Task Manager problems, Pop Ups, Trojan, Virtumonde, my computer sucks

By xanimefanx
Jun 1, 2007
Topic Status:
Not open for further replies.
  1. Task Manager problems, Pop Ups, Trojan, Virtumonde, only says log off on start not shut down or anything. my computer sucks. popups like cannot find server and things wanting through my computer i need help
  2. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Your system is infected with a variety of malware.

    Also, all items in your AVG Antispyware log say "Ignored". That`s because you haven`t told AVG Antispyware to quarantine it`s results as per the instructions. See this pictorial guide.

    Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

    If after reading the above, you wish to clean your system, do the following.

    Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

    Also, let me know the results of the AVG Antirootkit scan.

    Regards Howard :)

    This thread is for the use of xanimefanx only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  3. xanimefanx

    xanimefanx Newcomer, in training Topic Starter Posts: 83

    Thank god my Task Manager shows up and the missing buttons for Turn off Computer shows up and Intel graphics media accelarator driver shows up in the corner by the clock ok so regedit is now showing up but i have problems

    Mwinqndt.exe keeps wanted access granted in and out of my comp and if i open internet explorer and try to connect to different place mwinqndt.exe wants access and if i press deny it doesnt load the page. but firefox works and thats what im using right now but still that means theres a problem and i need it fixed
    i have 2 weird things installed
    Think-adz search assistant removal
    Enhanced abs by think-ads removal
    something like smitfraud toolbar would not delete in spybot s&d
    and is something called axbxceft.dll supposed to be installed in internet explorer add-ons as a browser helper object?
  4. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Once you`ve completed the instructions and posted the requested logfiles, I`ll be able to help you further.

    Regards Howard :)

    This thread is for the use of xanimefanx only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  5. xanimefanx

    xanimefanx Newcomer, in training Topic Starter Posts: 83

    Heres the logs from AVG Spyware, Analyze.exe, and combofix.exe.
    Just to let you know i have 2 Quarantined files in AVG Anti-Spyware 7.5 from earlier that i did not delete because the last time i deleted them they came back the next time i scanned they are
    Adaware.NewDotNet, Medium Risk
    Trojan.Agent, High Risk
    they both are in the system volume information as file's called A0005864.exe and A0005863.exe

    i will not delete them without help from you.
    Also the AVG Rootkit scan didnt find anything.
  6. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Don`t worry about the system volume information at the moment, we`ll deal with that once your system is clean.


    2. Download the attached avengerscript.txt and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the file you have just downloaded, click on it and press open
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please attach the content of c:\avenger.txt into your reply, as well as fresh HJT and Combofix logs.

    Regards Howard :)

    This thread is for the use of xanimefanx only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  7. xanimefanx

    xanimefanx Newcomer, in training Topic Starter Posts: 83

    I posted them in the attachments
  8. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Your log file look fine.

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of xanimefanx only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  9. xanimefanx

    xanimefanx Newcomer, in training Topic Starter Posts: 83

    Trojan.Agent.anr how do i get rid of it

    Trojan.Agent.anr has been found by AVG Anti-Spyware 7.5 and i have quarantined it.
  10. momok

    momok Newcomer, in training Posts: 2,272

    Hi,

    Have HijackThis fix the following entries.

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    Apart from that, you log is clean. The file in question was quarantined by AVG Antispyware and its previous location was in the the C:\Avenger backup. Your system should be clean of infections.

    Delete all files in the AVG Antispyware quarantine folder, and you're good to go.

    Should you face any further problems, please post in this thread.


    Regards,
    Your friendly momok =)

    This thread is for the use of xanimefanx only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  11. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Threads merged.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.