also @ TechSpot: Microsoft Surface RT drops to $199... for schools and colleges

Is my PC in harm's way?

Discussion in 'Virus and Malware Removal' started by adam88, Dec 6, 2012.

Post New Reply
Page 3 of 3

  1. Broni Malware Annihilator Posts: 40,051   +187

    No problem :)

    [IMG]
    Broni, Dec 22, 2012
    #41

  2. adam88 Newcomer, in training Posts: 68

    Thanks for your understanding :)

    I just ran the ATF, no files removed (Main + Firefox)
    Starting Eset online now, it may take some time :), I assume you will stay awake :) for another 3 (?) hrs ?

    Btw, I just happened to try to start the Windows Firewall, got some rootkit-related error instead ...

    Also, I completely re-vamped (as per your advice) my ex-Ramnit PC, what tests/scans should I run first to determine its health?

    Thanks
    adam88, Dec 22, 2012
    #42

  3. Broni Malware Annihilator Posts: 40,051   +187

    I need more details...
    Broni, Dec 23, 2012
    #43

  4. adam88 Newcomer, in training Posts: 68

    Windows Firewall can't change some of your settings
    Error code 0x80070424
    adam88, Dec 23, 2012
    #44

  5. Broni Malware Annihilator Posts: 40,051   +187

    Did Eset finish?

    As for Windows firewall...

    Download Windows Repair (all in one) from this site

    Install the program then run it.

    Go to Step 2 and allow it to run CheckDisk by clicking on Do It button:

    [IMG]



    Once that is done then go to Step 3 and allow it to run System File Check by clicking on Do It button:

    [IMG]


    Go to Step 4 and under "System Restore" click on Create button:

    [IMG]


    Go to Start Repairs tab and click Start button.

    [IMG]


    Please ensure that ONLY items seen in the image below are ticked as indicated (they're all checked by default):

    [IMG]

    Click on box next to the Restart System when Finished. Then click on Start.

    Post new FSS log.
    Broni, Dec 23, 2012
    #45

  6. adam88 Newcomer, in training Posts: 68

    Good morning :)
    Eset finished with no errors.

    In the meantime, I happened to witness Windows (auto) update and realized that it was not entirely successful ("Failure to configure Windows updates" (well, at least some)). Even though I tried to complete the update manually and did few rounds, it was never complete.
    adam88, Dec 23, 2012
    #46
     

  7. Broni Malware Annihilator Posts: 40,051   +187

    Follow my previous reply.
    Broni, Dec 23, 2012
    #47

  8. adam88 Newcomer, in training Posts: 68

    Re Step 4

    There are now more (35) options for Windows Repair (1.9.2), instead of 23 (older version, your instructions above)
    Please advise which options, out of these 35, to tick
    adam88, Dec 23, 2012
    #48

  9. Broni Malware Annihilator Posts: 40,051   +187

    Run it as it is with all default checkmarks.
    Broni, Dec 23, 2012
    #49

  10. adam88 Newcomer, in training Posts: 68

    Follow the defaults of the latest version or the defaults of the version from your instruction (some do not match!)?
    adam88, Dec 24, 2012
    #50

  11. adam88 Newcomer, in training Posts: 68

    Farbar Service Scanner Version: 23-12-2012
    Ran by Adam (administrator) on 24-12-2012 at 23:38:44
    Running from "C:\Users\Adam\Desktop\VIRUS removal by TechSupport"
    Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo IP is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============

    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============
    Checking Start type of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
    Checking ImagePath of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
    Checking ServiceDll of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => MD5 is legit
    C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\System32\dhcpcore.dll => MD5 is legit
    C:\Windows\System32\drivers\afd.sys => MD5 is legit
    C:\Windows\System32\drivers\tdx.sys => MD5 is legit
    C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\System32\dnsrslvr.dll => MD5 is legit
    C:\Windows\System32\mpssvc.dll => MD5 is legit
    C:\Windows\System32\bfe.dll => MD5 is legit
    C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\System32\SDRSVC.dll => MD5 is legit
    C:\Windows\System32\vssvc.exe => MD5 is legit
    C:\Windows\System32\wscsvc.dll => MD5 is legit
    C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\System32\wuaueng.dll => MD5 is legit
    C:\Windows\System32\qmgr.dll => MD5 is legit
    C:\Windows\System32\es.dll => MD5 is legit
    C:\Windows\System32\cryptsvc.dll => MD5 is legit
    C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit


    **** End of log ****
    adam88, Dec 24, 2012
    #51

  12. Broni Malware Annihilator Posts: 40,051   +187

    Can you enable Windows firewall now?
    Broni, Dec 24, 2012
    #52

  13. adam88 Newcomer, in training Posts: 68

    Yep, it;s ON
    adam88, Dec 24, 2012
    #53

  14. Broni Malware Annihilator Posts: 40,051   +187

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Check if your browser plugins are up to date.
    Firefox - https://www.mozilla.org/en-US/plugincheck/
    other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

    6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    8. Run Temporary File Cleaner (TFC) weekly.

    9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    11. (Windows XP only) Run defrag at your convenience.

    12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    13. Read:
    How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
    Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

    14. Please, let me know, how your computer is doing.
    Broni, Dec 24, 2012
    #54

  15. Broni Malware Annihilator Posts: 40,051   +187

    The issue seems to be resolved.
    Broni, Dec 29, 2012
    #55
Page 3 of 3

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...

Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.