One of my employees downloaded the "Clean This" virus. What I thought was going to be difficult to get rid of turned out to be fairly easy.

Got into Safe Mode. Ran MBAM. Found 6 Trojans. Deleted them. Rebooted and back in business.

Just now rerunning MBAM in Normal Mode. Then I'm going to run MS Security Essentials.

My computer wont turn on. it goes to the hp invent page then the moniter says innput out of range and the computer doesnt seem to be doing anything but the fans are runing. help please?
Posted via Mobile Device

Usually that means the video card is set to a resolution that the monitor can't support.

Reboot it. Right after the hp invent page, keep tapping F8. This will bring up a DOS menu. Select Safe Mode.

If it boots, go to Device Manager. Uninstall your video card, and reboot the computer. Then reinstall good video card drivers.

f8 is doin no good. it only lets me get into setup (f10) from the invent page nothing else works. thanks tons btw
Posted via Mobile Device

Did you keep tapping the F8 key? You might have to start clicking it before the Invent screen goes away. Sometimes the timing is hard if you've never done it before.

Does this sound familiar Kurt?

http://h30499.www3.hp.com/t5/Home-PC...en/td-p/951067

You might try a few of the recommendations in that thread..

tried f8 on the screen but it just keeps going to input out of range and it seems like the pc isnt making normal sounds.

im still trying f8 on the invent screen andafter hopefully something happn
Posted via Mobile Device

Thank you so much for your help, fish, you kick ass. However none of the reccomendations I tried helped.

I spent all day trying things, and then I decided to hit eject on my cd player to see if it still opened while I had a blank screen, and the windows screen popped up and started loading on screen! ****ing awesome, and I'm pleased.

Argh! My browser hijack is back. WTF do I have to do to get rid of this ****ing thing?

Stop surfing midget bestiality sites?

You must think very little of me. I don't like midgets.

I do. They make everything look bigger.

Donger,

Do the HijackThis thing that I said to do in a reply to your other thread (it is also mentioned in the OP of this thread).

So, I just copy and paste the log?

Yes

Oh, and during one of my many AdAware, Spybot, etc. scans, this little bugger kept popping up:

HKEY_CLASSES_ROOT\.fsharproj

I don't like the bolded -- in hijackthis, put a check in the box next to that entry and then select to "fix checked".

edit: also, be sure your doing all your scanners and tools in safe mode.

Are you doing everything in Safe Mode?

If malwarebytes caught it the first time and you weren't in Safe Mode, I'd run it in Safe Mode, reboot into Safe Mode, and run the scan again. If it comes back after all of that, research the Rogue Removal Kit/ComboFix in the OP.

I've done all of them in both Safe Mode and Normal. Now, even though it doesn't show up in any of the programs, I still have the symptoms.

Well, I uninstalled Firefox and re-installed the latest version, and it appears that the hijack has disappeared. That was simple.

I'd still run a few scans, just to make sure. Not sure what AV you are running, but give Microsoft Security Essentials a try. It is free and surprisingly very good. You can remove when it finishes if you prefer.

On google chrome it's doing two things: One is that a black bar will appear in the address bar area. I've read that's a common bug. But also, when I right click to copy something or whatever, it freezes everything for about 20 seconds and doesn't let me copy.
Anyone heard of this?

I have a Mac Mini from 2005 that is not Intel based. Which I recently unpacked. I haven't used it in a year or so. I was wanting to just use it for media. Now it seems that Adobe upgrade has made it a requirement to have an Intel based Mac to watch anything, Netflix or Hulu. Am I just SOL or does anyone know of anything I can do? I love that Mac. I hate to have to get rid of it. Your help is much appreciated. Thanks.
BTW. I don't know shit about computers.

First off... this is the Malware/Antivirus thread. No place for Mac questions... :D

Second... I'm pretty sure you're talking about Adobe Flash player upgrade. If so, 10.1 was the last version to support PowerPC. You'll have to download and install that. It will allow you to access Netflix, Hulu, etc.

