Home Discord Chat
Go Back   ChiefsPlanet > Nzoner's Game Room > Media Center

Reply
 
Thread Tools Display Modes
Old 08-18-2010, 12:28 AM  
Bearcat Bearcat is offline
Would an idiot do that?
 
Join Date: Nov 2000
Location: Arizona
The Official Malware/Antivirus Thread - Need help or general advice? Read this first!

This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.

Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer.

Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date.

Research


A lot of information can be found at this EliteKiller link, including...
  • Links to recommended malware scanning & removal tools, including the Rogue Removal Kit (which includes combofix), malwarebytes (aka MBAM), and Hitman Pro.
  • A link to HiJackThis, which creates a log of registry entries, running services, etc; that can be posted here for additional support.
  • Reviews, recommendations, and links to antivirus software, on-demand scanners, and online scanners.
  • Information on firewalls and unsecured networks, as well as malware/virus prevention.

Malware Removal

If you think your computer is infected, the EliteKiller link provides a thorough solution. Simply put...

Quote:
Originally Posted by mikeyis4dcats. View Post
Step 1 go here http://www.elitekiller.com/malware.htm and read up

Step 2 download the Rogue Removal Kit http://www.elitekiller.com/files/rogueremoval.zip

Step 3 unzip the Kit, read the instruction file and run the tools in the order given.

Step 4 Thank me in about 3 hours for fixing your shit.

The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode.

Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix.

Taken from the readme in the Rogue Removal Kit:

Quality Online Virus Scanners: (all scanners offer detection and removal)


F-Secure
NOD32
Bitdefender

Quality Free Anti-Virus Software:

Panda Cloud
Microsoft Security Essentials
Antivir
Avast!
AVG


My two cents on downloading anti-malware software...
  • Download it from another computer if possible, or from Safe Mode With Networking on the infected machine.
  • Verify you are downloading from a legit source and are not being redirected to a site where you'll end up downloading more malware. If you click on any links above, verify the link in the bottom left before clicking on it, then after clicking the link verify that's where you were taken in the address bar.
  • The elitekiller article mentions downloading the software to a USB drive. Do not download the software to a USB drive on the infected machine if you're not in Safe Mode, or else you risk infecting the USB drive and other computers you connect the drive to in the future.

Other Helpful Tips & Tools

Rkill will kill processes that may be preventing scanners from completely removing malware.

To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking.

If you get a Blue Screen of Death after selecting Safe Mode With Networking, read the following posts on how to fix it:
http://blog.didierstevens.com/2006/06/22/save-safeboot/
http://blog.didierstevens.com/2006/0...ring-safeboot/
http://blog.didierstevens.com/2007/0...th-a-reg-file/


Still infected, or just want to make sure everything is okay?

HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'.

If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research.

You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed.


Windows Performance

A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away.

To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer.

Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore.

Last edited by Bearcat; 03-27-2012 at 04:07 PM..
Posts: 54,960
Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.
  Reply With Quote
Old 01-24-2011, 11:16 PM   #106
Sure-Oz Sure-Oz is offline
Stay positive, don't give up
 
Join Date: Dec 2001
As for the proxy server, im not sure it's intentional or not. Dad has has a DSL router/modem in 1 from at&t yahoo and has multiple pcs and phones connected. Would removing the proxy stuff above effect any of that?
Posts: 46,175
Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.
    Reply With Quote
Old 01-24-2011, 11:44 PM   #107
Bearcat Bearcat is offline
Would an idiot do that?
 
Join Date: Nov 2000
Location: Arizona
Quote:
Originally Posted by Sure-Oz View Post
As for the proxy server, im not sure it's intentional or not. Dad has has a DSL router/modem in 1 from at&t yahoo and has multiple pcs and phones connected. Would removing the proxy stuff above effect any of that?
I can't tell you for sure... my guess is those entries remain from the malware, but I couldn't tell you if your dad has a use for it.

If he's not aware of needing a proxy server, it's safe to delete them and easy to replace them later. You would just need to go to that location in regedit and recreate those keys.
Posts: 54,960
Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.
    Reply With Quote
Old 01-25-2011, 12:40 AM   #108
Sure-Oz Sure-Oz is offline
Stay positive, don't give up
 
Join Date: Dec 2001
Quote:
Originally Posted by Bearcat View Post
I can't tell you for sure... my guess is those entries remain from the malware, but I couldn't tell you if your dad has a use for it.

If he's not aware of needing a proxy server, it's safe to delete them and easy to replace them later. You would just need to go to that location in regedit and recreate those keys.
I assume there is no use for them, my dad is not cpu savy at all and i assume the router didn't create those on its own.
Posts: 46,175
Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.
    Reply With Quote
Old 01-27-2011, 06:00 PM   #109
Bearcat Bearcat is offline
Would an idiot do that?
 
Join Date: Nov 2000
Location: Arizona
I'm updating the OP. I added the online analyze for HiJackThis, and I'm going to add some stuff about Windows services and msconfig.

So, keep the suggestions coming, and I'll try to update it more often... and if you've already suggested something that's not in the OP and you still think it should be included, suggest it again and the worst I'll do is ignore it again.
Posts: 54,960
Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.
    Reply With Quote
Old 01-31-2011, 10:52 PM   #110
RedNFeisty RedNFeisty is offline
Smokin
 
Join Date: May 2003
Location: Wichita
Question, after reading EliteKille, it suggests I may need to reinstall an OS, but I am using a little tiny notepad that does not have a disk drive. So, I can not put in a disk to reinstall anything....suggestions??

Awesome Thread, btw!
Posts: 8,393
RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.RedNFeisty Forgot to Remove His Claytex and Got Toxic Shock Syndrome.
    Reply With Quote
Old 02-08-2011, 02:59 PM   #111
chasedude chasedude is offline
Supporter
 
Join Date: Sep 2005
Location: St. Joe
Quote:
Originally Posted by RedNFeisty View Post
Question, after reading EliteKille, it suggests I may need to reinstall an OS, but I am using a little tiny notepad that does not have a disk drive. So, I can not put in a disk to reinstall anything....suggestions??

Awesome Thread, btw!
I've never tried it but it might be possible to load the disk onto a USB flash drive. Of course you would need another computer to do this.

You could then boot your laptop to USB using the flash drive and load the OS that way.

I have loaded OS's through the network before.
Posts: 36,287
chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.
    Reply With Quote
Old 02-26-2011, 03:05 PM   #112
Sure-Oz Sure-Oz is offline
Stay positive, don't give up
 
Join Date: Dec 2001
I copied this from another forum: since my dads pc has this exact issue:

cant hyperlink from search engine (google). it redirects me to ads or other pages and says url fraudcheck in the information bar at the bottom of the screen.

browser has been hijacked. any ideas to rectify this. done malwarebytes scan and antivirus and super antispyware scan. still the same

Any ideas? ran malwarebytes, avast antivirus scan and spybot nothing found.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:05:30 PM, on 2/26/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Shizzy.HOME\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HitmanPro35] "C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe" /scan:boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: GoZone iSync.lnk = C:\Program Files\GoZone\GoZone_iSync.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1242228432890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1242343626562
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...Uploader55.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-09.sun.com/s/ESD7/JSC...ws-i586-jc.cab
O16 - DPF: {B80CD4E6-5B02-4B6C-99BE-68F1511E9549} (WebSlingPlayer) - http://plugin.slingbox.com/downloads...lingPlayer.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe

--
End of file - 8186 bytes
Posts: 46,175
Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.Sure-Oz wants to die in a aids tree fire.
    Reply With Quote
Old 02-26-2011, 05:36 PM   #113
QuikSsurfer QuikSsurfer is offline
Got swag?
 
Join Date: Aug 2003
Location: Madison, MS
Quote:
Originally Posted by Sure-Oz View Post
I copied this from another forum: since my dads pc has this exact issue:

cant hyperlink from search engine (google). it redirects me to ads or other pages and says url fraudcheck in the information bar at the bottom of the screen.
Sounds like a corrupt host file..

check the entries in the file
c:\Windows\System32\drivers\etc\hosts

select to open with notepad --- copy and paste the jazz here.
Posts: 11,847
QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.QuikSsurfer has parlayed a career as a truck driver into debt free trailer and jon boat ownership.
    Reply With Quote
Old 03-03-2011, 12:43 PM   #114
chasedude chasedude is offline
Supporter
 
Join Date: Sep 2005
Location: St. Joe
Quote:
Originally Posted by Sure-Oz View Post
I copied this from another forum: since my dads pc has this exact issue:

cant hyperlink from search engine (google). it redirects me to ads or other pages and says url fraudcheck in the information bar at the bottom of the screen.
This maybe nothing but I notice both McAFee and Avast programs listed.

