Jump to content

pskelley

Trusted Malware Techs
  • Content Count

    1,759
  • Joined

  • Last visited

Everything posted by pskelley

  1. Hello Mike and welcome to the forum, You have a Smitfraud infection, before I address it I would like to give you this information. C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove Programs. http://www.clickz.com/news/article.php/3561546 http://www.greatis.com/appdata/u/v/viewmgr.exe.htm http://www.spywareinfo.com/newsletter/arch...4.php#viewpoint Tutorial and link to download http://siri.geekstogo.com/SmitfraudFix.php I would
  2. Hi Sarah, If you have not run the diagnostic test here, I suggest you do so if you can, they may pickup on something for you: http://pcpitstop.com/pcpitstop/default.asp Be careful what you touch inside the box, static can render the unit useless: http://www.overclock.net/faqs/110621-info-...lectricity.html Pick up canned air from a office supply (about $5) asnd blow out the insides, fans, etc. http://www.writersservices.com/www/c_cleaning.htm Unlikely it is RAM if you purchased from a reputable dealers, but here is some information: http://www.pcstats.com/articleview.cfm?articl
  3. Am I talking to Sarah or Pete? This is a fair explanation of a rootkit: http://en.wikipedia.org/wiki/Rootkit Nothing is showing in the Blacklight log though. I can not research more without more information. I suggest you review the google information I posted. Your HJT log looks fine, I fear you have other problems that are not related to malware. Good information here: http://support.microsoft.com/kb/293077 It is so important that we use the exact error message. You will benefit from using google: http://www.google.com/ to research them because that is what I will d
  4. Looks like you have issues not related to malware, see this: http://www.google.com/search?sourceid=navc...ss%5for%5fequal C:/Windows/system32/Isass.exe <<< are you sure that spelling is correction, I nesd the complete error message, not just a word or two if you want help troubleshooting them. LSA Shell error <<< same here, post the message "word for word" Win32k.sys <<< same here, complete error message: http://www.google.com/search?sourceid=navc...;q=Win32k%2esys Device Driver error <<< same here http://www.google.com/search?sourceid=nav
  5. Good morning and Happy New Year. Let's see how we did. So you will know this is the item we are removing: http://www.symantec.com/security_response/...-051714-2837-99 Please review the information under all tabs so you will understand this one usually comes from p2p file sharing, that is why I will suggest you uninstall this program: LimeWire 4.12.6 Uninstall list: J2SE Runtime Environment 5.0 Update 8 J2SE Runtime Environment 5.0 Update 9 See this information: http://forums.spybot.info/showpost.php?p=1...amp;postcount=2 You need an update, download the newest version and remove a
  6. Hello sarahb, welcome to the forum, it looks like you may have cut off the HJT log as I see no services running at the end and this is unusual. Please click the Format tab at the top of Notepad and make sure "Word Wrap" is NOT checked. Now click on Edit then Select all, copy and paste the highlited information from now on. You do have infections, we will start like this. It is very important that you read and follow the directions carefully. You may want to print them because you wil be working in safe mode during this cleanup. 1. Please download Ewido Anti-Malware Install ewido ant
  7. Welcome to the forum, your log looks to be free of malware, if you want to know how to turn off programs not needed, use this information: http://netsquirrel.com/msconfig/ If you wish to know what a file is, use google to find out: http://www.google.com/ That particular file containes a Microsoft Knowledge Base number in it. Here is the google: http://www.google.com/search?hl=en&q=m...G=Google+Search Since it appears to be part of a Windows Update, it is probably safe. If you want to check it you can have the file scanned at one of these free online scanners. http://virusscan.jo
  8. Looks clean, be nice to hear from you though, let's do this now. System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on: http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam AVG Anti-Spyware is a good program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run u
  9. Thanks for returning your information, one more nasty that did not go with the rest: http://www.google.com/search?sourceid=navc...=winexy32%2edll O20 - Winlogon Notify: winexy32 - C:\WINDOWS\SYSTEM32\winexy32.dll I also suggest you remove DAP from your computer, read this: http://www.greatis.com/appdata/u/d/dap.exe.htm I would like to run a good Spyware tool to make sure nothing is hiding also if it works for you. Let's do this. 1) Please download ATF Cleaner by Atribune http://www.atribune.org/content/view/25/2/ Save it to your Desktop. We will use this later. 2) We n
  10. Welcome to the forum, please follow these directions. 1) The junk will attract more, keep offline as much as possible until you are clean. 2) Follow the instructions in this link: http://siri.geekstogo.com/SmitfraudFix.php Thanks to S!Ri, and any others who helped with this fix. Please download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your Desktop. Search: Double-click smitfraudfix.cmd Select 1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:\rapport.txt Sav
  11. http://www.google.com/search?hl=en&q=m...G=Google+Search Try uninstalling the game that is causing this, these error messages will probably stop. Thanks Resolved the malware issues, this member will have to follow the links I provided and troubleshoot problems with the game at the website of where they downloaded it or one of the forums concerned with issues with the game.
  12. http://www.google.com/search?sourceid=navc...spearhead%2eexe http://www.google.com/search?sourceid=navc...tm%29+Spearhead http://www.gpdownloads.co.nz/dl.dyn/Files/3146.html <<< look to the left at this site, there are forums, you appear to have a corruption with one or more of the games files. Others seem to have the same problem. I just do not do this kind of troubleshooting. I would suggest you contact the maker of the game, or if you downloaded it online, download it again. Here is some information about the other file which is not a Windows file either: http://www.goog
