1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Virus help

Discussion in 'Virus & Other Malware Removal' started by Honey2aB, Apr 12, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. Honey2aB

    Honey2aB Thread Starter

    Joined:
    Apr 1, 2002
    Messages:
    398
    Hi. Before I go any further please, pretend that you are talking to a 4 year old. I'm really slow when it comes to fixing things on this dang computer.

    I've got a Dell, with windows ME and IE 6.0. I've just discovered, last nite, that I have a Trojan horse virus on my computer, and, according to a free download of SpyHunter (just to find out) I have 87 different parasites roaming around on my system. Two in memory, 11 in registry and 74 in my cookies. Sounds like fun. NOT. Probably why my computer shuts off my itself, resizes my desktop, erases things, S L O W, and a ton of other things.

    My current antivirus is AVG and apparently it won't look after this virus. It tells me that I should move this virus to the virus vault and when I press the key to do that it says...that file cannot be removed. File is..C:\ _ RESTORE\TEMP\A0247544.CPY

    I'm assuming that because all of this stuff is floating around on my computer that, that is the reason my AVG only works sporadically. It's supposed to update automatically, but only does it once in a while. It's also supposed to scan every morning at a certain time..sometimes it does, sometimes it doesn't do that for a few days. Because it's supposed to do it automatically I don't always remember to check on it.

    Can someone with patience help me out? Thanx a bunch :)
     
    Honey2aB, Apr 12, 2004
    #1
  2. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,276
    Please download and run the following programs.

    AD-AWARE

    Go here: http://www.lavasoftusa.com/support/download/
    and download Ad-Aware 6 Build 181

    Install the program and launch it.

    First in the main window look in the bottom right-hand corner and click on Check for updates now and download the latest reference files.

    Make sure the following settings are made and on -------ON=GREEN

    From main window: Click Start then Activate in-depth scan (recommended)

    Click Use custom scanning options then click Customize and have these options selected: Under Drives and Folders put a check by Scan within archives and below that under Memory and Registry put a check by all the options there.

    Now click on the Tweak button in that same window. Under Scanning engine select Unload recognized processes during scanning and under Cleaning Engine select Let windows remove files in use at next reboot

    Click proceed to save your settings.

    Now to scan just click the Next button.

    When the scan is finished mark everything for removal and get rid of it. (Right click the window and choose select all from the drop down menu and click Next)

    Restart your computer

    Download and run: SPYBOT SEARCH & DESTROY, here:

    http://download.com.com/3000-2144-1...tml?tag=lst-0-1

    Open Spybot Search & Destroy (Click Start, Programs, Spybot S&D (Advanced Mode). Click online, Search for updates, Download all available updates. Close all Browser windows, Click ''Check for Problems'', Put a check in every entry Spybot Search & Destroy flags with a red exclamation mark and click ''Fix Selected Problems'' , Then restart your computer.

    Download both of these for added protection: SPYWAREBLASTER & SPYWAREGUARD, here:

    http://www.javacoolsoftware.com/spywareblaster.html

    Once you've done all that, download HIJACK THIS, scan and post the saved log here for an expert to take a look at as I’m not qualified to analyze the log.

    Please do this. Click here: http://www.sherrylynn.us/HijackThis.exe to download Hijack This. Save it to it’s own folder (not temporary files or the desktop).

    Close all open windows and open HIJACK THIS. Click “Scan”. When the scan is finished (it only takes a second), the scan button will change to “Save Log”. Click on “Save Log” and save it to NotePad. Copy the entire log and paste it here.

    DO NOT FIX ANYTHING YET, most items that appear in the log are harmless or even needed. Wait for someone to analyze the scan and advise.

    Cookie
     
    Cookiegal, Apr 13, 2004
    #2
  3. Honey2aB

    Honey2aB Thread Starter

    Joined:
    Apr 1, 2002
    Messages:
    398
    Thanx for the help so far cookiegal. Here is what I have for you guys.

    Logfile of HijackThis v1.97.7
    Scan saved at 4:39:24 PM, on 14/04/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\WUAUCLT.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\WINDOWS\DESKTOP\DOWNLOADS\HIJACKTHIS.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\PROGRAM FILES\ACCESSORIES\WORDPAD.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ca/0SEENCA/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWAY\SEARCHAT\2.BIN\MWSSRCAS.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1501.0\EN-CA\MSNTB.DLL
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
    O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
    O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O9 - Extra button: Encarta Encyclopedia (HKLM)
    O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
    O9 - Extra button: Define (HKLM)
    O9 - Extra 'Tools' menuitem: Define (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
    O9 - Extra button: AOL Instant Messenger (TM) (HKLM)
    O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
    O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.yahoo.com/games/clients/y/fr2_x.cab
    O16 - DPF: Yahoo! Dots - http://download.yahoo.com/games/clients/y/dtr2_x.cab
    O16 - DPF: Yahoo! Checkers - http://download.yahoo.com/games/clients/y/kr2_x.cab
    O16 - DPF: Yahoo! Dominoes - http://download.yahoo.com/games/clients/y/dor4_x.cab
    O16 - DPF: {6D5FCFCB-FA6C-4CFB-9918-5F0A9F7365F2} (GigexCtrl ActiveX) - http://www.gigex.com/tv/igor/gigexagent.dll
    O16 - DPF: Yahoo! Chess - http://download.yahoo.com/games/clients/y/cr1_x.cab
    O16 - DPF: Yahoo! Go Fish - http://download.yahoo.com/games/clients/y/zr2_x.cab
    O16 - DPF: Yahoo! Chinese Checkers - http://download.yahoo.com/games/clients/y/ccr2_x.cab
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: ChatSpace Java Client 2.1.0.84N - http://about.chatspace.com/Java/cs4msn084.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O16 - DPF: LiveWorld EZTalk 3.0 - http://bizchat.liveworld.com/java/ezmed/ezmed.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/28c4fce3b9d566edeb22/netzip/RdxIE601.cab
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
     
