also @ TechSpot: Google, Samsung unveil Chromebook, Chromebox with Chrome OS 19

TechSpot
Collaborate in the cloud with Office, Exchange, SharePoint, and Lync.
Microsoft Office 365. Pay-as-you-go starting at $8/user/month. Begin your free trial now.

[Solved] Multiple ieexplore.exe's running in background

Discussion in 'Virus and Malware Removal' started by webbrewers, Jan 25, 2012.

Page 3 of 3

  1. webbrewers Newcomer, in training

    fss.txt

    Farbar Service Scanner Version: 18-01-2012 01
    Ran by Kate Reilly (administrator) on 28-01-2012 at 10:37:12
    Microsoft Windows XP Home Edition Service Pack 3 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Yahoo IP is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Security Center:
    ============

    Windows Update:
    ===========

    File Check:
    ========
    C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
    C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
    C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
    C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
    C:\WINDOWS\system32\netman.dll => MD5 is legit
    C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\WINDOWS\system32\srsvc.dll => MD5 is legit
    C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
    C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
    C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
    C:\WINDOWS\system32\qmgr.dll => MD5 is legit
    C:\WINDOWS\system32\es.dll => MD5 is legit
    C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
    C:\WINDOWS\system32\svchost.exe => MD5 is legit
    C:\WINDOWS\system32\rpcss.dll => MD5 is legit
    C:\WINDOWS\system32\services.exe => MD5 is legit

    Extra List:
    =======
    Avgtdix(10) Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3)
    0x0B000000040000000100000002000000030000000800000056000000090000000A000000050000000600000007000000
    IpSec Tag value is correct.

    **** End of log ****
    webbrewers, Jan 28, 2012
    #41

  2. webbrewers Newcomer, in training

    eset:

    C:\Documents and Settings\James Michalski\My Documents\social studies\Setup.exe Win32/Adware.180Solutions application
    C:\Documents and Settings\Kate Reilly\Application Data\Business Logic\UWC\Backup\J38652.5333523148.WCU Win32/Adware.180Solutions application
    C:\Documents and Settings\Kate Reilly\Application Data\Business Logic\UWC\Backup\J39108.4333783565.WCU Win32/Adware.180Solutions application
    C:\Documents and Settings\Kate Reilly\Application Data\Mozilla\Firefox\Profiles\wbjb79dx.default\extensions\{5e594888-3e8e-47da-b2c6-b0b545112f84}\defaults\preferences\prefs.js Win32/Cycbot.AC.Gen trojan
    C:\Program Files\0BA1C\lvvm.exe a variant of Win32/Kryptik.ZKX trojan
    C:\Program Files\B19BF\lvvm.exe a variant of Win32/Kryptik.ZKX trojan
    C:\Program Files\Zango SiteFinder\3z98zb0g.DLL a variant of Win32/Adware.ClearSearch.AJ application
    C:\Program Files\Zango SiteFinder\qy17507p.DLL a variant of Win32/Adware.ClearSearch.AK application
    C:\Qoobox\Quarantine\C\Documents and Settings\Kate Reilly\Application Data\427B1\45A20.exe.vir a variant of Win32/Kryptik.ZKX trojan
    C:\Qoobox\Quarantine\C\Documents and Settings\Kate Reilly\Application Data\FCC0B\45A20.exe.vir a variant of Win32/Kryptik.ZKX trojan
    C:\Qoobox\Quarantine\C\Program Files\LP\20C4\111.exe.vir a variant of Win32/Kryptik.ZKX trojan
    C:\Qoobox\Quarantine\C\Program Files\LP\20C4\FB.tmp.vir Win32/PSW.Agent.NTM trojan
    C:\Qoobox\Quarantine\C\Program Files\LP\20CF\1.exe.vir Win32/Cycbot.AK trojan
    C:\Qoobox\Quarantine\C\Program Files\LP\20CF\4.tmp.vir Win32/PSW.Agent.NTM trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000007.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000314.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000426.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000452.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0001451.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0002451.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0002467.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0002546.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0003546.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0003823.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0004823.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0005823.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0005836.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0005846.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0005864.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP4\A0005992.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP4\A0006992.sys a variant of Win32/Rootkit.Kryptik.IE trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP4\A0007228.exe a variant of Win32/Kryptik.ZKX trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP4\A0007229.exe a variant of Win32/Kryptik.ZKX trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP4\A0007231.exe a variant of Win32/Kryptik.ZKX trojan
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP4\A0007232.exe Win32/Cycbot.AK trojan
    webbrewers, Jan 28, 2012
    #42

  3. Broni Malware Annihilator

    Uninstall:
    Ultra WinCleaner
    WinCleaner OneClick Cleanup
    both rogue programs.

    Uninstall iolo technologies' System Mechanic
    Registry cleaners/optimizers are not recommended for several reasons:

    • Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

      The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
    • Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
    • Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
    • Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
    • The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".
    Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.


    Uninstall:
    Java 2 Runtime Environment, SE v1.4.2_03
    Java 2 Runtime Environment, SE v1.4.2_05
    Java 2 Runtime Environment, SE v1.4.2_06

    Update Adobe Flash Player
    Download the Latest Adobe Flash for Firefox and IE Without Any Extras: http://www.404techsupport.com/2010/...-flash-for-firefox-and-ie-without-any-extras/

    ==========================================================

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
    Broni, Jan 28, 2012
    #43

  4. webbrewers Newcomer, in training

    Computer seems very good. I notice too some annoying things about IE like sites not opening in tabs have gone away.
    The only thing I couldn't uninstall was the old Java software because it says it's "on a network resource that isn't available" or "error applying transforms".

    Once again, thanks for your great work!
    webbrewers, Jan 28, 2012
    #44

  5. Broni Malware Annihilator

    Way to go!! [IMG]
    Good luck and stay safe :)
    Broni, Jan 28, 2012
    #45
Page 3 of 3