TechSpot

My roommate screwed over my computer...

By gabriot
Mar 23, 2008
  1. I came home to find tons of popups on my computer constantly telling me to download spyware and such. Also my task manager has been disabled by the administrator. This really sucks and I don't know how to begin about fixing all this. Norton detects a problem and won't fix it, I click fix and it says do you want to make a backup, I click ok and nothing happens. Here's a hijack this log.




    If you need any other info I can tell you. This sucks I really need to get this computer fixed in time for school to start this wed. I didn't even cause thi seither, I come home from spring break and I find my computer messed up.
     
  2. kritius

    kritius TS Guru Posts: 2,084

    Hi gabriot, :wave:

    Lets see if we can get you fixed ASAP!

    I need you to follow all the steps HERE and then post back with the three requested logs as attachments
    • AVG antispyware
    • ComboFix
    • Hijackthis (step 15)

    Dont forget to make sure that AVG is set to quarantine the results, that HJT is the last step and to let us know the results of the antirootkit scan.

    Good luck and welcome to techspot.

    I just had a check through the log, some nasty things in there but I think we can get rid of them, btw what the hell did your roommate do?

    This thread is for the use of gabriot only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. gabriot

    gabriot TS Rookie Topic Starter

    Here they are. I could not get combo fix to work, so I posted the results of the alternative scanner. Most of the pop-ups have gone away and I can use task manager. However, there still are some popups that still show up. It's taking a while for a particular one to show up but I'll write out what it says if it ever shows up again....

    Also, will it ever be safe to input private info to the web from this computer ever again?

    P.S. I'm not sure what caused it, I notice Limewire is installed when I know I uninstalled it. I believe it was the last thing installed before one of the programs alphabetized my start menu. I know he's lying to me because he says it all just happened while he was looking at youTube videos. I looked through history and did notice a porn.youtube visitation but I don't think that's the culprit...
     
  4. gabriot

    gabriot TS Rookie Topic Starter

    Alright here's one, it is a red and grey window that says 'Security system Waring"

    Alert Details

    File:
    C:\WINDOWS\wml.exe

    Threat:
    Abebot

    etc. etc. etc.

    Click here to visit PC-Antispyware web site..

    EDIT: And another one

    System Integrity Scan Wizard

    Warning: Your ocmputer may have critical errors in Windows registry and file system!

    etc. etc. etc.

    To scan your computer for errors please click the 'Next' button below

    Edit:

    And a exclamation mark still appears in the bottom right syste tray that says click here to fix problem
     
  5. kritius

    kritius TS Guru Posts: 2,084

    Hi gabriot,

    Please go to Virus Total or Jotti and upload C:\WINDOWS\system32\tycdyoni.exe for scanning.

    For Virus Total

    1. Please copy and paste C:\WINDOWS\system32\tycdyoni.exe in the text box next to the Browse button.
    2. Click on Send File.

    For Jotti

    1. Please copy and paste C:\WINDOWS\system32\tycdyoni.exe in the text box next to the Browse button.
    2. Click on Submit.

    Fix entries with HijackThis

    Open up Hijackthis.
    Click on do a system scan only.
    Place a checkmark next to these lines(if still present).

    O2 - BHO: GNX Bingo - {1098C2BD-4709-4891-ADE8-5F4DBDD1A110} - C:\WINDOWS\drnpfdxmlp.dll
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [tycdyoni] C:\WINDOWS\system32\tycdyoni.exe
    O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
    O16 - DPF: {131EB16C-BD58-443F-8151-6DFBB0DA1778} (Anark Client 3.0 ActiveX Control) - http://install.anark.com/client/version3/windows-ie/en/AMClient.cab


    Then close all windows except Hijackthis and click Fix Checked
    Close HijackThis.

    I would like you to do an online scan so that we can what else may be in your system,
    Run Kaspersky online scanner
    With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
    Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.
    Do not go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.


    Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      o Scan using the following Anti-Virus database:
      o Extended (If available, otherwise use standard)
      o Scan Options:
      o Scan Archives
      o Scan Mail Bases
    • Click OK
    • Under select a target to scan, select My Computer
    • The scan will take a while so be patient and let it run.
    • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
    • Click the Save Report As... button (see red arrow below)

      [​IMG]
    • In the Save as... prompt, select Desktop
    • In the File name box, name the file
    • In the Save as type prompt, select Text file (see below)

      [​IMG]
    • Include the report in your next post.


    Run HijackThis again and post a fresh log.

    So in your next reply you should attach,
    1)Results of Jotti or Virus Scan
    2)Kaspersky Scan
    3)Fresh HijackThis log


    This thread is for the use of gabriot only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  6. gabriot

    gabriot TS Rookie Topic Starter

    Here they are. Haven't got a pop-up in a few hours, maybe it's fixed?
     
  7. kritius

    kritius TS Guru Posts: 2,084

    Just going over your logs now but its looking a lot better.

    Ill post back later with the results for you.

    EDIT||||||||||||||||||||||||||||||

    Time for some housekeeping
    • Click START then RUN
    • Now type Combofix /u in the runbox and click OK
    • [​IMG]
    • When shown the disclaimer, Select "2"

    The above procedure will:
    • Delete the following:
      • ComboFix and its associated files and folders.
      • VundoFix backups, if present
      • The C:\Deckard folder, if present
      • The C:_OtMoveIt folder, if present
    • Reset the clock settings.
    • Hide file extensions, if required.
    • Hide System/Hidden files, if required.
    • Reset System Restore.

    Delete the three tools from step 10 by dragging them to the recycle bin and then emptying it.

    After run the Kaspersky scan again and we'll see if it got everything.


    This thread is for the use of gabriot only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  8. gabriot

    gabriot TS Rookie Topic Starter

    I wasn't able to run the combofix /u, it did kind of what it did before how a blue screen just comes up with a period sign as the title of the window, and it just sits there and does nothing.

    I went ahead and just manually deleted the step 10 things.

    Here's the new scan, I think it's still saying there's a trojan downloader and a backdoor present?
     
  9. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    If it were me I'd remove Norton (fully)
    Then install AVG Free and then do another scan (you'd be amazed how AVG Free can remove viruses that expensive Norton can't)
     
  10. kritius

    kritius TS Guru Posts: 2,084

    It is still saying that but its mostly in your system restore so we can take care of that now.

    First,

    Delete this folder and empty your recycle bin.

    C:\Documents and Settings\Brian\SmitfraudFix

    After that you appear to be all clean, the next few steps will get rid of the nasties in system restore.

    Now we can remove all the tools that we used.

    Please download OTMoveIt2 and save it to desktop.
    • Double-click OTMoveIt2.exe.
    • Click the CleanUp! button.
    • Select Yes when the "Begin cleanup Process?" prompt appears.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes, if not delete it by yourself.

    Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt2 attempting to contact the internet, please allow it to do so.

    • Disable and Enable System Restore.
    - If you are using Windows XP or Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

    You can find instructions on how to enable and re-enable system restore here:

    Windows XP System Restore Guide

    Re-enable system restore with instructions from tutorial above

    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.

    • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
    • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

      This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:

      Instructions for Spybot S & D

    • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.

    Here are some additional utilities that will enhance your safety

    • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
    • Comodo BOCLEAN <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
    • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
      Using Winpatrol to protect your computer from malicious software

    Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

    The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

    Also, please get your roommate to read this great article by Tony Klein So How Did I Get Infected In First Place

    After he has read it, ban him from the computer, if you have to leave again and cant take the computer, at least take the power cord! Told you we would get you clean as quickly as possible.

    Happy surfing and stay clean and if you have any more problems then you know where we are.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...