I'm assuming you've loaded avast after the McAfee script ran out.

I have had systems run into conflicts before with 2 different antivirus' running.

See if a uninstall of McAfee and a reboot can help in your troubles.

This may not be a fix for your situation, but when troubleshooting these damn machines it's worth a step to try.

Good Luck!
Posts: 36,287
chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.
    Reply With Quote
Old 04-01-2011, 07:53 PM   #115
ThaVirus ThaVirus is offline
All about that Paper Boi
 
Join Date: Sep 2007
Ok, so I ran into a virus thing today. Was browsing the web and all of a sudden my comp started telling me my hard drive had failed and all kinds of crazy stuff. So some WindowsHelper thing popped up and began "searching for any problems" and "found" 11 of them. It looked legit and wouldn't let me touch anything else so I clicked OK like a dumbass. Then shit started ****ing up and got even worse.

Anyway, I started the Task Manager and found a couple odd programs running: one of which was "483080805740..." (a bunch of numbers-not accurate) and another "A1Ashfjdhf..." (a bunch of letters-again not accurate). So I ended the processes and was able to open other things in my comp again. After I updated Malware Bytes I ran the check and it found 5 problems (2 of which were the ones already mentioned and the other 3 I didn't recognize). Anyway, I removed them and now I can access all processes of my comp.

Here's the issue: all of my data and files have been wiped out. Since my comp is just for schoolwork, music and browsing the web I didn't have many important files saved in the first place so I'm fine with that. The thing is, when I move the cursor over any of the folders- let's just say Music- all of the information pertaining to it shows up. So it says my Music folder has 9.84 GBs worth of files and when it was created and all of that, but none of it is showing up. All of my songs even exist and play perfectly in iTunes, it's pretty bizarre.

I've been browsing the web on how to restore lost information and am not computer savy enough to figure out their instructions. I haven't run any "System Restore" or "Recovery" programs yet. So my questions to you guys are:
1. Is there anyway to recover all of my "lost" data and files?
2. Since Malware apparently deleted any traces of the virus, is it safe to be browsing on the same comp again? (Which I'm doing now, by the way)
3. I've accessed my credit card/bank accounts and have applied for several jobs on this comp (so I've entered in a lot of my personal information). I have never saved any of this information or any of these passwords (just entered them in and submitted them) so is there anyway that this virus possibly could have stolen any of that info?

***EDIT: As I said earlier, none of the files on the comp were extremely vital to me so I never ran any backup, transferring of the files to an external hard drive, etc. I'm sure that will come back to bite me in the ass now but I figured it was pertinent information for you to help me.

Last edited by ThaVirus; 04-01-2011 at 07:58 PM..
Posts: 43,992
ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.
    Reply With Quote
Old 04-01-2011, 08:31 PM   #116
Bearcat Bearcat is offline
Would an idiot do that?
 
Join Date: Nov 2000
Location: Arizona
Quote:
Originally Posted by ThaVirus View Post
Ok, so I ran into a virus thing today. Was browsing the web and all of a sudden my comp started telling me my hard drive had failed and all kinds of crazy stuff. So some WindowsHelper thing popped up and began "searching for any problems" and "found" 11 of them. It looked legit and wouldn't let me touch anything else so I clicked OK like a dumbass. Then shit started ****ing up and got even worse.

Anyway, I started the Task Manager and found a couple odd programs running: one of which was "483080805740..." (a bunch of numbers-not accurate) and another "A1Ashfjdhf..." (a bunch of letters-again not accurate). So I ended the processes and was able to open other things in my comp again. After I updated Malware Bytes I ran the check and it found 5 problems (2 of which were the ones already mentioned and the other 3 I didn't recognize). Anyway, I removed them and now I can access all processes of my comp.

Here's the issue: all of my data and files have been wiped out. Since my comp is just for schoolwork, music and browsing the web I didn't have many important files saved in the first place so I'm fine with that. The thing is, when I move the cursor over any of the folders- let's just say Music- all of the information pertaining to it shows up. So it says my Music folder has 9.84 GBs worth of files and when it was created and all of that, but none of it is showing up. All of my songs even exist and play perfectly in iTunes, it's pretty bizarre.

