roguewrench
Posts: 11 +0
I tried a lot of things and I am exhausted here is my log file if someone could help.
Another PC-antispyware, abebot...
- Thread starter roguewrench
- Start date
- Status
Blind Dragon
Posts: 3,774 +4
I hope you don't mind but with so many of these infections I need to experiment a little.
Please Download VirtumundoBeGone by secured2k
Note: It is normal for the the fix to terminate by producing a BLUE SCREEN OF DEATH so don't be concerned when this happens. It requires you to manually reboot to restore your normal windows desktop.
The log created by VirtumundoBeGone called VBG.TXT will be on located on your desktop. Please retain VBG.TXT.
Empty Recycle Bin.
Reboot and "copy/paste" a new HijackThis log file along with the VBG.TXT into this thread.
Also please describe how your computer behaves at the moment.
If this doesn't remove it have a way to get rid of it, but I really need to know if this is a Vundo infection as it has similar characteristics
This thread is for the use of roguewrench only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Please Download VirtumundoBeGone by secured2k
- Save the file to your desktop
- Close all running programs (including your Internet Browser)
- Double-click VirtumundoBeGone.exe on the desktop
- Read the introductory information, and then click Continue
- Click Start
- When asked if you want to continue, click Yes to run the fix
- Click "Save Log"
Note: It is normal for the the fix to terminate by producing a BLUE SCREEN OF DEATH so don't be concerned when this happens. It requires you to manually reboot to restore your normal windows desktop.
The log created by VirtumundoBeGone called VBG.TXT will be on located on your desktop. Please retain VBG.TXT.
Empty Recycle Bin.
Reboot and "copy/paste" a new HijackThis log file along with the VBG.TXT into this thread.
Also please describe how your computer behaves at the moment.
If this doesn't remove it have a way to get rid of it, but I really need to know if this is a Vundo infection as it has similar characteristics
This thread is for the use of roguewrench only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
roguewrench
Posts: 11 +0
Right now I am not having any issue with my system. I get pop-ups about 15 min after I start the system.
the log wat to long to add the the reply, so I attched them both.
the log wat to long to add the the reply, so I attched them both.
Blind Dragon
Posts: 3,774 +4
That's what I expected, it didn't catch the infection. This has been removing it the best so far
Download and Install SDFix
Run SDFix
Malwarebytes' Anti-Malware
Combofix
Combofix will automatically save the log file to C:\combofix.txt
Also attach fresh Hijackthis after following the above
This thread is for the use of roguewrench only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Download and Install SDFix
- Download SDFix and save it to your Desktop.
- Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Run SDFix
- Open the extracted SDFix folder and double click RunThis.bat to start the script.
- Type Y to begin the cleanup process.
- It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
- Press any Key and it will restart the PC.
- When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
- Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
- Attach Report.txt back here
Malwarebytes' Anti-Malware
- Please download Malwarebytes' Anti-Malware to your desktop.
- Double-click mbam-setup.exe and follow the prompts to install the program.
- At the end, be sure a checkmark is placed next to
- Update Malwarebytes' Anti-Malware
- and Launch Malwarebytes' Anti-Malware
- then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select Perform full scan, then click Scan.
- When the scan is complete, click OK, then Show Results to view the results.
- Be sure that everything is checked, and click Remove Selected.
- When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Combofix
- Download Combofix to your desktop.
- Double click combofix.exe & follow the prompts.
- A window will open with a warning.
- Type "1" (and Enter) to start the fix.
- When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log.
Combofix will automatically save the log file to C:\combofix.txt
Also attach fresh Hijackthis after following the above
This thread is for the use of roguewrench only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
roguewrench
Posts: 11 +0
I to a while but here is everything.
I attached the four file you asked for. they are to long to add to the text field.
I attached the four file you asked for. they are to long to add to the text field.
Blind Dragon
Posts: 3,774 +4
CFScript
Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..
Pay particular attention to this :-
Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Save this as CFScript.txt
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.
Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..
Pay particular attention to this :-
Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Save this as CFScript.txt
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.
roguewrench
Posts: 11 +0
Thank you for your help I know you have been going overboard to help a lot of people.
Blind Dragon
Posts: 3,774 +4
CFScript
Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..
Pay particular attention to this :-
Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Save this as CFScript.txt
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again.
-------------------------------------------------------------------------------
Download and Run ATF Cleaner
Download ATF Cleaner by Atribune to your desktop.
Double-click ATF Cleaner.exe to open it.
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox or Opera:
Click Firefox or Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
--------------------------------------------------------------------
Run Kaspersky Online AV Scanner
Order to use it you have to use Internet Explorer.
Go to Kaspersky and click the Accept button at the end of the page.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
Your next reply should have
1)Hijackthis log
2)Kaspersky log
This thread is for the use of roguewrench only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..
Pay particular attention to this :-
Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Save this as CFScript.txt
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again.
-------------------------------------------------------------------------------
Download and Run ATF Cleaner
Download ATF Cleaner by Atribune to your desktop.
Double-click ATF Cleaner.exe to open it.
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox or Opera:
Click Firefox or Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
--------------------------------------------------------------------
Run Kaspersky Online AV Scanner
Order to use it you have to use Internet Explorer.
Go to Kaspersky and click the Accept button at the end of the page.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
- Read the Requirements and limitations before you click Accept.
- Allow the ActiveX download if necessary.
- Once the database has downloaded, click Next.
- Click Scan Settings and change the "Scan using the following antivirus database" from standard to extended and then click OK.
- Click on "My Computer"
- When the scan has completed, click Save Report As...
- Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
- Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
Your next reply should have
1)Hijackthis log
2)Kaspersky log
This thread is for the use of roguewrench only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
roguewrench
Posts: 11 +0
Just wanted to let you know Kaspersky Online AV Scanner is running it's just taking a long time 2.5hours right now.
Blind Dragon
Posts: 3,774 +4
Ok, thanks for the update. Kaspersky is really used as a 2nd opinion of our work, and also points out where the last of the infections are hiding. There is really no 1 program that can see everything on your system so that is why we suggest such a wide variety of software
This thread is for the use of roguewrench only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
This thread is for the use of roguewrench only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
roguewrench
Posts: 11 +0
here they are.
Blind Dragon
Posts: 3,774 +4
How is your computer running? Any more symptoms?
Kaspersky is clean, only infections are listed in restore points which we will now clear and in quarantine of SDFix which we will now remove.
EDIT********************
I just noticed the 3 entries in Hijackthis that are infected, these were gone 24 hours ago. You were reinfected.
You aren't running Firewall Software. Please download and install one of these first!
Use a Firewall - It is very important that you use a Firewall on your computer. If you use the Windows Firewall you might think that's enough but it only controls inbound traffic. Simply using a Firewall in its default configuration can lower your risk greatly. Here are some firewalls which are free for personal use and most commonly used:
Comodo
Kerio
Online Armor
Zonealarm
---------------------------------------------------------------------
Combofix
Combofix will automatically save the log file to C:\combofix.txt
Kaspersky is clean, only infections are listed in restore points which we will now clear and in quarantine of SDFix which we will now remove.
EDIT********************
I just noticed the 3 entries in Hijackthis that are infected, these were gone 24 hours ago. You were reinfected.
You aren't running Firewall Software. Please download and install one of these first!
Use a Firewall - It is very important that you use a Firewall on your computer. If you use the Windows Firewall you might think that's enough but it only controls inbound traffic. Simply using a Firewall in its default configuration can lower your risk greatly. Here are some firewalls which are free for personal use and most commonly used:
Comodo
Kerio
Online Armor
Zonealarm
---------------------------------------------------------------------
Combofix
- Double click combofix.exe & follow the prompts.
- A window will open with a warning.
- Type "1" (and Enter) to start the fix.
- When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log.
Combofix will automatically save the log file to C:\combofix.txt
roguewrench
Posts: 11 +0
I did see any thing come up. My mcafeehad flags when I was running the programs you listed above.
I have firewall on my router and DSL Hub but I can add more. I also the port closed down and resticted IPs access
It seems to be running good now.
I have firewall on my router and DSL Hub but I can add more. I also the port closed down and resticted IPs access
It seems to be running good now.
Blind Dragon
Posts: 3,774 +4
The infection is definitley back with different random files.
Install 3rd party firewall and keep an eye on what is trying to connect. I have fixed machines before and watched the blocked intrusion attempts go crazy. Even behind router
Install 3rd party firewall and keep an eye on what is trying to connect. I have fixed machines before and watched the blocked intrusion attempts go crazy. Even behind router
roguewrench
Posts: 11 +0
here is the latest log file
Blind Dragon
Posts: 3,774 +4
Please install a Firewall ASAP!
