Virusremover 2008 + associated issues!!!
Touch Forum Moderator Hello
Have you tried a systemrestore ?
Start - run, or winkey+r at the same time
Copy this in to the box: %systemroot%\system32\restore\rstrui.exe
Hit Enter
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
bosso20640 When I click the START button I don't get the RUN option Back to Top
bosso20640 Well, I eventually managed to have a degree of success by using Malwarebytes Anti-Malware!!! Back to Top
bosso20640 Here is the Hijackthis Log file:
Logfile of HijackThis v1.99.1
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Ulead Photo Express Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 5 SE\calcheck.exe
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [brastk] brastk.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [] C:\Documents and Settings\Andrew\Application Data\Adobe\Player.exe
O4 - HKCU\..\Run: [cmden] C:\WINDOWS\system32\hmnavqvs.exe
O4 - Startup: Rapid Antivirus.lnk = C:\Program Files\Rapid Antivirus\Rapid Antivirus.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspx O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.%22download.com%22
O15 - Trusted Zone:
http://www.mymaths.co.uk O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) -
http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://lilxmissxmanda.spaces.live.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) -
http://upload.facebook.com/controls/FacebookPhotoUploader3.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) -
http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) -
http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1171379776234 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1171379763843 O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) -
https://www.tescophoto.com/wpp/tesco/app/opcuploader.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: karna.dat ztikhm.dll gwiylv.dll ammolv.dll lygltq.dll
O20 - Winlogon Notify: gzipmod - C:\WINDOWS\SYSTEM32\gzipmod.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: xgpsarbm - {9C6CC07C-B03E-4A17-8157-1D1DF4221147} - C:\WINDOWS\xgpsarbm.dll (file missing)
O21 - SSODL: onfwbsak - {877EE4A5-6E5A-486E-A914-17FF26CE6B3E} - C:\WINDOWS\onfwbsak.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DvpApi - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
Back to Top
Touch Forum Moderator I´ve missed you- sorry. Update malwarebyte and run a complete scan.
Please download Combofix:
And save to the desktop.
Close all other browser windows.
Important-> Temporarily disable your anti-virus, real-time protection before performing a scan. They can interfere with combofix or remove some of its embedded files which may cause "unpredictable results".
Go to Start->Run and copy/paste: ComboFix /snapshot and hit OK. It should run Combofix.
Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.
When finished, it will produce a logfile located at C:\combofix.txt.
Post the contents of that log in your next reply, along with malwarebyte log
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
bosso20640 SP3 downloaded and installed since my last Malware log so this latest one shows up all sorts ("residue rubbish") anyway I chose to "Remove Selected" after the log was produced, DIDN't REBOOT just ran ComboFix Back to Top
bosso20640
Touch Forum Moderator No problem, I´ve deleted it
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:
Quote:
Save this as:CFScript
Refering to the picture above, drag CFScript into ComboFix.exe
log.
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
bosso20640 Followed your instructions, here's the latest log! Back to Top
bosso20640 Interestingly (NOT!!!) I've just noticed something else. Back to Top
Touch Forum Moderator Ok. We´ll deal with the other accounts when this are clean
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:
Quote:
Killall::
Snapshot::
Folder:: C:\Documents and Settings\All Users\Application Data\ehqjkpil
C:\Documents and Settings\All Users\Application Data\mtenuhkf
Save this as:CFScript
Refering to the picture above, drag CFScript into ComboFix.exe
log.
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
bosso20640 Here's the log Touch, Cheers Back to Top
bosso20640 Things on this account seem to be pretty much fine, I still get the odd warning from AVG but I move it to the vault and it doesn't seem to cause any issue. If I get an AVG warning I'll post it. I'll just try one of the other accounts....hang on! Back to Top
bosso20640 ok, just switched to account ALY and it's as described previoulsy, TASKMANAGER disabled, program listings missing from START menu, VIRUS ALERT bottom right of screen near clock display and when I go to log out I don't have the option to SWITCH user. Niot tried the other two accounts that were playing up. Back to Top
Touch Forum Moderator Will do - hang on
What - "odd warning from AVG" ?
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
bosso20640 Please see above, our posts must have crossed! Back to Top
Touch Forum Moderator Looks like it.
If you can follow this on ALY´s account, please do - >>
The program download the necessary cleaning programs. Once the program
Please follow the instructions and copy the logs here, in this Topic:
Note : Fix_download.exe is detected by some antivirus programs as a "RiskTool" /infection; it is not a virus. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
If necessary, temporarily disable your anti-virus, real-time protection before downloading
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
bosso20640 Touch,:Access is denied. Make sure the disk is not full or write protected and that the file is currently not in use(??????) Back to Top
bosso20640 On the ALY account I'm going to run an AVG scan and Malwarebytes Anti Malware scan see what that comes up with.It may give me a bit more control of the accounts(?) Back to Top
bosso20640 Malwarebytes came up with 18 infections on the ALY account, I deleted them and am now running it through another Malwarebytes scan. The last one cleared the VIRUS ALERT and brought back control to the START button.Perhaps I'll have to do this on all the dodgy accounts? Back to Top
Touch Forum Moderator You´ll have to do it on all accounts
I suggest you post a combolog from ALY`s account
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
30 posts in this thread. 1 2
Forum Information Currently it is Saturday, March 13, 2010 5:04 PM (GMT +1)View Active Threads Who's Online This forum has 31125 registered members. Please welcome our newest member, keith45 .Details markusg 5 Latest Threads
|