Home Discord Chat
Go Back   ChiefsPlanet > Nzoner's Game Room > Media Center

Reply
 
Thread Tools Display Modes
Old 08-18-2010, 12:28 AM  
Bearcat Bearcat is offline
Would an idiot do that?
 
Bearcat's Avatar
 
Join Date: Nov 2000
Location: Arizona
Casino cash: $3214931
The Official Malware/Antivirus Thread - Need help or general advice? Read this first!

This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.

Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer.

Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date.

Research


A lot of information can be found at this EliteKiller link, including...
  • Links to recommended malware scanning & removal tools, including the Rogue Removal Kit (which includes combofix), malwarebytes (aka MBAM), and Hitman Pro.
  • A link to HiJackThis, which creates a log of registry entries, running services, etc; that can be posted here for additional support.
  • Reviews, recommendations, and links to antivirus software, on-demand scanners, and online scanners.
  • Information on firewalls and unsecured networks, as well as malware/virus prevention.

Malware Removal

If you think your computer is infected, the EliteKiller link provides a thorough solution. Simply put...

Quote:
Originally Posted by mikeyis4dcats. View Post
Step 1 go here http://www.elitekiller.com/malware.htm and read up

Step 2 download the Rogue Removal Kit http://www.elitekiller.com/files/rogueremoval.zip

Step 3 unzip the Kit, read the instruction file and run the tools in the order given.

Step 4 Thank me in about 3 hours for fixing your shit.

The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode.

Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix.

Taken from the readme in the Rogue Removal Kit:

Quality Online Virus Scanners: (all scanners offer detection and removal)


F-Secure
NOD32
Bitdefender

Quality Free Anti-Virus Software:

Panda Cloud
Microsoft Security Essentials
Antivir
Avast!
AVG


My two cents on downloading anti-malware software...
  • Download it from another computer if possible, or from Safe Mode With Networking on the infected machine.
  • Verify you are downloading from a legit source and are not being redirected to a site where you'll end up downloading more malware. If you click on any links above, verify the link in the bottom left before clicking on it, then after clicking the link verify that's where you were taken in the address bar.
  • The elitekiller article mentions downloading the software to a USB drive. Do not download the software to a USB drive on the infected machine if you're not in Safe Mode, or else you risk infecting the USB drive and other computers you connect the drive to in the future.

Other Helpful Tips & Tools

Rkill will kill processes that may be preventing scanners from completely removing malware.

To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking.

If you get a Blue Screen of Death after selecting Safe Mode With Networking, read the following posts on how to fix it:
http://blog.didierstevens.com/2006/06/22/save-safeboot/
http://blog.didierstevens.com/2006/0...ring-safeboot/
http://blog.didierstevens.com/2007/0...th-a-reg-file/


Still infected, or just want to make sure everything is okay?

HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'.

If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research.

You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed.


Windows Performance

A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away.

To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer.

Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore.

Last edited by Bearcat; 03-27-2012 at 04:07 PM..
Posts: 54,804
Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.
    Reply With Quote
Old 11-15-2011, 09:13 PM   #196
KurtCobain KurtCobain is offline
legend
 
KurtCobain's Avatar
 

Join Date: Oct 2006
Location: Independence, MO
Casino cash: $-1277903
so i turn hit the power button on my hp desktop and the fans spin and the lights light up, but nothing else happens. nothing on screen. is it toast?
Posted via Mobile Device
Posts: 28,350
KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.KurtCobain is obviously part of the inner Circle.
    Reply With Quote
Old 11-16-2011, 05:17 PM   #197
chasedude chasedude is offline
Supporter
 
chasedude's Avatar
 

Join Date: Sep 2005
Location: St. Joe
Casino cash: $10004900
Quote:
Originally Posted by KurtCobain View Post
so i turn hit the power button on my hp desktop and the fans spin and the lights light up, but nothing else happens. nothing on screen. is it toast?
Posted via Mobile Device
Could be a video failure. Do you have another monitor around you could plug into the laptop?
Posts: 36,287
chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.
    Reply With Quote
Old 11-28-2011, 05:23 AM   #198
Pushead2 Pushead2 is offline
**** off
 
Pushead2's Avatar
 

Join Date: Feb 2007
Location: New York
Casino cash: $7571882
Has anyone in Malwarebytes ever come across the updating error
Quote:
program_error_updating 11004 0
I'm trying to clean out a laptop that was given to me, I know it is infected and when you google it, it says to run a Quick scan and see if you get
Quote:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Bad: (213.109.65.147) Good: () -> Quarantined and deleted successfully.
I did not see that in the quick scan - any ideas what I can do to clean this machine out?? Should I just go straight to ComboFix?
__________________
"**** up once, lose two teeth....”
Posts: 5,186
Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.
    Reply With Quote
Old 11-28-2011, 06:53 AM   #199
Pushead2 Pushead2 is offline
**** off
 
