System Integrity Check Wizard - virus

By mushy
Apr 19, 2008
Topic Status:
Not open for further replies.
  1. I'm a bit new to this so I hope someone can help and take pity on me - as I'm not entirely sure about what I'm doing.
    My sons computer seems to have a nasty bug which I cant get rid of with Ad-Aware (his anti-virus had lapsed - I've renewed it now but cant get rid of the integrity check wizard).
    I've seem a few posts about running Hijack this but I dont know what it is or how to do it.
    Any help would be very much appreciated.
    many thanks
  2. Matthew

    Matthew TechSpot Staff Posts: 6,043   +84 Staff Member

  3. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

  4. mushy

    mushy Newcomer, in training Topic Starter

    Hi - thanks so much for this. Sorry its taken a while but it took a while to work my way through all the various scans and stuff.

    Anyway, this is my Hijack this log

    Since doing some of the scans I've now got rid of the desktop message (the desktop is now plain white) but it still thinks the task manager is disabled.

    I also get another message when I boot up which says;

    error: c/Windows/system32/glawxfjy.dll
    module could not be found

    Thanks so much for saving me and my son (we'll definately know better next time)
  5. kritius

    kritius TechSpot Guru Posts: 2,087

    I need to see the other logs please.

    ComboFix or if that didnt work DSS.
  6. kritius

    kritius TechSpot Guru Posts: 2,087

    Update your Java Runtime Environment
    • First try going to Start -> Control Panel -> double click Java
    • Select the Update TAb at the top
    • Click the Check for Updates button at the bottom
    • If it finds the newer version (Java 6 Update 5) Follow the on screen instructions
    • After it installs the newest version Go back to Control Panel -> Add/remove programs
    • Uninstall any older versions of Java

    If for some reason you couldn't update through the above instructions.
    • Click the following link
      Java Runtime Environment 6 Update 5
    • The 4th option down is the one you want (click Download)
    • Check the box to agree to terms of service
    • Check the box for your operating system and click 'Download selected'at the bottom
    • After the install Go to Start-> Control Panel-> add/remove programs (Programs and features), and uninstall any old versions
    • Navigate to C:\programfiles\Java -> delete any subfolders except the jre1.6.0_05 folder

    Fix entries using HiJackThis
    • Launch HiJackThis
    • Click the Do a system scan only button
    • Put a check next to the entries listed below
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
    O2 - BHO: (no name) - {3CAB59B4-55A3-4737-9FD5-B93C6430BF75} - C:\WINDOWS\system32\osnthyaf.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [c877572a] rundll32.exe "C:\WINDOWS\system32\glawxfjy.dll",b

    • IMPORTANT: Do NOT click fix until you exit all browser sessions including the one you are reading in right now
    • Click the Fix checked button and close HiJackThis
    • Reboot HijackThis if necessary

    Reboot into safe mode.

    Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

    Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these files (if present):

    C:\WINDOWS\system32\osnthyaf.dll
    C:\WINDOWS\system32\glawxfjy.dll


    After that, Reboot, and post a new HijackThis log here in a reply as well as describing how your computer is running at the minute.

    Get an Uninstall List from HijackThis:
    • Open HijackThis, click Config, click Misc Tools
    • Click "Open Uninstall Manager"
    • Click "Save List" (generates uninstall_list.txt)
    • Click Save, copy and paste the results in your next post.
  7. mushy

    mushy Newcomer, in training Topic Starter

    Thanks for all this.

    I have deleted the files you listed but the other two werent visible when I went to explorer.

    This is my current hijack this log...

    The computer seems to be running much more like it used to but it still thinks the Task Manager has been disabled.

    This is my uninstall list...

    Thanks again for all your help.
  8. kritius

    kritius TechSpot Guru Posts: 2,087

    Unistall this,
    Viewpoint Media Player
    LimeWire 4.16.6


    I would like you to do an online scan so that we can what else may be in your system,
    Run Kaspersky online scanner
    With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
    Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.
    Do not go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.


    Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      o Scan using the following Anti-Virus database:
      o Extended (If available, otherwise use standard)
      o Scan Options:
      o Scan Archives
      o Scan Mail Bases
    • Click OK
    • Under select a target to scan, select My Computer
    • The scan will take a while so be patient and let it run.
    • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
    • Click the Save Report As... button (see red arrow below)

      [​IMG]
    • In the Save as... prompt, select Desktop
    • In the File name box, name the file
    • In the Save as type prompt, select Text file (see below)

      [​IMG]
    • Include the report in your next post.
  9. mushy

    mushy Newcomer, in training Topic Starter

    Thanks for your help - here is the log from kaspersky.

    I havent done anything with the files or virus identified - I've just left the window open for now.

    By the way - I've deleted Limewire and the media player but wanted to ask - is Limewire not safe anymore. I read one site that said that it wasnt but is now and one that said it still isnt? If its not I dont suppose you know a safe site - my son will be gutted when I tell him its gone in the interests of safety.

    Sorry to be a pain but is the computer ok to use? Should we stay off the internet until its clear or is ok now that the anti-virus is back up and running?

    Many thanks for all your help - dont know what I would have done otherwise.
  10. mushy

    mushy Newcomer, in training Topic Starter

    Sorry - one more thing.

    I deleted Limewire but its still showing in the system tray but its no longer in the list when I go to add/remove programs. When I click on the icon in the tray it opens up and says a security update is needed - is there a way to remove from the tray too?

    Many thanks
  11. kritius

    kritius TechSpot Guru Posts: 2,087

    We'll try and clear up the Limewire entries now, you are always going to take a risk downloading things off the internet, Limewire especially is true of this as you cannot in anyway be sure of the content you are downloading.

    Please download the OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      [kill explorer]
      C:\APPS\AOL\comps\acs\acssetup.exe
      C:\APPS\Powercinema\fwnet.dll
      C:\Documents and Settings\Joe\Local Settings\Temporary Internet Files\Content.IE5\KURHLUQC
      C:\Program Files\Common Files\AOL\ACS\MultiOS.dll
      C:\Program Files\Common Files\AOL\Backup\ACS\Current\UK\acssetup.exe/WISE0079.BIN
      purity
      [start explorer]
          
    • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


    Empty the contents of this folder but not the folder itself, then empty the recycle bin
    C:\Program Files\Trend Micro\HijackThis\backups

    : Download and Run DSS

    Download Deckard's System Scanner (DSS) to your Desktop. You must be logged onto an account with administrator privileges.
    • Close all applications and windows.
    • Double-click on dss.exe to run it, and follow the prompts.
    • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<- this one will be minimized.
    • Attach the main.txt and the extra.txt in your reply.
     
  12. mushy

    mushy Newcomer, in training Topic Starter

    HI there

    I tried copying the files into moveit but when it got to the last line i got an error message "invalid time flag! [WISE01079.BIN] Must be numerical

    I had to delete this line and press moveit again to get to the start explorer option so the contents of the right hand window were

    File/Folder not found.
    Explorer started successfully

    OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04242008_184749

    after the second move it. I didnt have an option to reboot only to Ok the message.

    Should I run it again and paste whats in the right hand window when the error message comes up?

    Should I carry on with the rest of the instructions?

    Sorry
  13. kritius

    kritius TechSpot Guru Posts: 2,087

    Code:
    [kill explorer]
    C:\APPS\AOL\comps\acs\acssetup.exe
    C:\APPS\Powercinema\fwnet.dll
    C:\Documents and Settings\Joe\Local Settings\Temporary Internet Files\Content.IE5\KURHLUQC
    C:\Program Files\Common Files\AOL\ACS\MultiOS.dll
    C:\Program Files\Common Files\AOL\Backup\ACS\Current\UK\acssetup.exe
    purity
    [start explorer]
    Try that then carry on.
  14. mushy

    mushy Newcomer, in training Topic Starter

    Thanks for that - this is what appeared

    Explorer killed successfully
    File/Folder C:\APPS\AOL\comps\acs\acssetup.exe not found.
    File/Folder C:\APPS\Powercinema\fwnet.dll not found.
    File/Folder C:\Documents and Settings\Joe\Local Settings\Temporary Internet Files\Content.IE5\KURHLUQC not found.
    File/Folder C:\Program Files\Common Files\AOL\ACS\MultiOS.dll not found.
    C:\Program Files\Common Files\AOL\Backup\ACS\Current\UK\acssetup.exe moved successfully.
    < purity >
    Explorer started successfully

    OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04242008_220623

    DSS log to follow
  15. mushy

    mushy Newcomer, in training Topic Starter

    And these are the results from DSS

    Thanks again for helping so much
  16. kritius

    kritius TechSpot Guru Posts: 2,087

    Please open the OTMoveIt2 by OldTimer
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      [kill explorer]
      C:\Users\Heather\AppData\Roaming\LimeWire
      HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\\DisableTaskMgr
      purity
      [start explorer]
          
    • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    Please download ATF Cleaner by Atribune.

    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main menu to close the program.
    For Technical Support, double-click the e-mail address located at the bottom of each menu.

    I would like you to do an online scan so that we can what else may be in your system,
    Run Kaspersky online scanner
    With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
    Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.
    Do not go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.


    Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      o Scan using the following Anti-Virus database:
      o Extended (If available, otherwise use standard)
      o Scan Options:
      o Scan Archives
      o Scan Mail Bases
    • Click OK
    • Under select a target to scan, select My Computer
    • The scan will take a while so be patient and let it run.
    • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
    • Click the Save Report As... button (see red arrow below)

      [​IMG]
    • In the Save as... prompt, select Desktop
    • In the File name box, name the file
    • In the Save as type prompt, select Text file (see below)

      [​IMG]
    • Include the report in your next post.
  17. mushy

    mushy Newcomer, in training Topic Starter

    This is what move it reported

    Explorer killed successfully
    File/Folder C:\Users\Heather\AppData\Roaming\LimeWire not found.
    < HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\\DisableTaskMgr >
    Registry value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\\DisableTaskMgr deleted successfully.
    < purity >
    Explorer started successfully

    OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04262008_171407
  18. mushy

    mushy Newcomer, in training Topic Starter

    here is my new kaspersky file - thanks again for looking at it
  19. kritius

    kritius TechSpot Guru Posts: 2,087

    Excellent!! They are all clear, just a few entries in the system restore and the moved files, we'll take care of that now.

    Please download the OTMoveIt2 by OldTimer.

    • Double-click OTMoveIt2.exe.
    • Click the CleanUp! button.
    • Select Yes when the "Begin cleanup Process?" prompt appears.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes, if not delete it by yourself.

    Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt2 attempting to contact the internet, please allow it to do so.

    • Disable and Enable System Restore. - If you are using Windows XP or Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

      You can find instructions on how to enable and re-enable system restore here:

      Windows XP System Restore Guide

      or

      Windows Vista System Restore Guide

    Re-enable system restore with instructions from tutorial above

    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.

    • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
    • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

      This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:

      Instructions for Spybot S & D

    • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.

    Here are some additional utilities that will enhance your safety

    • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
    • Comodo BOCLEAN <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
    • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
    • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
      Using Winpatrol to protect your computer from malicious software

    Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

    The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

    Also, please read this great article by Tony Klein So How Did I Get Infected In First Place
  20. mushy

    mushy Newcomer, in training Topic Starter

    Sorry for the delay in replying we have been away.

    Just wanted to say THANK YOU so much for helping us - we have both realised the massive error of our ways and will certainly do everything you recommended to ensure this doesnt happen again - I dont know what we'd have done without your help.

    My son has asked just one question - do you know of any music sites where he can get music without running the risk to his computer?

    Many thanks once again
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.