I've been browsing the web on how to restore lost information and am not computer savy enough to figure out their instructions. I haven't run any "System Restore" or "Recovery" programs yet. So my questions to you guys are:
1. Is there anyway to recover all of my "lost" data and files?
2. Since Malware apparently deleted any traces of the virus, is it safe to be browsing on the same comp again? (Which I'm doing now, by the way)
3. I've accessed my credit card/bank accounts and have applied for several jobs on this comp (so I've entered in a lot of my personal information). I have never saved any of this information or any of these passwords (just entered them in and submitted them) so is there anyway that this virus possibly could have stolen any of that info?

***EDIT: As I said earlier, none of the files on the comp were extremely vital to me so I never ran any backup, transferring of the files to an external hard drive, etc. I'm sure that will come back to bite me in the ass now but I figured it was pertinent information for you to help me.
Windows XP or 7?

I'm taking off soon, so don't know how much detail I'll be able to get into.... if you Google 'Windows XP restore' or 'Windows 7 restore', you can find info on how to do a restore. That will restore your computer back to a certain date, so you would lose anything new from that date until today. If you have Windows CDs, you could also do a fresh install, which would obviously delete everything.

As far as the virus, I wouldn't assume it's gone. I would follow some of the instructions in the OP... look at the elitekiller site, download the toolkit, and run the scans from Safe Mode (reboot and press f8 a few times (it's in the OP, too)).

As far as the files... the folder says there's stuff in it, but you don't see anything? Usually if it's corrupt, you'll at least see icons, but either way... if they're gone or corrupt, you're probably SOL.

As far as the personal information, I doubt any of it is at risk... you could always change important passwords, but if you haven't saved bank/CC info anywhere on the PC, I wouldn't worry about it.


So.... for a basic gameplan,
1) I think a restore is your best option at this point, and Google (or someone who's going to be here later tonight) should be able to help you there... if you're not comfortable doing what Google says, or need verification on anything, feel free to post it here, but you might have to wait a little while for feedback.

2) If you're not doing the restore right away, while you're waiting, I'd look at the OP and run the scans in Safe Mode... that will at least get you to a point where your computer is cleaned up, and there's a smaller risk of something else going wrong.
Posts: 54,960
Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.
    Reply With Quote
Old 04-01-2011, 08:48 PM   #117
ThaVirus ThaVirus is offline
All about that Paper Boi
 
Join Date: Sep 2007
Thanks for the prompt response, my man. I'm getting ready to hit the town so I'll take a look at all that stuff tomorrow.. Let you guys know how it goes.
Posts: 43,992
ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.ThaVirus is obviously part of the inner Circle.
    Reply With Quote
Old 04-04-2011, 05:34 PM   #118
Bearcat Bearcat is offline
Would an idiot do that?
 
Join Date: Nov 2000
Location: Arizona
Quote:
Originally Posted by ThaVirus View Post
Thanks for the prompt response, my man. I'm getting ready to hit the town so I'll take a look at all that stuff tomorrow.. Let you guys know how it goes.
Did you get it fixed?
Posts: 54,960
Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.
    Reply With Quote
Old 04-10-2011, 02:17 AM   #119
salame salame is offline
Under the Sofa
 
Join Date: Apr 2009
****ing malware man
Posts: 4,907
salame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitellisalame 's adopt a chief was Sabby Piscitelli
    Reply With Quote
Old 04-11-2011, 02:19 PM   #120
Bowser Bowser is offline
mod-ish
 
Join Date: Jan 2004
Location: KC North
Ok, so my avast starts going apeshit with a malware warning. I open it up, delete it, restart, and get to a window where everything looks like it's from 1988, asking if I want to delete the problem. I click yes, and it goes nuts deleting stuff. Now, I am looking at a line that reads thusly -

File C:\windows\help\mui\0409\aclui.CHM>html\066cfb1-0e68-40bb-b889-6268f1308575.htm is infected by HTML:Script-inf
File is in windows folder, are you sure?
1-Yes, 2-Yes all, 3-No, Esc-Exit :

I have no idea where this shit is. I'm assuming I click yes all, but is that right? (And btw, the avast went apeshit on me as soon as I left ChiefsPlanet)
Posts: 100,198
Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.Bowser is obviously part of the inner Circle.
    Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On

Forum Jump




All times are GMT -6. The time now is 12:54 PM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.