1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Virus?

Discussion in 'Virus & Other Malware Removal' started by attackedbyvirus?, Jan 23, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. attackedbyvirus?

    attackedbyvirus? Thread Starter

    Joined:
    Jan 23, 2007
    Messages:
    6
    I may have posted this wrong initially so here goes again!

    I have had my computers taken over by someone that I used to live with and have moved but keep finding myself attached to a remote server. This is after I put a new hard drive in desktop and reformatted laptop. Have tried to use drive erase pro (last night) and there is 28 mg that will not be erased in my laptop. Are there virises that cannot be erased? My virus scan came up with the following:

    C:\\WINDOWS\System32\Kernal32.dll Change
    " " " \user32.dll "
    " " " \shell32.dll "
    " " " \ntoskml.exe "

    Any advice? This has been going on for 8 weeks and the whole story is long, involved and weird. There have been password changes and I actually saw a total of 29 user/machine/admin accounts, a new guest acct. after I had turned it off. This is all on a computer that has no extra software but the op system, zone alarm, AVG and a printer installed. I have a business and need my computers back!! I have hired 5 techs ($1300.00) so far who say they are securing my system and it doesn't help. Any suggestions?

    Thanks
     
  2. Byteman

    Byteman Gone but Never Forgotten

    Joined:
    Jan 24, 2002
    Messages:
    17,742
    Hi, The first step is this:



    go to Click here to download HJTsetup.exe
    • Save HJTsetup.exe to your desktop.
    • Double click on the HJTsetup.exe icon on your desktop.
    • By default it will install to C:\Program Files\Hijack This.
    • Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
    • Put a check by Create a desktop icon then click Next again.
    • Continue to follow the rest of the prompts from there.
    • At the final dialogue box click Finish and it will launch Hijack This.
    • Click on the Do a system scan and save a log file button. It will scan and then save the log and then the log will open in Notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Paste the log in your next reply.
    • DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

    Also: Open Hijack This and click on the "Open the Misc Tools section" button. Click on the "Open Uninstall Manager" button. Click the "Save List" button. After you click the "Save List" button, you will be asked where to save the file. Pick a place to save it then the list should open in notepad. Copy and paste that list here.
     
  3. attackedbyvirus?

    attackedbyvirus? Thread Starter

    Joined:
    Jan 23, 2007
    Messages:
    6
    Logfile of HijackThis v1.99.1
    Scan saved at 10:31:19 PM, on 1/23/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
    C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
    O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    O4 - Global Startup: officejet 6100.lnk = ?
    O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
     
  4. Byteman

    Byteman Gone but Never Forgotten

    Joined:
    Jan 24, 2002
    Messages:
    17,742
    Hi, Congratulations! No obvious malware was seen in the log.

    That does not mean that things are not on the system that are giving you headaches....they easily can be.

    Is your spelling correct for these files? Or, did you make some typos....

    C:\\WINDOWS\System32\Kernal32.dll << this correct?
    kernel32.dll

    " " " \ntoskml.exe " <<or did you mean n t o s k r n l.exe

    Let me know about the spelling of those items.

    Only some really good intensive scans with progams will tell you whether there is anything findable.
     
  5. attackedbyvirus?

    attackedbyvirus? Thread Starter

    Joined:
    Jan 23, 2007
    Messages:
    6
    I forgot this stuff too - This computer really has bare min on it as I am figuring out what is going on

    Adobe Reader 8
    Adobe® Photoshop® Album Starter Edition 3.0
    AVG Anti-Spyware 7.5
    AVG Free Edition
    Broadcom 440x 10/100 Integrated Controller
    Dell ResourceCD
    Hijackthis 1.99.1
    HijackThis 1.99.1
    HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet
    HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet
    HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet Drivers
    hp psc 2200 series
    Intel(R) 537EP V9x DF PCI Modem
    Intel(R) Extreme Graphics Driver
    Microsoft .NET Framework 1.1
    Mozilla Firefox (2.0.0.1)
    MSXML 4.0 SP2 (KB927978)
    QuickBooks Pro 2006
    Readiris 7.5
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB917734)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923694)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB925454)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB929969)
    SoundMAX
    Spy Sweeper
    Update for Windows XP (KB894391)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB908531)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB911280)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Windows Installer 3.1 (KB893803)
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB891781
    ZoneAlarm
     
  6. attackedbyvirus?

    attackedbyvirus? Thread Starter

    Joined:
    Jan 23, 2007
    Messages:
    6
    I did not spell that - i don't even know what it means

    what really good programs?
     
  7. Byteman

    Byteman Gone but Never Forgotten

    Joined:
    Jan 24, 2002
    Messages:
    17,742
    Well, what I meant was is that exactly what a scanner found as filenames? if so, then those are bad.

    Don't rush and try to get rid of anything~ may cause damage.

    What would probably be installed is a rootkit, they can be a devil '
    to get rid of but we have some experts here (not me) who may be able to
    find and get rid of those things.

    I will have someone help you with finding out if you want, but won't be until tomorrow morning.
     
  8. attackedbyvirus?

    attackedbyvirus? Thread Starter

    Joined:
    Jan 23, 2007
    Messages:
    6
    Hi and thank you for replying--

    Yes, those are the names of the files that the computer scanned. And yes, I know they are a "devil", I have been dealing with this for quite a while. Any suggestions on how to get rid of it or additional information would be great.

    thank you
     
  9. Byteman

    Byteman Gone but Never Forgotten

    Joined:
    Jan 24, 2002
    Messages:
    17,742
    Hi, Can you post which program detected or how you were alerted
    about any of the files you listed?

    Was it SpSweeper or AVG Antispyware or something else that found them, or was it just yourself?

    If it was a scan that found them did you save one that shows them? We can't use just a filename, it has to be most or all of the full report by any given program......but, if you cannot find them or did not save the report such as an online scan report, what we will do next may turn up something.

    If you do a scan with either program make sure it is a full scan...these programs have settings that may have to be adjusted to work better.

    I will post the way we advise to run AVG Antispyware in case when you installed it you did not have directions.

    You should turn Spysweeper off temporarily as it can get in the way of fixing by other programs.

    These steps are:

    SpySweeper
    Open Spysweeper and click on Options > Program Options and uncheck "load at windows startup".
    On the left click "shields" and then uncheck everything there.
    Uncheck "home page shield".
    Uncheck "automatically restore default without notification".
    Exit the program. You can now scan with AVG Antispyware, but we need you to do it this way:

    For AVG Antispyware:

    • On the main screen select the icon "Update" then select the "Update now" link.
      • Next select the "Start Update" button. The update will start and a progress bar will show the updates being installed.
    • Once the update has completed, select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
    • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
    • Under "Reports"
      • Select "Automatically generate report after every scan"
      • Un-Select "Only if threats were found"
      • Disabling the Resident Shield: (This may have changed in a new build but check for it).

        By default the Resident Shield is active but as it may interfere with the process of cleaning your PC, it will need to be disabled.
        (When the PC has been cleaned you can activate the shield again, if you wish.)
        Click the Shield icon at the top and under "Resident shield is..." - click active.
        This should now change to inactive.
    Close AVG Anti-Spyware. Do Not run a scan just yet, we will run it in safe mode.

    1. _ _ _ _ _
    2. Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.

      IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning as it may interfere with the scanning process:
    3. Launch AVG Anti-Spyware by double clicking the icon on your desktop.
    4. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
    5. AVG will now begin the scanning process. Please be patient as this may take a little time.
      Once the scan is complete, do the following:
    6. If you have any infections you will be prompted. Then select "Apply all actions."
    7. Next select the "Reports" icon at the top.
    8. Select the "Save report as" button in the lower left- hand of the screen and save it to a text file on your system (make sure to remember where you saved that file. This is important).
    9. Close AVG Anti-Spyware and reboot your system back into Normal Mode.

    Post that scan result as a reply here. Then we will have you scan with SpySweeper.
    It is possible that someone may be able to catch on to what you are scanning with, so if I were you i would proceed soon.
     
  10. attackedbyvirus?

    attackedbyvirus? Thread Starter

    Joined:
    Jan 23, 2007
    Messages:
    6
    I did not have any program that found this stuff - In fact I do believe that my Zonealarm and AVG were configured to allow stuff in. I discovered that there was something wrong by seeing extra passwords on my computer, and poking around and seeing stuff that just did not look right. Last night I tried to print something and had a printer error and traced printer settings to a driver that did not come with my printer and settings that were allowing everything that I print to be uploaded to the web. I could bnot open my upload to web desktop file either, got the hourglass symbol continusly and had to reboot. The whole thing is bizarre and when I read up on rootkit it makes more sense that is what has been happening for 8 weeks!!!!! I also ran another rootkit detector last night but could not figure out any possible was to save it - the computer settings would not let me! There were about 20 alerts in there.

    Currently wiping all my drives -- and reinstalling. I hope this virus/sicko quits targeting me!

    thanks
     
  11. Byteman

    Byteman Gone but Never Forgotten

    Joined:
    Jan 24, 2002
    Messages:
    17,742
    Hi, Been my experience that SpySweeper can show some rootkits-

    and, I did not see anything from you about AVG Antispyware, so would you try scanning with SpySweeper, settings as I have below, and in Safe Mode directions below for all:

    If the Update part of SpySweeper has expired, if you were using the free trial edition and not the type you buy, I suggest uninstalling it and getting a new download...but if it does get updates, then use what you have!

    I know you already have this program, but check how the settings are carefully and set them as I have below:

    update to the latest definitions, click Yes.
    Once the definitions are installed, click Options on the left side.
    Click the Sweep Options tab.
    Under What to Sweep please put a check next to the following:
    • *Sweep Memory
    • *Sweep Registry
    • *Sweep Cookies
    • *Sweep All User Accounts
    • **Enable Direct Disk Sweeping
    • **Sweep Contents of Compressed Files
    • **Sweep for Rootkits-Make sure you DO check to do this one!
    • **>>Please UNCHECK Do not Sweep System Restore Folder.

    You should do the scan in Safe Mode

    .* Restart your computer into safe mode now.To get into the Windows 2000 / XP Safe mode, as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu"
    Use your arrow keys to move to "Safe Mode" and press your Enter



    Perform the following steps in safe mode:



    Click Sweep Now on the left side.
    Click the Start button.
    When it's done scanning, click the Next button.
    Make sure everything has a check next to it, then click the Next button.
    It will remove all of the items found.
    Click Session Log in the upper right corner, copy everything in that window.
    Click the Summary tab and click Finish.
    Paste the contents of the session log you copied into your next reply.
     
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/537736

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice