. I am unable to do so. Message says: Cannot create C:\Windows\system32\Drivers\Etc\hosts.
#11
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 9,959
Computer Experience:
Please download OTM Save it to your desktop .
Please double-click OTM to run it. (Note : If you are running on Vista , right-click on the file and choose Run As Administrator ).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy ):
Code:
:Processes
:Services
:Reg
:Files
:Commands
[purity]
[resethosts]
[emptytemp]
[Reboot] Return to OTM, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste .
Click the red Moveit!
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM and reboot your PC.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes . In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
#12
Senior Member
Profile: Join Date: Jan 2002
Posts: 434
Computer Experience:
Success, I think. Herer is the log.
#13
Senior Member
Profile: Join Date: Jan 2002
Posts: 434
Computer Experience:
broni - I ran HijackThis and am posting the new log:SP3 (WinNT 5.01.2600)http://www.yahoo.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.imgag.com/kiw/toolbar/dow...lerControl.cab http://download.netmarble.com/web/nm...MStarter24.cab http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab http://upload.facebook.com/controls/...oUploader5.cab http://www.nvidia.com/content/Driver...sysreqlab3.cab http://s.nx.com/activex/public_new/nxpm.cab http://security.symantec.com/sscv6/S...in/AvSniff.cab http://community.webshots.com/html/atx/wsaxcontrol.cab http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab http://upload.facebook.com/controls/...oUploader3.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab https://webdl.symantec.com/activex/symdlmgr.cab https://mpsnare.iesnare.com/StmOCX.cab http://www.lineage.co.kr/common/ocx/ncweb.cab http://upload.facebook.com/controls/...Uploader55.cab http://user.buddybuddy.co.kr/cab/BBNPort.cab http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab http://fs1.us.cyworld.com/common/activex/CyGlobal.cab
#14
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 9,959
Computer Experience:
Very good Temp File Cleaner (TFC) TFC.exe to run the program.Start button to begin cleaning process.may ask you to restart computer.Kaspersky website and perform an online antivirus scan.Accept button.Run .Settings .Spyware, Adware, Dialers, and other potentially dangerous programs Archives
Mail databases
My Computer under Scan .View Scan Report .Save Report As.... Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
#15
Senior Member
Profile: Join Date: Jan 2002
Posts: 434
Computer Experience:
broni - I apologize for the delay, but I only come to my daughter's house when I can. My grandddaughter reports that she can now sign into her youtube and yahoo accounts and she can finally search on yahoo and google. SP3 (WinNT 5.01.2600)http://www.yahoo.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.imgag.com/kiw/toolbar/dow...lerControl.cab http://download.netmarble.com/web/nm...MStarter24.cab http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab http://upload.facebook.com/controls/...oUploader5.cab http://www.nvidia.com/content/Driver...sysreqlab3.cab http://s.nx.com/activex/public_new/nxpm.cab http://security.symantec.com/sscv6/S...in/AvSniff.cab http://community.webshots.com/html/atx/wsaxcontrol.cab http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab http://upload.facebook.com/controls/...oUploader3.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab https://webdl.symantec.com/activex/symdlmgr.cab https://mpsnare.iesnare.com/StmOCX.cab http://www.lineage.co.kr/common/ocx/ncweb.cab http://upload.facebook.com/controls/...Uploader55.cab http://user.buddybuddy.co.kr/cab/BBNPort.cab http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab http://fs1.us.cyworld.com/common/activex/CyGlobal.cab
All times are GMT +1. The time now is 08:50 .