Comodo
Kerio
Online Armor
Zonealarm
CFScript
Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..
Pay particular attention to this :-
Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Save this as CFScript.txt
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.
Comodo
Kerio
Online Armor
Zonealarm
CFScript
Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..
Pay particular attention to this :-
Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Save this as CFScript.txt
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.
roguewrench
Posts: 11 +0
I forgot to metion Had Mcafee Firewall already installed. I did go ahead and install ZoneAlarm to help.
Here is the new log.txt
Here is the new log.txt
Blind Dragon
Posts: 3,774 +4
Running 2 firewalls can cause problems, keep whichever one you like better.
Uninstall Combofix
* Click START then RUN
* Now type Combofix /u in the runbox
* Make sure there's a space between Combofix and /u
* Then hit Enter.
* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
-----------------------------------------------------------------------
Cleanup using OTMoveit2 by OldTimer
Now we can clear out the rest of the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if launched accidentally.
Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop.
1. Double click OTMoveIt2.exe to launch it.
If using Vista Right-Click OTMoveIt and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
* When finished exit out of OTMoveIt2
---------------------------------------------------------------------------
I recommend you keep
1 anti virus program
1 firewall
Combo of Anti-Spyware (Spybot S&D, Adaware 2007, and MBAM)
keep them updated.
You can also turn on tea timer in Spybot:
Also under Tools you can double-click System Startup in the right pane and disable programs from running at startup. This will free up system resources. For example if you don't use MSN Messenger everytime you run your computer you can disable it, then when you want to use it you can launch it through Start -> all programs, or make a shortcut on the desktop for it. That way it doesn't use resources when you aren't using it. Don't disable any entries in green though.
And just to be sure
Set correct settings for files
clear system restore points
Uninstall Combofix
* Click START then RUN
* Now type Combofix /u in the runbox
* Make sure there's a space between Combofix and /u
* Then hit Enter.
* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
-----------------------------------------------------------------------
Cleanup using OTMoveit2 by OldTimer
Now we can clear out the rest of the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if launched accidentally.
Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop.
1. Double click OTMoveIt2.exe to launch it.
If using Vista Right-Click OTMoveIt and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
* When finished exit out of OTMoveIt2
---------------------------------------------------------------------------
I recommend you keep
1 anti virus program
1 firewall
Combo of Anti-Spyware (Spybot S&D, Adaware 2007, and MBAM)
keep them updated.
You can also turn on tea timer in Spybot:
- Click on Mode at the top and make sure that Advanced is checked
- Expand the Tools tab in the left pane
- Single click on the Resident Icon also in the left pane
- check Resident "TeaTimer" (Protection of over-all system settings) Active
- Close spybot
Also under Tools you can double-click System Startup in the right pane and disable programs from running at startup. This will free up system resources. For example if you don't use MSN Messenger everytime you run your computer you can disable it, then when you want to use it you can launch it through Start -> all programs, or make a shortcut on the desktop for it. That way it doesn't use resources when you aren't using it. Don't disable any entries in green though.
And just to be sure
Set correct settings for files
- Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
- Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
- If unchecked please check Hide protected operating system files (Recommended)
- If necessary check "Display content of system folders"
- If necessary Uncheck Hide file extensions for known file types.
- Click OK
clear system restore points
This is a good time to clear your existing system restore points and establish a new clean restore point:- Go to Start > All Programs > Accessories > System Tools > System Restore
- Select Create a restore point, and Ok it.
- Next, go to Start > Run and type in cleanmgr
- Select the More options tab
- Choose the option to clean up system restore and OK it.
roguewrench
Posts: 11 +0
I owe you big time for your help. I work for Leatherman tool group we make personal multi tools. If you give me your address I send a special thank you.
roguewrench
Posts: 11 +0
Recommendation on these:
1 antivirus program
1 firewall
1 antivirus program
1 firewall
kritius
Posts: 2,077 +0
Blind Dragon
Posts: 3,774 +4
roguewrench said:
Thank you for the offer, but your appreciation is enough, and is why we donate our time. If you have any more problems please use this thread.
Regards,
Blind Dragon
- Status
Similar threads
Latest posts
-
Nintendo DMCA lawyers shut down everything Mario on Garry's Mod- Uncle Al replied
-
BlizzGone: Blizzard cancels 2024 convention but promises an eventual return- GodisanAtheist replied
