Avast reported I had the ‘Win32:JunkPoly [Cryp]’ worm. Never heared of it, but it seems to have slowed down my PC. Kaspersky online scanner has also detected something a few days ago, which I scanned with Avast and put in the vault.
Something I have noticed (had a few days ago) is that I cant use MSN Hotmail email service, I cant view my emails, delete them or anything. I cant watch TV on Iplayer (video doesn’t load), facebook doesn’t work well (mum said she cant view her friends) and im sure there’s more sites I wont be able to use. Iv reinstalled the latest Java, flash player (as well as shockwave player and acrobat reader), cleared internet history, done a disc cleanup and defrag.
Super anti-spyware also found something. Hijack This in the next post as the forum doesnt allow that many characters.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:12 PM, on 15/02/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal
Thank you for the help. Please can I ask (if you can use it) just to recheck my hijack this log above. Its a fresh once. The last one was made before I got the virus warning earlier today.
Heres the Malwarebytes report (all clear):
Malwarebytes' Anti-Malware 1.44
Database version: 3742
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
Thank you. I’ll make a quick post on the forum he mentions with an OTL log. As for cleaning, my PC is generally fast. I tend to keep it clean from clutter, delete files I don’t need regularly, use the cleanup took, defrag in safe mode and delete internet history/cache. If anything, it needs hardware upgrades which i’ll do when I have money
I use it as a rough outline although it doesn’t seem to work with chrome Its not completely accurate, but it helps). Might try your suggestion though, thank you.
However much I love Nickelback, this most certainly ISNT a system file. (By the way, I have NO music currently on my PC, its all on my mp4. I was moving 1 nickelback song from my pc to mp4 a few days ago then deleted it.)
I’ll post the results of the scan. Also, heres the OLT logs.
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot when it is done
[*]Then post a new OTL log ( don’t check the boxes beside LOP Check or Purity this time )
OK that is a file or folder within windows that is appearing to use unicode to hide - lets try big brother this time as it is more adept at removing that type of thing
To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.
[*]Close ALL OTHER PROGRAMS.
[*]Double-click on OTS.exe to start the program.
[*]Check the box that says Scan All Users
[*]Under Additional Scans check the following:
[*]Reg - Shell Spawning
[*]File - Lop Check
[*]File - Purity Scan
[*]Evnt - EvtViewer (last 10)
[*]Under the Custom Scan box paste this in netsvcs
%SYSTEMDRIVE%*.*
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%*. /mp /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options /s
CREATERESTOREPOINT
%systemroot%\system32*.dll /lockedfiles
%systemroot%\Tasks*.job /lockedfiles
[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Ok could you run this and left me know what problems you are still having
Start OTS. Copy/Paste the information in the quotebox below into the pane where it says “Paste fix here” and then click the Run Fix button.
[Unregister Dlls]
[Files/Folders - Created Within 30 Days]
NY -> _ -> C:\Users\James\AppData\Local\_
[Files/Folders - Modified Within 30 Days]
NY -> ´ô) -> C:\Windows\´ô)
[Files - No Company Name]
NY -> ´ô) -> C:\Windows\´ô)
[Empty Temp Folders]
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new OTS log.
I will review the information when it comes back in.
Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.
Not really having any major problems now. Not sure why my PC thought the nickelback image was a system file, that bit is confusing. Internet seems to be a little slow (slower then it was, but not too much, could be a connection problem, IDK). And im having trouble with some sites like BBC Iplayer (viewing vids), facebook (viewing certain things) and sometimes certain buttons dont work, for instance, on ebuyer.com, I have cant view comments about items or the specifications, but othertimes I can as the button doesnt do anything on the site). This is all new. Java & flash are both up-to-date and allowed via settings.
Anyway, Done the fix and the scan. Not sure if you wanted a normal scan or the custom scan you stated in the last post, so I performed both just incase.
The fix is ‘02172010_213849.log’, a new default scan (without clicking certion options) is ‘OTS.txt’ and the new scan like you stated in your last post is ‘OTS1.txt’
[*]Open the file and close any other windows.
[*]It will close all programs itself when run, make sure to let it run uninterrupted.
[*]Click the Start button to begin the process. The program should not take long to finish its job
[*]Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean
The Flash Flush has worked perfectly, all sites are working like normal again.
1 question, iv been running ‘Admucher’ to remove ads (got it any problems occurred) and it removes all ads from all sites in chrome and IE. Will this cut down (or hopefully stop) me getting any spyware from ads?
Also, I use ‘My defrag’ as it runs perfectly in safe mode. Should I keep this or use the one you mentioned? I tried it before and I don’t think it worked in safe mode Or is it pointless going into safe mode altogether for defragging?
Thank you for the help, you saved me from a lot of annoyances… and in good timing as I have a job interview in the morning.
James.
EDIT: Just been on a forum I use and I cant use the clickable smileys. I have to type in the code (and I dont know the code for most of them )
Unfortunately there are always going to be driveby downloads and infected websites, but as long as you use common sense and close ads by using the X and not the supplied close button the chances are greatly reduced
If you are happy with my defrag then keep it - always use what you like and not what any one else says
I had a problem with the smileys yesterday as well - may be a forum problem
