Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
20-Apr-2008, 02:10 PM
#16 | ||||||
| Sorry about the late reply, my internet connection is playing up at the moment, so waiting for the cable company to get it sorted  Can you go to Start | Find Files and Folders and search for this file, and tell me the location: uc.vbs If you can't find it, it may be hidden. If that's the case, in the Search part, click on Tools | Folder Options. View tab. Scroll down to the option Show Hidden Files and Folders, select that option, apply and ok. Search again, and it should find it. eddie
__________________ Just go with the flow, like a twig on the shoulders of a mighty stream |
| |
21-Apr-2008, 01:05 PM
#17 | ||||||
| I've tried searching for "uc.vbs", but cannot locate it. I am searching hidden files and folders, as well as system folders, and I've made the search case insensitive. I've also tried searching for all files and folders containing ".vbs", but it doesn't turn up anything even close to uc.vbs. What's going wrong? |
22-Apr-2008, 02:35 PM
#18 | ||||||
| That's okay, it may already have been deleted  The steps that I am about to suggest involve modifying the registry. Modfying the registry can be dangerous so we will make a backup of the registry first. Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing so follow the steps that are listed below EXACTLY. if you cannot preform some of these steps or if you have ANY questions please ask BEFORE proceeding. Backing Up Your Registry
Now, copy/paste the following lines into a new Notepad file. Then click File | Save As, and in the File Name, call it fix.reg. Ensure the Save as Type is showing as All Files. Save it to your Desktop. Code: REGEDIT4
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{14e191ca-84aa-11dc-9f9d-0014a51edf38}]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountoints2\{3a3d7a02-5774-11da-9ce5-0014a51edf38}] Now, locate the fix.reg file on your Desktop, doubleclick and when the option appears to Merge the file to the Registry, select Yes. Then, using Windows Explorer, locate and delete this file: E:\MSOCache\doWTP_RESTORE.exe Reboot and post a fresh DSS log. eddie
__________________ Just go with the flow, like a twig on the shoulders of a mighty stream |
01-May-2008, 08:21 PM
#20 | ||||||
| Update... I was getting a file off of my USB key today, and had a look for that E:\MSO_Cache\doWTP_RESTORE.exe file, and found it. When I try to delete it, or the MSO_Cache folder, it comes back next time I refresh the folder.  Also, remember that uc.vbs file we were looking for? Well, it's showed up again. When I insert the USB key, I can select "Open a folder to view files and folders" from the pop-up. But, if I try to get to the USB key by going to My Computer and double-clicking the E: drive, I get the following popup: Windows Script Host Can not find script file "E:\uc.vbs". I am quite confused. The computer is slow with or without the USB key. How are these files affecting performance when the system cannot access them? |
07-May-2008, 02:42 PM
#22 | ||||||
| Sorry for the late reply, been trying to get rid of this lousy cold. Been off work with it, but its finally gone, so playing catchup now
I'll go thru the lists as well, but could you re-run DSS again, after doing the above first, which should hopefully remove the infection eddie
__________________ Just go with the flow, like a twig on the shoulders of a mighty stream |
14-May-2008, 03:54 PM
#24 | ||||||
| Thanks Your Java is out of date: Upgrading Java:
Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Then, post a fresh HijackThis log along with the MBAM log eddie
__________________ Just go with the flow, like a twig on the shoulders of a mighty stream |
17-May-2008, 09:17 AM
#26 | ||||||
| Re-open HiJackThis and scan. Check the boxes of all the entries listed below. O4 - HKLM\..\Run: [ctfmgr] C:\WINDOWS\ctfmgr.exe O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTS...4/vet_install_ Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode. Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. Please delete this file using Windows Explorer(if present): C:\WINDOWS\ctfmgr.exe Reboot to Windows, and post a fresh HijackThis log
__________________ Just go with the flow, like a twig on the shoulders of a mighty stream |
20-May-2008, 04:05 PM
#28 | ||||||
| Yep, that looks a lot cleaner now How's the computer running now? I've seen that you only have 223MB of RAM on your system, which isn't much. You really need at least 512MB. This is a good site to check for the RAM that you need: http://www.crucial.com/ eddie
__________________ Just go with the flow, like a twig on the shoulders of a mighty stream |
21-May-2008, 04:12 PM
#30 | ||||||
| Great Yep, forgot to post the 'close out speech'  We have a couple of last steps to perform and then you're all set. First, let's reset your hidden/system files and folders. System files are hidden for a reason and we don't want to have them openly available and susceptible to accidental deletion.
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:
To keep your operating system up to date visitmonthly. And to keep your system clean run these free malware scanners weekly, and be aware of what emails you open and websites you visit. To learn more about how to protect yourself while on the internet read this about Security online: General Security Information, How to tighten Security Settings and Warnings Have a safe and happy computing day! eddie
__________________ |