Find that here: http://fpdownload.macromedia.com/get....1_archive.zip

That contains all the versions though. I couldn't find a download for just the version you need. But find the flashplayer10_1r82_76_ub_mac.dmg file in there, and run that. That should do it.

This is driving me crazy. Have this program called guard online that's pretty much hijacked my computer. I've tried running malaware on safe mode but the program is actually blocking anti spyware programs. Any advice?

How to remove Guard Online

The simplest way to remove Guard Online is following:
1. Right-click on Guard Online icon on desktop.
2. Select Properties. There will be a field that shows file and folder name. The folder name will likely be C:\Windows\System32\. File name will be completely random.
3. Open the location in explorer (C:\Windows\System32\ )
4. Rename the file in that folder that is shown in Target field (step 2).
5. Reboot PC normally. The Guard Online should not launch.
6. open the location again and delete the file.
7. scan with Spyware Doctor and Malwarebytes Anti-Malware to get rid of remaining Guard Online files and processes. If browser does not open websites, try disabling proxy server in the browser
8. You might have to scan your PC with TDSS killer as well. This might need to be done after step 5.
If you have problems launching software while Guard Online is active try this code to disable it : 4261328365

Thanks, man. Appreciate it. The TDSS killer did the track. That bastard was shutting down every anti-malware program I was throwing at it.

I will try posting this here to see if I get any help. I have a laptop (toshiba satellite) I am working on and can't figure out what is causing it to reboot at random. If I boot into safe mode it can run forever without a reboot no problem, in normal mode it reboots randomly shortly after startup. I was going to either do a repair install or complete wipe and reinstall of windows, but it even rebooted when I was trying that. I can run safe mode, hirens boot cd to mini xp, memtest 86+ with no problems, just normal windows. I did a Hijack this in safe mode and am attaching my log. I hope someone here can help me figure it out (about to sign off for the night, but will check back tomorrow).

If it's rebooting during installation it may be a hardware problem.

I vote for a full backup/wipe/install.

My first thought as well, but if it really is a hardware problem, why does it run in safe mode all night, runs hiren's boot cd with no problems, runs tests with no faults. In process now of backing up entire hard drive, then will do a low level format outside of Windows and trying a reinstall again (she says there is nothing important on the drive anyway). I just don't know what could possibly cause this problem.

Check the event viewer logs and see if you can find when the computer is shutting down -- should give you some idea.
Let me know what you find.

I'd check the event logs first, like QuikSsurfer said, and while you're there, you could look in Computer Management to see if there are any '!' for malfunctioning hardware... in safe mode, you could go open msconfig and uncheck the stuff you don't need to start Windows, like the stuff below (I doubt Malwarebytes or avast would be your problem, and you'd obviously want to check them again when you're finished troubleshooting). Also, under services, there are a bunch of Toshiba services for bluetooth and stuff... you could disable those to make sure they aren't causing issues with missing hardware.


O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICIO LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICIO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Servicio de red')

Yeah, unfortunately, already wiped the hard drive. Tried install both Vista and 7 to no avail, just kept on rebooting. I am now installing XP, and that seems to be working. I believe there must have been a problem in the video drivers as the one thing all the working modes had in common was 800x600 displays. Still not clear what the problem was, but hopefully this load works.

Just to give an update, in case anyone else encounters this problem...here is where I am. I finally got Windows XP installed (more forgiving in the install process). It would continue to do the same thing with that install. So I continued to play with it. It turns out when it was not connected to the charger it would run just fine, but when connected it would only run in safe mode without reboot. So I searched more with make and model of laptop and this specific problem. I came across a strange solution, disable 1 of the 2 processors, and it worked. Problem now is getting it up to Windows 7, as it would reboot during install. Solution there was, install windows 7 to the hard drive on a different computer, put hard drive back on original computer, boot into safe mode (after installing numerous drivers) go into device manager disable a processor (intel core 2 duo t5550), reboot, and it is working fine (obviously installed Windows 7 32 bit). I will probably be searching for a better solution than disabling a processor this week, but it will get her by for a week.