  13. Yes, as stated in the instructions, I need to see a new AVG scan result and a new HJT log that is made after AVG removed what it located. Could I have the exact error messages you are receiving from your game and from Firefox. You may have to download both of them again? Firefox is releasing a new version as we speak: http://www.mozilla.com/en-US/firefox/ <<< please DO NOT download the new version until out work is complete. Thanks
  14. For some reason you chose to ignore what the AVG Spyware located??? This did nothing for you. Please run that scan again, choose to delete or at least quarantine what is located. Ignore something only if you know it is not bad. Post the new results and a HJT log run after the scan has been run. I will have suggestions at that time that may help speed up your computer. Thanks
  15. Good job running that tool If it is ok with you I would like to run one more good spyware tool to make sure nothing is hiding. If that works for you, then do this. 1) Follow the directions in this link to download, install, update and run AVG Anti-Spyware 7.5. http://www.virusvault.co.uk/fusionbb/showtopic.php?tid/33/ Thanks to John McKenna for the excellant tutorial. 2) Please download ATF Cleaner by Atribune http://www.atribune.org/content/view/25/2/ Save it to your Desktop. We will use this later. 3) Open HijackThis and choose "Do a system scan only" then check the box
  16. OK, thanks for returning that information. That is a strange looking Vundo infection, let's see what happens when we run the fix. Atribune's fix will locate the bad stuff and it may take several tries to remove it all. You want to watch the Vundofix report until you see all files located have been deleted. Read your instructions so you understand them, then follow them carefully. Thanks to Atribune and any others who helped with this fix. Please download VundoFix.exe to your desktop Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, clic
  17. Welcome to the forum, it looks to me like you have a hidden Vundo trojan infection because of no BHO's or 020 items showing in your HJT log. Vundo usually directs you to rouge spyware programs like Winfixer. If you wish to find out, rename HijackThis.exe, call it dumb_nelby2.exe or whatever you wish. Restart the computer and post a new HJT log and let's see what shows up. Thanks
  18. G'Day Simon and thanks for returning your information and your comments. I do a small business in the area but all online work is volunteer. I do it because I like to help people and I hate malware C:\Program Files\Java\jre1.5.0_07\ <<< out of date, this will get you infected. See this information. http://forums.spybot.info/showpost.php?p=1...amp;postcount=2 Your logs are all looking good. You can empty the quarantine folder in AVG Anti-Spyware if you decide to keep the scanner. If all is running well again, I would say you are good to go. AVG Anti-Spyware is a good
  19. Welcome to the forum, follow the instructions in this link: http://siri.geekstogo.com/SmitfraudFix.php You have the infection so continue through the instructions, this information applies to the Optional item: Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection. after you complete those instructions, then follow the instructions in this link: http://www.virusvault.co.uk/fusionbb/showtopic.php?ti
  20. No Joe, I am not familiar with the program, my suggestion would be to discuss it with RR. http://content.rr.com/rdrun/care_support.htm The AVG Spyware scan is optional. You had a good bit of junk in the last, but I believe it was run before Smitfraud "Clean". It's up to you if you want that final check, and if you do run it I suggest you do it in Safe Mode. I will give you closing information in case you decide the computer is running well and you do not wish to do more. AVG Anti-Spyware is a good program but it does use some resources. Once the trial is over you can update and use
  21. Thanks, that's much better. Smitfraud will clean in normal mode but needs safe mode to kill running program effectively. What about this item: C:\Program Files\MEDIC\bin\sprtcmd.exe Can you validate it is safe? If not, use one or more of these free scanners to find out: http://virusscan.jotti.org/ http://www.kaspersky.com/scanforvirus http://www.virustotal.com/flash/index_en.html Post that information for me to view. Scan for and post an AVG Anti-Spyware - Scan Report, let me know about the item above and how the computer is running now. I do not need to see any cooklies in the
  22. Well thanks for stopping by for a check, here is what I suggest. 1) Move HJT from the Desktop for safety. I prefer C:\HJT\HijackThis.exe, if you need additional instructions use these: http://russelltexas.com/malware/createhjtfolder.htm 2) Keep your Java program updated, it is a security risk, see this information: http://forums.spybot.info/showpost.php?p=1...amp;postcount=2 C:\Program Files\Java\jre1.5.0_06\ <<< out of date 3) C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe For your information, Viewpoint is installed by aol probably without your knowledge,
  23. I apologize for the confusion. Jacee has asked me to continue helping you. I will use the information you have provided thus far, but for now I want you to click on this link: http://siri.urz.free.fr/Fix/SmitfraudFix_En.php It will help you with the visuals. Do this in the numbered order: Please understand that first "Clean" failed and it is probably because it was not run in safe mode as the instructions indicate: Clean: Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually But in normal mode: Scan done at 11:31:44.65, Sat 10/14/2006 Run f
  24. I apologize, you must have started another topic instead of replying to the one Jacee started with you. Return to the original topic and post there using add reply and do not start new Topics, she will not get notified when you post. Thanks
  25. Edited this information because I was not aware Jacee was helping this member. pskelley
×
×
  • Create New...