Task manager closes right after I open it and my computer is extremely slow.

[Go Zags]

fsbl log

here is the new log

 

[evilfantasy]

Please download Vundofix.exe to your desktop.

* Double-click VundoFix.exe to run it.
* Put a check next to Run VundoFix as a task.
* You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
* When VundoFix re-opens, click the Scan for Vundo button.
* Once it's done scanning, click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will shutdown your computer, click OK.
* Turn your computer back on.
* Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears at reboot.

Please let Vundo finish, sometimes it can take multiple passes

--------------------

* Run the F-Secure Online Scanner

* Then click the Start Scanning button at the bottom of the page.
* You should get a notification (bar on top) to install the activeX. Click on it and select to install the ActiveX.
* Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
* In case you are having problems with installing the ActiveX/starting the scan, please read here.
* Click the Full System Scan button.
* It will start to download scanner components and databases. This can take a while.
* The main scan will start.
* Once the scan finished scanning, click the Automatic cleaning (recommended) button
* It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
* The cleaning can take a while, so please be patient.
* Then click the Show report button and add the results in your next reply. (you will want to save the report in notepad to your desktop as a text (.txt) file)

Next post please attach
vundofix.txt
F-Secure txt
New HijackThis log

 

[Go Zags]

Vundo Fix Log

Here are the HJT log and VundoFix log.

The F-Secure Online Scanner ran, said it finished, said it detected no bad files. It then said there was an error and I needed to re-do it. I re-did it twice with the same results.

 

[momok]

I would like you to perform the following:

Unhide all hidden files and folders.

1. Please boot into safe mode. Next,
   
2. Go to start > run and type msconfig. Press the enter key.
   Search for the following entries in bold and uncheck them from starting.
   
   Internt
   Program file
   
   
3. Go to start > run and type services.msc. Press the enter key.
   Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.
   
   Alerter COM+
   
   
4. Run HJT and fix these entries:
   
   O2 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - C:\Program Files\Mario Forever Toolbar\v2.0.0.4\Mario_Forever_Toolbar.dll
   O4 - HKLM\..\Run: [Internt] C:\WINDOWS\system32\internt.exe
   O4 - HKLM\..\Run: [Program file] C:\WINDOWS\system32\progmon.exe
   O23 - Service: Alerter COM+ - Unknown owner - C:\WINDOWS\system32\IME\svchost.exe < this is fake. its running from the wrong folder
   
   
5. Navigate manually to the following files and folders in bold and delete them.
   
   C:\WINDOWS\system32\internt.exe
   C:\WINDOWS\system32\progmon.exe
   C:\WINDOWS\system32\IME\svchost.exe
   
   
6. Reboot into normal mode and rehide your files and folders.

Post fresh HJT, ComboFix and AVG antispyware logs as attachments. The tools can be downloaded from my signature.

Regards,
momok

This thread is for the use of Go Zags only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and The Web forum.

 

[Jase123]

He/She may not know how to show "Hidden files and folders".

Here are the instructions.

1. Open My Computer.
2. Go to Tools > Folder Options.
3. Select the View tab.
4. Scroll down to Hidden files and folders.
5. Select Show hidden files and folders.
6. Uncheck (untick) Hide extensions of known file types.
7. Uncheck (untick) Hide protected operating system files (Recommended).
8. Click Yes when prompted.
9. Click OK.
10. Close My Computer.

Regards Jason

This thread is for the use of Go Zags ONLY. Please do NOT post your own virus/spyware problems into this thread. Instead, open a new thread in our security and the web forum.

 

[evilfantasy]

-
What happened to this?

* Run the F-Secure Online Scanner

* Then click the Start Scanning button at the bottom of the page.
* You should get a notification (bar on top) to install the activeX. Click on it and select to install the ActiveX.
* Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
* In case you are having problems with installing the ActiveX/starting the scan, please read here.
* Click the Full System Scan button.
* It will start to download scanner components and databases. This can take a while.
* The main scan will start.
* Once the scan finished scanning, click the Automatic cleaning (recommended) button
* It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
* The cleaning can take a while, so please be patient.
* Then click the Show report button and add the results in your next reply. (you will want to save the report in notepad to your desktop as a text (.txt) file)

 

[momok]

The F-Secure Online Scanner ran, said it finished, said it detected no bad files. It then said there was an error and I needed to re-do it. I re-did it twice with the same results.

He has already done it apparently hehe.

 

[evilfantasy]

Ahh, missed that, I'm awake now......

 

[Go Zags]

Yaaaaaaaaaaaaaaa!!!

I think it worked. My computer is way faster, my Task Manager stays open, and the HJT log doesn't show progmon.exe or internt.exe.

Here is the HJT log and ComboFix log. I haven't downloaded AVG yet but will do that. Here are the first two.

THANKS

ComboFix log is too large to attach and too large to copy and paste. What should I do about that? (it's 133,236 characters)

 

[evilfantasy]

Break the log in two and use posts to add it.

 

[Go Zags]

???

The posts only allow 10,000 characters, this log was 133,000. That would be 13 posts. How about I save it as two files and upload the two. I will try that.

I will attach them to this post.

 

[evilfantasy]

-
The combofix log looks fine, did you recently update Windows?

There are 11 instances of Symantec Live Update running. Is this a paid version?

That has to be eating up resources. Does the computer run OK?

--------------------

Your Java is out of date
Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version of Java components and update

Updating Java:
* Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
* Check for any item with Java Runtime Environment (JRE or J2SE) in the name.
** The latest version is Java 6 Update 3. Remove all other entries.
* Click the Remove or Change/Remove button.
* Repeat as many times as necessary to remove each of the Java versions.
* Reboot your computer once all Java components are removed.

* Download the latest version of Java Runtime Environment (JRE) 6
* Click the Free Java Download button.
* Click the Download Now button.
* When the Software Installation dialog box opens. Click on the Install Now button.
* Follow the prompts to complete installation.

-------------------

Go to Start > Run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /
Then hit Enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again

------

Let us know how everything is now.

 

[Go Zags]

Way better....

Wow, what an improvement. It seems all is working. Should I keep all of the programs I downloaded through this process?

Also, I got these problems from our external hard drive, who got it from my wife's computer.

Can I do these same things to my wife's computer?

Secondly, how do I get the viruses off of the external hard drive?

Which one should I do first, my wife's computer or the external hard drive?

Thanks a ton.

 

[momok]

Glad to see everything's fine.

If you have no immediate use for the hard drive, I would fix your wife's computer first. However, the same steps here may not apply to that system. It would be prudent to follow the 15 step instruction for your wife's computer.

Ensure that all your systems have real-time monitoring anti-virus and anti-spyware programs running on your current system. This way, you can prevent an infection from your hard drive when you plug it in to fix it.

Regards,
momok =)

 

[Go Zags]

My wife's computer....

I did the same things for my wifes computer and it worked for it as well.

I plugged back in the external hard drive to her CPU and I searched for internt.exe, progmon.exe, \svchost\IME and couldn't find them.

We both have the new Norton 360.

I think the external hard drive is fine, but I'm not exactly sure.

Thanks.

 

[momok]

You can try running AVG antispyware and antivirus scans and include the external hard drive to see if anything is detected.
Does the hard drive still prompt infection alerts in the computer at your wife's school?

Regards,
momok =)

 

[Go Zags]

She is going to try it again there to see if the virus alert still comes up.

I will run the virus scans and include the external hard drive.

Thanks.