Solved:I need help!! Whataboutadog???

[SamanthaB]

Hi, it looks very busy here, i hope someone can help. I have had my computer going on 2 years, its a Dell Inspirion notebook. I have never had any problems until recently. I had trouble logging into a finacial website and had a few warnings from Windows such as TFSWSHX.DLL missing file please insert backup disk. I need help i hope its ok to post the results from HJT and findawf..... thank you

Trying to upload my HJT summary, pasting the text is just too long

 

[Rik]

When you say a "financial" website do you mean online banking? If so, read If your system is infected. Read this before deciding whether to CLEAN or REFORMAT.

Please let me know your decision.



This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

Hello Rik

I am ready to go forward Rik, it wasnt online banking thank goodness.

 

[howard_hopkinso]

Please do the following.

Attach a fresh awf.txt as an attachment.

Regards Howard

This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

Hello Howard

Hello Howard, your wish is my command. i saved the file to my desktop and uploaded the file to TS...pretty sure i did it correctly. Thank you Howard! regards Samantha

 

[howard_hopkinso]

Right click on this link DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards. NOTE: This script will delete any sites you may have added to the Trusted Sites. So if you want them back, you have to add them back to the Trusted Sites again.

Double-click FindAWF.exe to start the tool. Then, do the following
Select "option #2 - Restore files from bak folders" by typing 2 and press Enter .
A text file will open up. Please copy/paste the following text from the quote box (all except the word QUOTE) into the text file.

"C:\Program Files\Apoint\bak\Apoint.exe"
"C:\Program Files\Dell Photo AIO Printer 924\bak\dlccmon.exe"
"C:\Program Files\DellSupport\bak\DSAgnt.exe"
"C:\Program Files\DIGStream\bak\digstream.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\WINDOWS\ehome\bak\ehtray.exe"
"C:\Program Files\Corel\Corel Photo Album 6\bak\MediaDetect.exe"
"C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe"
"C:\Program Files\Dell\QuickSet\bak\quickset.exe"
"C:\Program Files\Grisoft\AVG7\bak\avgcc.exe"
"C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mimboot.exe"
"C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
"C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe"
"C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe"
"C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe"
"C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
"C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe"
"C:\Program Files\Java\jre1.6.0_02\bin\bak\jusched.exe"
"C:\Program Files\Common Files\AOL\1173276754\ee\bak\AOLSoftware.exe"

Close the .txt file and click Yes to save the changes.
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt in your next reply as an attachment.

Regards Howard

This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

Completed Howard

All done. All my trusted sites did disapear and i put WAAD in my restricted sites (still there).

Howard, all instructions listed below were followed and completed. What i would do to know what you know!!

Right click on this link DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards. NOTE: This script will delete any sites you may have added to the Trusted Sites. So if you want them back, you have to add them back to the Trusted Sites again.

Double-click FindAWF.exe to start the tool. Then, do the following
Select "option #2 - Restore files from bak folders" by typing 2 and press Enter .
A text file will open up. Please copy/paste the following text from the quote box (all except the word QUOTE) into the text file.

 

[howard_hopkinso]

My instructions never said anything about copy/paste the results.

I said I want you to post the awf.txt as an attachment. Now please do so.

Regards Howard

 

[SamanthaB]

What happened?

Thats strange i uploaded the results in an attachment, clueless as to why it did not work , lets try this again. Howard if it does not work should i just paste it here. Sorry i did the same thing as before with no results. Beginning to feel like a true blonde.

 

[howard_hopkinso]

Please double-click the FindAWF icon once again
This time we are going to remove some folders.