You might check to see if there is a BIOS update, there might be a bug fix for that.

so i turn hit the power button on my hp desktop and the fans spin and the lights light up, but nothing else happens. nothing on screen. is it toast?
Posted via Mobile Device

Could be a video failure. Do you have another monitor around you could plug into the laptop?

Has anyone in Malwarebytes ever come across the updating error I'm trying to clean out a laptop that was given to me, I know it is infected and when you google it, it says to run a Quick scan and see if you get I did not see that in the quick scan - any ideas what I can do to clean this machine out?? Should I just go straight to ComboFix?

Here's the hijackthis log:

Here's the ComboFix Log:

update is that my LAN works but the laptop won't connect via wireless.

I'm working on it my job though. Is it possible its set up for his router? Should I delete it & re-install the wireless driver?

I'm all set! Everything works :)

Never use a computer that you didn't install the operating system on...especially one that spits out log files that look like this.

Unless you installed LimeWire yourself from a known source (and even then using that network is asking for a vile note from your ISP or one of the record labels) I'd certainly consider it riddled with stuff that's part of a bonnet at this point.

My son had the "Win 7 anitspyware 2012" virus: http://www.bleepingcomputer.com/viru...tispyware-2012


Followed the steps in the above link....rkill; malwarebytes; etc....Malwarebytes found it and I got it removed. Computer seems to be running fine now.

I've just rerun Malwarebytes a second time before doing another virus scan, here is a log of the files that it detects as malicious. Could someone in "the know" look at the files and make sure they are either A: malicious and need to be removed or B: normal and can be ignored on future scans.

I don't want to ignore something that I need to remove, and I definitely don't want to remove something that should be ignored.

Thanks!


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8318

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/5/2011 6:02:51 PM
mbam-log-2011-12-05 (18-02-41).txt

Scan type: Full scan (C:\|)
Objects scanned: 294023
Time elapsed: 29 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{9193fbaf-bdaf-4751-a99a-1f5ef255c35b} (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\facetheme-apl (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\program files (x86)\Object (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon (PUP.FCTPlugin) -> No action taken.

Files Infected:
c:\program files (x86)\Object\status.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\bho_project.dll (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon.pem (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\config.ini (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\enable.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\facetheme-apl_uninstall.exe (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\status2.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\._included.js (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\background.html (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\included.js (PUP.FCTPlugin) -> No action taken.

Back up your data and reinstall windows. This is really the only way that you can be sure that all of this stuff is gone. "Good" malware will avoid all of these tools.

This is another reason to keep your data separate and constantly backed up so reinstalling windows isn't that big of a deal.

Or, you know, stop using Windows.

Thanks guys! This is what I've been looking for. Such a helpful and informative thread.

Sorry if this has been asked, but does anyone know how to get rid of win.32.pup.bandoo from a XP computer?

Seriously. Malware is designed in many instances to steal login credentials and other sensitive information. It's foolish to rely on free tools which may or may not be completely effective to remove this crap. Once that's done, try to figure out what you did to get infected and stop doing that. Here are some other thoughts on how to avoid this situation entirely.

0. Back up your data so that reinstallation or hardware failure isn't so hard to recover from. If you don't have three copies (one working, one local backup, one offsite backup) then you're at risk of losing data.
1. If you can avoid using Windows, do so.
2. If you have to use Windows, use Windows 7.
3. Don't use IE. Chrome is a nice alternative.
4. Install Ad-Block extensions to any browsers that you use.
5. If you insist on installing Flash, use the Click-to-Flash extension. This way you're only loading flash content you actually want to see. The only way I run Flash is through Chrome which has it's own sandboxed version.
6. Install all of your system updates when they become available including Flash and Acrobat.
7. Stop using Windows. Mac hardware isn't as comparatively expensive as it used to be. What's your time worth? Is wrestling with constant malware infections and account compromises really worth saving a couple hundred bucks on a computer?

FYI..... this looks to be a great offline tool to clean your Windows machines..

Windows Defender Offline Beta

Microsoft this week released a beta version of what appears to be a very useful tool: An offline version of its Windows Defender anti-malware solution. This tool can help final and remove malicious software, much like the version built into Windows. But because it can be installed to CD, DVD, or USB flash drive, it can be run in offline mode, when the Windows OS isn't running. And that makes it more effective, since many exploits, like rootkits, are hard to remove when Windows is running.

You can find the Windows Defender Offline Beta on the Microsoft web site. You'll need a blank CD, DVD, or a USB flash drive you don't mind formatting. There are basically two downloads that need to occur; the tiny installer and then a later 214 MB Setup package that is expanded and copied onto the media. This package includes all the files needed to boot your PC plus the Windows Defender Offline tool itself.

http://www.winsupersite.com/content/...offline_03.jpg

To use the tool, you need to reboot your PC from the created optical disk or USB flash drive. (This could require interrupting the boot process and choosing a different boot device, of course.) The interface is straightforward and basically resembles a full-screen version of Windows Defender, giving you a chance to perform Quick, Full, and Custom scans of the underlying PC.

Intriguingly, this tool also appears to be based on the Windows 8 version of Windows Defender, in that it provides both spyware and anti-virus scanning.

This would be encouraging if Windows Defender actually did anything useful.
Save your flashdrives/dvds for a useful tool(s), like Hirens or UBCD.

Actually this isn't the same Defender that you're used to. If you'll read the last sentence in bold, this is the Win8 version of Defender, which is a beefed up version that scans for virus, spyware, and malware.

It's not perfect, or foolproof. But you're selling it way short by calling it not useful. And instructing non-tech folks to create a Hirens bootdisk can be pretty confusing. Although perhaps someone should undertake that sometime....

I've downloaded it and slapped it on a jumpdrive. I'll test this out on the next infected machine I get, which shouldn't be long based on how business is going.

Please help me remove win.32.pup.bandoo from an bootleg xp. My original os was so ****ed my tech friend put a bootleg version on it. Is there anyway to get it off without reinstalling (he did not give me the disk and has since moved)

vista internet security 2012

Hit with it. Will the steps in the OP help me with this? I've googled it, but I'm afraid to click on anything having to do with it.

Yes. Malwarebytes is your best bet to remove it. Preferably run it in Safe Mode.

every time

reboot into Safe Mode w/networking
run rkill ( http://download.bleepingcomputer.com/grinler/rkill.com )
run malwarebytes (updated)


I saw 3 rogues in 3 different counties today. A lot of these rogues are being bundled with rootkits as well... I caught a zero.access root today.

This would be a good time for me to throw TDSS killer out there as well for these nasties: http://support.kaspersky.com/downloa...tdsskiller.zip

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:42:22 PM, on 12/19/2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.19088)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Camera Assistant Software for Gateway\traybar.exe
C:\Program Files (x86)\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe
C:\Users\Owner\Downloads\rogueremoval\HiJack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx...m=md7818u&c=BB
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
R3 - URLSearchHook: YTNavAssist.YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\YTNavAssist.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Gateway\traybar.exe"
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files (x86)\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WRSVC] "C:\Program Files (x86)\Webroot\WRSA.exe" -ul
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: ZooskMessenger.lnk = C:\Program Files (x86)\ZooskMessenger\ZooskMessenger.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: WRSVC - Webroot - C:\Program Files (x86)\Webroot\WRSA.exe
O23 - Service: XAudioService - Unknown owner - C:\Windows\system32\DRIVERS\xaudio64.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 10189 bytes

Have fun analyzing that. Foreign language to me.

I had to shut down webroot to run the scans and such. Safe to bring it back up now?

There's not much. You can delete ('fix') these two...

...and if you want to clean up, any of that Yahoo toolbar/YT, realplayer, qttask crap can go.

Did malwarebytes or anything else find/delete any problems? If you've run the scans (particularly malwarebytes and an antivirus like Microsoft Security Essentials) in safe mode to the point where they don't find anything, you should be fine.