Pushead2's Avatar
 

Join Date: Feb 2007
Location: New York
Casino cash: $7571882
Here's the hijackthis log:

Quote:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:20:55 AM, on 11/28/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 4 for rogueremoval (2).zip\HiJack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 \3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Administrator\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_9 -reboot 1
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Privacy Protection] C:\Documents and Settings\All Users\Application Data\privacy.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O4 - Startup: PMB Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.syr.edu
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxct_device - - C:\WINDOWS\system32\lxctcoms.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 9876 bytes
__________________
"**** up once, lose two teeth....”
Posts: 5,186
Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.
    Reply With Quote
Old 11-28-2011, 06:53 AM   #200
Pushead2 Pushead2 is offline
**** off
 
Pushead2's Avatar
 

Join Date: Feb 2007
Location: New York
Casino cash: $7571882
Here's the ComboFix Log:

Quote:
ComboFix 11-11-28.02 - Administrator 11/28/2011 7:37.1.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.202 [GMT -5:00]
Running from: E:\ComboFix.exe
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\DFx5B.tmp
c:\documents and settings\Administrator\My Documents\~WRL0360.tmp
c:\documents and settings\Administrator\My Documents\~WRL2813.tmp
c:\documents and settings\All Users\Application Data\privacy.exe
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\SPL11A.tmp
c:\documents and settings\All Users\SPLB.tmp
c:\windows\bwUnin-6.1.4.36-8876480L.exe
c:\windows\CSC\d6
c:\windows\system32\usp10(3).dll
.
.
((((((((((((((((((((((((( Files Created from 2011-10-28 to 2011-11-28 )))))))))))))))))))))))))))))))
.
.
2011-11-28 12:14 . 2011-11-28 12:14 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-11-28 12:02 . 2011-11-28 12:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2011-11-28 11:53 . 2011-11-28 11:53 94768 ----a-w- c:\windows\system32\drivers\72330364.sys
2011-11-27 17:19 . 2011-11-27 17:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-11-27 17:19 . 2011-11-27 17:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-11-27 17:18 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-27 17:18 . 2011-11-27 17:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-01 06:50 . 2011-11-27 17:12 -------- d-----w- c:\documents and settings\All Users\Application Data\hjvoesiiangeeau
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 11:54 . 2004-08-04 04:07 187776 ----a-w- c:\windows\system32\drivers\acpi.sys
2011-10-10 14:22 . 2007-10-02 20:58 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2004-08-04 05:56 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 15:41 . 2008-07-29 23:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41 . 2001-08-23 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41 . 2001-08-23 12:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-06 13:20 . 2004-08-04 04:17 1858944 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Administrator\Application Data\mjusbsp\cdloader2.exe" [2009-04-10 50520]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2009-06-27 16384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"lxctmon.exe"="c:\program files\Lexmark 5400 Series\lxctmon.exe" [2006-11-22 291760]
"Lexmark 5400 Series Fax Server"="c:\program files\Lexmark 5400 Series\fm3032.exe" [2006-11-22 304048]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"EzPrint"="c:\program files\Lexmark 5400 Series\ezprint.exe" [2006-11-22 82864]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-02-28 519584]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712]
PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2010-6-13 327680]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-02-15 22:07 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\lxctcoms.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
.
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [3/25/2010 9:25 AM 30969208]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 8:37 PM 4640000]
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\q3of49i7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=VI2TDF&PC=VI2TDF&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
HKLM-Run-LXCTCATS - \3\LXCTtime.dll
MSConfigStartUp-Aim6 - c:\program files\AIM6\aim6.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-28 07:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCTCATS = rundll32 \3\LXCTtime.dll,_RunDLLEntry@16????????????????????????????????????????????????????????????????????? ???????????????????????????????????????????????????????????????????????????????????????????????????? ??????????????????????????????????????????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-790525478-688789844-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,da,1e,51,55,57,99,8c,44,8f,4d,b4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,da,1e,51,55,57,99,8c,44,8f,4d,b4,\
.
Completion time: 2011-11-28 07:50:04
ComboFix-quarantined-files.txt 2011-11-28 12:49
.
Pre-Run: 38,911,938,560 bytes free
Post-Run: 39,301,586,944 bytes free
.
- - End Of File - - AE8876CFA4D6B1464D68D76B79883ED3
__________________
"**** up once, lose two teeth....”
Posts: 5,186
Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.
    Reply With Quote
Old 11-28-2011, 07:05 AM
Pushead2
This message has been deleted by Pushead2.
Old 11-28-2011, 07:05 AM
Pushead2
This message has been deleted by Pushead2.
Old 11-28-2011, 07:19 AM   #201
Pushead2 Pushead2 is offline
**** off
 
Pushead2's Avatar
 

Join Date: Feb 2007
Location: New York
Casino cash: $7571882
update is that my LAN works but the laptop won't connect via wireless.

I'm working on it my job though. Is it possible its set up for his router? Should I delete it & re-install the wireless driver?
__________________
"**** up once, lose two teeth....”

Last edited by Pushead2; 11-28-2011 at 07:58 AM..
Posts: 5,186
Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.
    Reply With Quote
Old 11-28-2011, 11:03 AM   #202
Pushead2 Pushead2 is offline
**** off
 
Pushead2's Avatar
 

Join Date: Feb 2007
Location: New York
Casino cash: $7571882
I'm all set! Everything works
__________________
"**** up once, lose two teeth....”
Posts: 5,186
Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.Pushead2 would the whole thing.
    Reply With Quote
Old 11-28-2011, 07:09 PM   #203
DaveNull DaveNull is offline
Veteran
 
DaveNull's Avatar
 

Join Date: Nov 2011
Location: Villa Straylight
Casino cash: $10005610
Never use a computer that you didn't install the operating system on...especially one that spits out log files that look like this.

Unless you installed LimeWire yourself from a known source (and even then using that network is asking for a vile note from your ISP or one of the record labels) I'd certainly consider it riddled with stuff that's part of a bonnet at this point.
Posts: 2,367
DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.
    Reply With Quote
Old 12-05-2011, 06:10 PM   #204
Mr. Plow Mr. Plow is offline
Malcor is in the Mod Lounge
 
Mr. Plow's Avatar
 

Join Date: Dec 2005
Casino cash: $2347391
My son had the "Win 7 anitspyware 2012" virus: http://www.bleepingcomputer.com/viru...tispyware-2012


Followed the steps in the above link....rkill; malwarebytes; etc....Malwarebytes found it and I got it removed. Computer seems to be running fine now.

I've just rerun Malwarebytes a second time before doing another virus scan, here is a log of the files that it detects as malicious. Could someone in "the know" look at the files and make sure they are either A: malicious and need to be removed or B: normal and can be ignored on future scans.

I don't want to ignore something that I need to remove, and I definitely don't want to remove something that should be ignored.

Thanks!


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8318

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/5/2011 6:02:51 PM
mbam-log-2011-12-05 (18-02-41).txt

Scan type: Full scan (C:\|)
Objects scanned: 294023
Time elapsed: 29 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{9193fbaf-bdaf-4751-a99a-1f5ef255c35b} (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\facetheme-apl (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\program files (x86)\Object (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon (PUP.FCTPlugin) -> No action taken.

Files Infected:
c:\program files (x86)\Object\status.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\bho_project.dll (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon.pem (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\config.ini (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\enable.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\facetheme-apl_uninstall.exe (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\status2.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\._included.js (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\background.html (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\included.js (PUP.FCTPlugin) -> No action taken.
Posts: 30,703
Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.Mr. Plow is obviously part of the inner Circle.
    Reply With Quote
Old 12-06-2011, 12:56 PM   #205
DaveNull DaveNull is offline
Veteran
 
DaveNull's Avatar
 

Join Date: Nov 2011
Location: Villa Straylight
Casino cash: $10005610
Back up your data and reinstall windows. This is really the only way that you can be sure that all of this stuff is gone. "Good" malware will avoid all of these tools.

This is another reason to keep your data separate and constantly backed up so reinstalling windows isn't that big of a deal.

Or, you know, stop using Windows.
Posts: 2,367
DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.
    Reply With Quote
Old 12-07-2011, 07:31 AM   #206
pearlblue pearlblue is offline
Rookie
 

Join Date: Dec 2011
Casino cash: $10004900
Thanks guys! This is what I've been looking for. Such a helpful and informative thread.
Posts: 25
pearlblue is a favorite in the douche of the year contest.pearlblue is a favorite in the douche of the year contest.pearlblue is a favorite in the douche of the year contest.pearlblue is a favorite in the douche of the year contest.pearlblue is a favorite in the douche of the year contest.pearlblue is a favorite in the douche of the year contest.
    Reply With Quote
Old 12-07-2011, 07:35 AM   #207
durtyrute durtyrute is offline
MVP
 
durtyrute's Avatar
 

Join Date: Mar 2011
Casino cash: $8526085
Sorry if this has been asked, but does anyone know how to get rid of win.32.pup.bandoo from a XP computer?
Posts: 5,831
durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.durtyrute is blessed with 50/50 Hindsight.
    Reply With Quote
Old 12-07-2011, 10:33 AM   #208
DaveNull DaveNull is offline
Veteran
 
DaveNull's Avatar
 

Join Date: Nov 2011
Location: Villa Straylight
Casino cash: $10005610
Quote:
Back up your data and reinstall windows.
Seriously. Malware is designed in many instances to steal login credentials and other sensitive information. It's foolish to rely on free tools which may or may not be completely effective to remove this crap. Once that's done, try to figure out what you did to get infected and stop doing that. Here are some other thoughts on how to avoid this situation entirely.

0. Back up your data so that reinstallation or hardware failure isn't so hard to recover from. If you don't have three copies (one working, one local backup, one offsite backup) then you're at risk of losing data.
1. If you can avoid using Windows, do so.
2. If you have to use Windows, use Windows 7.
3. Don't use IE. Chrome is a nice alternative.
4. Install Ad-Block extensions to any browsers that you use.
5. If you insist on installing Flash, use the Click-to-Flash extension. This way you're only loading flash content you actually want to see. The only way I run Flash is through Chrome which has it's own sandboxed version.
6. Install all of your system updates when they become available including Flash and Acrobat.
7. Stop using Windows. Mac hardware isn't as comparatively expensive as it used to be. What's your time worth? Is wrestling with constant malware infections and account compromises really worth saving a couple hundred bucks on a computer?
Posts: 2,367
DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.DaveNull Forgot to Remove His Claytex and Got Toxic Shock Syndrome.
    Reply With Quote
Old 12-08-2011, 11:16 AM   #209
Fish Fish is online now
Ain't no relax!
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $2668919
FYI..... this looks to be a great offline tool to clean your Windows machines..

Windows Defender Offline Beta

Microsoft this week released a beta version of what appears to be a very useful tool: An offline version of its Windows Defender anti-malware solution. This tool can help final and remove malicious software, much like the version built into Windows. But because it can be installed to CD, DVD, or USB flash drive, it can be run in offline mode, when the Windows OS isn't running. And that makes it more effective, since many exploits, like rootkits, are hard to remove when Windows is running.

You can find the Windows Defender Offline Beta on the Microsoft web site. You'll need a blank CD, DVD, or a USB flash drive you don't mind formatting. There are basically two downloads that need to occur; the tiny installer and then a later 214 MB Setup package that is expanded and copied onto the media. This package includes all the files needed to boot your PC plus the Windows Defender Offline tool itself.



To use the tool, you need to reboot your PC from the created optical disk or USB flash drive. (This could require interrupting the boot process and choosing a different boot device, of course.) The interface is straightforward and basically resembles a full-screen version of Windows Defender, giving you a chance to perform Quick, Full, and Custom scans of the underlying PC.

Intriguingly, this tool also appears to be based on the Windows 8 version of Windows Defender, in that it provides both spyware and anti-virus scanning.
__________________
Posts: 47,320
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
    Reply With Quote
Old 12-08-2011, 11:21 AM   #210
QuikSsurfer QuikSsurfer is offline
Got swag?
 
QuikSsurfer's Avatar
 

Join Date: Aug 2003
Location: Madison, MS
Casino cash: $10008287
Quote:
Originally Posted by KC Fish View Post
FYI..... this looks to be a great offline tool to clean your Windows machines..

Windows Defender Offline Beta

Microsoft this week released a beta version of what appears to be a very useful tool: An offline version of its Windows Defender anti-malware solution. This tool can help final and remove malicious software, much like the version built into Windows. But because it can be installed to CD, DVD, or USB flash drive, it can be run in offline mode, when the Windows OS isn't running. And that makes it more effective, since many exploits, like rootkits, are hard to remove when Windows is running.

You can find the Windows Defender Offline Beta on the Microsoft web site. You'll need a blank CD, DVD, or a USB flash drive you don't mind formatting. There are basically two downloads that need to occur; the tiny installer and then a later 214 MB Setup package that is expanded and copied onto the media. This package includes all the files needed to boot your PC plus the Windows Defender Offline tool itself.



To use the tool, you need to reboot your PC from the created optical disk or USB flash drive. (This could require interrupting the boot process and choosing a different boot device, of course.) The interface is straightforward and basically resembles a full-screen version of Windows Defender, giving you a chance to perform Quick, Full, and Custom scans of the underlying PC.

Intriguingly, this tool also appears to be based on the Windows 8 version of Windows Defender, in that it provides both spyware and anti-virus scanning.
This would be encouraging if Windows Defender actually did anything useful.
Save your flashdrives/dvds for a useful tool(s), like Hirens or UBCD.
__________________
Posts: 11,847
QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.
    Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On

Forum Jump




All times are GMT -6. The time now is 11:01 PM.


This is a test for a client's site.
Fort Worth Texas Process Servers
Covering Arlington, Fort Worth, Grand Prairie and surrounding communities.
Tarrant County, Texas and Johnson County, Texas.
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.