1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved laptop pc having some concerns

Discussion in 'Malware and Virus Removal Archive' started by Forsaken Knight, 2011/05/28.

Page 2 of 3
  1. 2011/06/07
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    Results of screen317's Security Check version 0.99.7
    Windows 7 (UAC is enabled)
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Disabled!
    avast! Free Antivirus
    McAfee Security Scan Plus
    ZoneAlarm
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 25
    Out of date Java installed!
    Adobe Flash Player
    Adobe Reader 9.4.4 MUI
    Out of date Adobe Reader installed!
    Mozilla Firefox (3.6.6)
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Alwil Software Avast5 AvastSvc.exe
    Zone Labs ZoneAlarm zlclient.exe
    ``````````End of Log````````````
     
    Forsaken Knight,
    #21
  2. 2011/06/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Update Firefox to the current 4.0.1 version.

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

    ...and Eset...
     
    broni,
    #22


  3. to hide this advert.

  4. 2011/06/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Still with me?
     
    broni,
    #23
  5. 2011/06/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Reopened.
     
    broni,
    #24
  6. 2011/06/19
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    I would like to ask, how do I uninstall old versions of adobe photoshop? Please tell me how do I do this?
     
    Forsaken Knight,
    #25
  7. 2011/06/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    My instructions don't say anything about uninstalling Adobe Photoshop, only Adobe Reader.
     
    broni,
    #26
  8. 2011/06/20
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    I'm sorry, I meant older version of adobe reader. I updated adobe reader, but I do not know how do I uninstall the olderversions entirely. Please help me uninstall the older versions of adobe reader, now that I downloaded the updated version.
     
    Forsaken Knight,
    #27
  9. 2011/06/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Are there any older versions listed in Start>Control Panel>Programs & Features?
     
    broni,
    #28
  10. 2011/06/21
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    I only see adobe reader x (10.1.0), among three other adobe named programs.

    Onto the outdated java. Should I just update that program now?
     
    Forsaken Knight,
    #29
  11. 2011/06/21
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Yes, Java is at Update 26 now.

    Then...Eset.
     
    broni,
    #30
  12. 2011/06/23
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    C:\Users\walmart\Desktop\removalable disk e items transfered on thur fed 17 2011\Desktop things up to may 2009\desktop things 3\SpyBlocker_v1.zip a variant of Win32/AdInstaller application
    C:\Users\walmart\Desktop\removalable disk e items transfered on thur fed 17 2011\Desktop things up to may 2009\desktop things 3\zlsSetup_70_483_000_en.exe a variant of Win32/AdInstaller application
     
    Forsaken Knight,
    #31
  13. 2011/06/23
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    additional concerns.

    1.
    My mom recently installed a new toolbar onto my laptop. She did it because she is under the impression that if she uses the search engine of this new toolbar, that she will accumilate frequent flyer miles. The toolbar is "U.S. Airways Dividend Miles" Its powered by yahoo. I don't use it my self, because I am wary towards this new toolbar. My question in regards to this new toolbar is as follows. Should I be concerned about this new toolbar? Has anyone heard anything bad, or good, about this specific toolbar? How do I check to see if this new toolbar, can be a threat to my laptop pc?

    2.
    I think I meantioned this at the beginning of this thread, but just in case I didn't, I'll go into more detail now.

    I started this thread because all of a sudden, my laptop didn't start up properly. One day, when I clicked on the button to turn on my laptop, the initial load screen went well. However, when it came time for the windows logo loading screen to appear, a white cursor, like the one you would see in dos, appeared on the screen. I took a screen shot of this about (roughly) the second to last time this has happened using my cell phone.

    It has been about a week since I have seen this specific issue occur again. What was displayed on the screen was the following.

    "
    Intel UMDI, PXE-Z, 1 (build 08Z)
    Copyright (C) 1997-2000 Intel Corporation

    For Atheros PCIE Ethernet Controller v1.0.0.5(01/22/09)

    Check cable connection..!
    PXE-E63: Erro while initializing the NIC
    PXE-M0F: Exiting Intel PXE ROM.
    No bootable device -- insert boot disk and press any key
    "

    I'm not sure why this happened in the first place, but it was not a one time issue. It happened a few times.

    This problem was easily fixed by me just pressing the power buttion to turn the laptop off, then turning the laptop back on.

    When this occured, the sound of the pc "working" went dormant and was not present.

    End of additional concerns.

    I thought to first get help in this sub topic section of the windowsbbs web site, to eliminate any potential software sources of the main issue I had a concern over, which lead me to start this newly thread of mine. If none of the processes done here to indicate that a problem was removed, which could have been the source of the original concern of mine, then I would have atleast had virus and malware as not the cause of my concerns.

    Thank you for your time in reading this lengthy explaination of mine.
     
    Forsaken Knight,
    #32
  14. 2011/06/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    1. That toolbar looks safe.

    2.
    That's what we do in this particular forum. Good move :)

    ======================================================

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL

:Services

:Reg

:Files
C:\Users\walmart\Desktop\removalable disk e items transfered on thur fed 17 2011\Desktop things up to may 2009\desktop things 3\SpyBlocker_v1.zip 
C:\Users\walmart\Desktop\removalable disk e items transfered on thur fed 17 2011\Desktop things up to may 2009\desktop things 3\zlsSetup_70_483_000_en.exe

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ====================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
     
    broni,
    #33
  15. 2011/06/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    The issue seems to be resolved.
     
    broni,
    #34
  16. 2011/06/28
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    Thats what is left.
     
    Forsaken Knight,
    #35
  17. 2011/06/28
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    All processes killed
    ========== OTL ==========
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    C:\Users\walmart\Desktop\removalable disk e items transfered on thur fed 17 2011\Desktop things up to may 2009\desktop things 3\SpyBlocker_v1.zip moved successfully.
    C:\Users\walmart\Desktop\removalable disk e items transfered on thur fed 17 2011\Desktop things up to may 2009\desktop things 3\zlsSetup_70_483_000_en.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: AppData
    ->Temp folder emptied: 0 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: walmart
    ->Temp folder emptied: 7264809 bytes
    ->Temporary Internet Files folder emptied: 180249096 bytes
    ->Java cache emptied: 49418 bytes
    ->FireFox cache emptied: 0 bytes
    ->Google Chrome cache emptied: 326629150 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 7337 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 2726843 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50400 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 493.00 mb


    [EMPTYFLASH]

    User: All Users

    User: AppData

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Public

    User: walmart
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.23.0 log created on 06282011_195152

    Files\Folders moved on Reboot...
    C:\Users\walmart\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    C:\Users\walmart\AppData\Local\Temp\~DFEEBF880E673F7F26.TMP moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U0UECH0K\background-banner-right-v9[1].jpg moved successfully.
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U0UECH0K\ddc[2].htm not found!
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BJQ6OEJ1\ads[1].htm moved successfully.
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BJQ6OEJ1\audmeasure[1].gif not found!
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BH0UATIV\ddc[1].htm not found!
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BH0UATIV\iframescript[1].htm moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BH0UATIV\list-item-plus[1].png moved successfully.
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BH0UATIV\unpixel[1].gif not found!
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Q2O9UYJ\99146-resolved-laptop-pc-having-some-concerns-3[1].htm not found!
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Q2O9UYJ\audmeasure[1].gif not found!
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Q2O9UYJ\audmeasure[2].gif not found!
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Q2O9UYJ\background-banner-middle-v9[1].jpg moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Q2O9UYJ\background_banner_green_50_v9[1].jpg moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Q2O9UYJ\L[1].htm moved successfully.
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Q2O9UYJ\p-01-0VIaSjnOLg[1].gif not found!
    File\Folder C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Q2O9UYJ\pixel[1].gif not found!
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
    File\Folder C:\Windows\temp\ZLT078ce.TMP not found!

    Registry entries deleted on Reboot...
     
    Forsaken Knight,
    #36
  18. 2011/06/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ok......
     
    broni,
    #37
  19. 2011/06/28
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: AppData
    ->Temp folder emptied: 0 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: walmart
    ->Temp folder emptied: 2676838 bytes
    ->Temporary Internet Files folder emptied: 1472532 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 434 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1260516 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 5.00 mb


    [EMPTYFLASH]

    User: All Users

    User: AppData

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Public

    User: walmart
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore point Set: OTL Restore Point

    OTL by OldTimer - Version 3.2.23.0 log created on 06282011_195917

    Files\Folders moved on Reboot...
    C:\Users\walmart\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    C:\Users\walmart\AppData\Local\Temp\~DFAD3929EA19F0D13E.TMP moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XO6KCI1D\audmeasure[1].gif moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XO6KCI1D\drts[1].htm moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XO6KCI1D\p-01-0VIaSjnOLg[1].gif moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W9O7PDMS\iframescript[1].htm moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W9O7PDMS\p-01-0VIaSjnOLg[1].gif moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OXYZ1DCF\ads[1].htm moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OXYZ1DCF\ddc[1].htm moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQV24TL0\99146-resolved-laptop-pc-having-some-concerns-3[1].htm moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQV24TL0\audmeasure[1].gif moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQV24TL0\drts[1].htm moved successfully.
    C:\Users\walmart\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQV24TL0\p-01-0VIaSjnOLg[1].gif moved successfully.
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
    File\Folder C:\Windows\temp\ZLT01808.TMP not found!

    Registry entries deleted on Reboot...
     
    Forsaken Knight,
    #38
  20. 2011/06/28
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 6970

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 9.0.8112.16421

    6/28/2011 8:24:26 PM
    mbam-log-2011-06-28 (20-24-26).txt

    Scan type: Quick scan
    Objects scanned: 175212
    Time elapsed: 3 minute(s), 32 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    Forsaken Knight,
    #39
  21. 2011/06/28
    Forsaken Knight

    Forsaken Knight Well-Known Member Thread Starter

    Joined:
    2007/12/01
    Messages:
    512
    Likes Received:
    0
    Quote:
    Originally Posted by broni
    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    10. Run defrag at your convenience.

    End Quote:

    Thats it. All other instructions done. Your great in helping people with software issues.

    I would like to thank you, Broni, for helping me out. Take care.
     
    Forsaken Knight,
    #40
Page 2 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...