The CCleaner or ComboFix or whatever deleted several things. I'll delete what you mentioned as well. I kind of like the Yahoo toolbar. Got my apps set, so it's easy to just click and go.

I haven't read through all of this, but it's a good source for information on the rogue anti-virus...

http://www.bleepingcomputer.com/viru...tispyware-2012

Basically what QuikSsurfer... rkill + malwarebytes.

Well, if you actually use it... ;)

Yup. I mentioned this in the other thread. I got it too. Somehow, I blame luv here.



Not really, I don't even know her (or him).

I followed mikey's malware remover steps. Is this something else I need to look into running?

If you did everything in that doc, then no. The combofix, malwarebytes, and hitman pro are the 3 big ones... they'll all find different stuff.

If you'd like to prevent this from happening again, I'd suggest purchasing Malwarebytes Pro. $25, but it works very very well.

I thought i had it removed, but it came back....twice.

I finally backed up and restored to factory settings. Clean as a whistle now. All that reinstalling sure was a PIA, but at least now i am sure it's gone.

That's the only way you can be sure. Anti-malware tools are too spotty and inconsistent. Obviously this thread speaks volumes to the kind of snake oil is being sold by AV and Anti Malware vendors as well. Circumventing these things is very trivial for anyone who knows what they are doing.

I'll add that you guys need to turn off system restore while troubleshooting these malware episodes. Enable and create a new restore point when system is clean and behaving normally.
I anticipate this thread getting more and more attention.

It also scares me the number of novice users running combofix at the first sign of a infection. It should really be used at a last resort - before a wipe and reload.

I've gone back and forth with that in my head... I've never had a problem with it, but I've thought about editing the OP to include "for starters, reboot into safe mode, scan with malwarebytes & antivirus, etc" ... "and for a kill-it-with-fire approach, here's combofix...". I actually started editing it last night, but thought it came off like it was so time consuming, you might as well just restore.

This is a really good point. If you have an infection, and it happens to go unnoticed by your virus scanner or if your scanner doesn't detect that sort of thing, the virus will get backed up into a System Restore point. And system restore info can't be scanned by normal antivirus/malware scanners. So if you get an infection, and it's able to go unnoticed and ends up in a sys restore point, it can infect your system later.

After you purge your system of a bug, always delete all of your restore points just to be safe.

1. Open System by clicking the Start button http://res2.windows.microsoft.com/re...a2fd33_818.jpg, right-clicking Computer, and then clicking Properties.
2. In the left pane, click System protection. http://res2.windows.microsoft.com/re...75bf05b_48.jpg If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
3. Under Protection Settings, click Configure.
4. Under Disk Space Usage, click Delete.
5. Click Continue, and then click OK.

http://res2.windows.microsoft.com/Re...xpcol_imgs.png

To add to fish's instructions:
For XP users :
Disabling system restore will automatically wipe all restore points.
Right click on My Computer and select System Restore tab and you will have a checkbox to turn off system monitor - do this.
After repairing the system go back to same tab and turn it back on.

AAAAAAGGGGGGGGGHHHHHHHHHH!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

yup. me too.:banghead:

Got the flashblock add-on on Firefox. Been roaming around CP for about 20 minutes, and my webroot just blocked a rogue. I'm still here, though, and not Vista Internet Security 2012 pop-ups....yet.

I posted this on Facebook, but I'll put it on here. It's a knb.exe rogue file that attaches itself to any executable you try to run. The information on bleepingcomputer.com was a huge help.

This time, it caught it whenever I clicked to go into the Media Center forum. I've been browsing different threads, including one that I know I was in before when it happened. I've also been posting on a few people's profile pages.

I've got about 10 minutes before I need to head back to work, so I'll keep snooping around here and see what happens.

Yea I got that Vista Internet Security crap the other day as well. I did a restore and everything appears fine. I have since added MSE to my computer so hopefully that will do the trick.

Annoying. I have to disable flashblock for some sites, but, if I forget to enable it, then something always, without fail, triggers my anti-virus on this site.