Use the following option: Press 3 then Enter to remove bak folders


A text file opens called: folders.txt
Click below the line and paste the following list of folders to be removed:

C:\Program Files\Apoint\bak
C:\Program Files\Dell Photo AIO Printer 924\bak
C:\Program Files\DellSupport\bak
C:\Program Files\DIGStream\bak
C:\Program Files\QuickTime\bak
C:\WINDOWS\ehome\bak
C:\Program Files\Corel\Corel Photo Album 6\bak
C:\Program Files\CyberLink\PowerDVD\bak
C:\Program Files\Dell\QuickSet\bak
C:\Program Files\Grisoft\AVG7\bak
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak
C:\WINDOWS\system32\dla\bak
C:\Program Files\Common Files\AOL\ACS\bak
C:\Program Files\Common Files\InstallShield\UpdateService\bak
C:\Program Files\Common Files\Real\Update_OB\bak
C:\Program Files\Intel\Wireless\Bin\bak
C:\Program Files\Java\jre1.6.0_02\bin\bak
C:\Program Files\Common Files\AOL\1173276754\ee\bak

Next, close and click Yes to save the changes.

When done with the above, FindAWF automatically runs a new scan and opens a new log that you need to post.
Please provide the new FindAWF log

Regards Howard

This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

Hello Howard

As per your instructions Howard regards Samantha

 

[howard_hopkinso]

Just one more bak folder to deal with.

Double-click FindAWF.exe to start the tool. Then, do the following
Select "option #2 - Restore files from bak folders" by typing 2 and press Enter .
A text file will open up. Please copy/paste the following text from the quote box (all except the word QUOTE) into the text file.

"C:\Program Files\Common Files\AOL\ACS\bak\AOLDial.exe"

Close the .txt file and click Yes to save the changes.
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt in your next reply as an attachment.

Regards Howard

This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

Howard

Here it goes Howard...thank you for your time by the way. Starting to feel better about this whole situation.

 

[howard_hopkinso]

Please double-click the FindAWF icon once again
This time we are going to remove some folders.


Use the following option: Press 3 then Enter to remove bak folders


A text file opens called: folders.txt
Click below the line and paste the following list of folders to be removed:

C:\Program Files\Common Files\AOL\ACS\bak

Next, close and click Yes to save the changes.

When done with the above, FindAWF automatically runs a new scan and opens a new log that you need to post.
Please provide the new FindAWF log

Regards Howard

This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

All done Howard

Here is the log Howard, regards Samantha

 

[howard_hopkinso]

Just as I feared, it`s still there. We`re going to have to manually delete it. After doing that, you may find you need to reinstall your AOl software.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

AOLDial.exe

Close task manager.

Locate and delete the following bold files and/or directories(if there).

C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Common Files\AOL\ACS\bak<Delete the entire folder.

Reboot into normal mode and rehide your protected OS files.

Please download FindAWF to your Desktop.
Double-click FindAWF.exe to start the tool.
Select "option #1 - Scan for bak folders" by typing 1 and press Enter
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt as an attachment.

Also, please post a fresh HJT log as well.

Regards Howard

This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

Im back

Hello Howard, think im getting the hang of this
cant wait for the diagnosis
Samantha

 

[Rik]

You are now clear of that infection, however, to be 100% sure that your pc has no other infections, you need to rename hijackthis.exe to crusty.exe then attach a fresh hjt log.



This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

Great news Thank you 1k times Howard!

Hello Rik, did as instructed. The file is simply showed as crusty with a screen icon, hope its rite.

 

[Rik]

You need to follow steps 4 and 5 from here - Viruses/Spyware/Malware, preliminary removal instructions



This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

All done Rik do either you or Howard need me to post any other summaries, regards Samantha

 

[Rik]

Yes, we need to see your hjt log.



This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[howard_hopkinso]

As rik said, you awf log is now clean.

However, in the interests of making sure your system is clean, you need to do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

Also, let me know the results of the Panda Antirootkit scan.

Regards Howard

This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[SamanthaB]

Thank you Howard, Rik i know you gentlemen do this all the time but for someone thats not so savvy you guys are life savers. Thank you thank you. Samantha

 

[howard_hopkinso]

No worries SamanthaB.

I strongly advise you to follow the instructions in my post above, just to make sure your system is free from malware. Otherwise, all the work we`ve done, could all be for nothing.

Regards Howard

This thread is for the use of SamanthaB only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.