    Honey2aB, Apr 14, 2004
    #3
  4. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
    Turn off System restore......
    1. Right click the My Computer icon on the Desktop and click on Properties.
    2. Click on the Performance tab.
    3. Click on the File System button.
    4. Click on the Troubleshooting tab.
    5. Put a check mark next to 'Disable System Restore'.

    Run hijackthis again and put a checkmark against these entries....double check
    in case you miss anything....
    .....then,close all browser and outlook windowsincluding this one and "fix checked"

    O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWAY\SEARCHAT\2.BIN\MWSSRCAS.DLL

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    [This is the realplayer updater,which is not needed and is intrusive]

    Re-boot and delete:
    C:\PROGRAM FILES\MYWAY [FOLDER]

    Your log is clean apart from the above............do yourself a favour.......remove SpyHunter...its next to useless.

    Now re-enable system restore......and when you know everything is running ok set a new restore point.

    ;)
     
    $teve, Apr 16, 2004
    #4
  5. Honey2aB

    Honey2aB Thread Starter

    Joined:
    Apr 1, 2002
    Messages:
    398
    Thanx a bunch $teve, but I just have a couple of questions first. The things that I am checking off on HJT means that I am deleting them from my computer right?? If that is the case, can I delete another one, as I have no idea what it is. It's this one..016-DPF:LiveworldEZTalk3.0-http://bizchat........

    How do I even find that C:/PROGRAM FILES/MYWAY?? Told ya, I'm slow :)

    Oh, and about that msn pop up blocker toolbar that the kids downloaded and is currently sitting underneath my address bar....can I leave that or lose it? I don't know if it's bringing anything I don't need to the computer but it sure is doing a good job of blocking those dang pop-ups. But, if it's not a good idea, please tell me and I'll lose it, no problem.

    Thanx again.
     
    Honey2aB, Apr 16, 2004
    #5
  6. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
    When you check and fix the entries with HijackThis all it does is stop the item from running,it wont delete anything except a few.dll`s from the o1/o2`s.
    Any of the o16`s can be fixed,even if its needed you will be asked to re-download it the next time you visit the page.....The MSN toolbar is ok to leave.

    Double click "My Computer"......Navigate to C:/PROGRAM FILES/MYWAY and delete the folder.

    ;)
     
    $teve, Apr 17, 2004
    #6
  7. Honey2aB

    Honey2aB Thread Starter

    Joined:
    Apr 1, 2002
    Messages:
    398
    Thanx for being so patient $teve. You've been :cool: Just one more question. Oh, no. Not another question. Please make her stop. :p

    It's about setting a new restore point...like you said earlier. It won't. When I get to the restore point page, this is what happens. Create a restore point..click...restore point description..did that (I'm assuming, for example, if you wanted to call your restore point Fred, that's ok) pressed NEXT...then it tells me "system restore is not able to create a restore point. Please restart the computer, and then run system restore again" Did that, and the same messages repeated themselves. Going in a circle, basically.
     
    Honey2aB, Apr 17, 2004
    #7

  8. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - Virus help
  1. Simplicity777

    New Virus help

    Simplicity777, Apr 3, 2019, in forum: Virus & Other Malware Removal
    Replies:
    0
    Views:
    728
    Simplicity777
    Apr 3, 2019
  2. zennymars

    In Progress Virus hacked completely froze my laptop, please help

    zennymars, Feb 12, 2019, in forum: Virus & Other Malware Removal
    Replies:
    1
    Views:
    1,018
    iMacg3
    Feb 14, 2019
  3. AtheriusStormgale

    In Progress Possible Virus/Malware problem, please Help

    AtheriusStormgale, Jan 27, 2019, in forum: Virus & Other Malware Removal
    Replies:
    1
    Views:
    1,018
    iMacg3
    Jan 28, 2019
  4. WazeJinx

    Solved Please help the virus spreads through Wi-Fi

    WazeJinx, Dec 15, 2018, in forum: Virus & Other Malware Removal
    Replies:
    3
    Views:
    731
    iMacg3
    Jan 18, 2019
  5. kangmirae

    In Progress Script Error may be a virus?

    kangmirae, Nov 5, 2019, in forum: Virus & Other Malware Removal
    Replies:
    5
    Views:
    347
    iMacg3
    Nov 6, 2019
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/219714

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice