Loads of malware!!!

Viruses and worms
21

Check your Nvidia drivers here and then download the latest version
http://www.nvidia.co.uk/Download/Scan.aspx?lang=en-uk

Those are dotnet updates and are a notorious pain in the posterior

We will need to uninstall and then re-install .Net framework

Download Dontetfx cleanup tool. zip to your desktop
Unzip the tool
Run the exe file
Click throught the EULA popups
Select All Version

https://dl.dropbox.com/u/73555776/dotnetfx.JPG

Once done reboot the computer
Download then run the Net 4.0 installer from here
Then install
Reboot and try Updates and Office again please

22

I went to the nvidia site but nothing happened.

I’ve downloaded everything that seemed suitable from that page you gave me a link to - which was pretty much everything - except that I use sumatra rather than foxit and CCleaner rather than TFC. The only other thing I didn’t do was, I run malwarebytes but it also suggests spywareguard and spywareblaster - are these necessary?

Finally, I use windows firewall, can I stick with that or should I download zonealarm for example?

By the way, what does opendns do?

23

By the way, I downloaded that keystroke scrambler thing and I can’t get into a forum I use now - not sure if the two are related.

I’m also having trouble with facebook - I can’t click any of the tabs - I downloaded the no script program as well - don’t know if that interferes?

Oddly, the problem is with firefox, everything works ok in chrome.

24

Windows update working now.

I’m putting all my questions in ordered format so its easier for you :).

  1. By the way, I downloaded that keystroke scrambler thing and I can’t get into a forum I use now - not sure if the two are related.

I’m also having trouble with facebook - I can’t click any of the tabs - I downloaded the no script program as well - don’t know if that interferes?

Oddly, the problem is with firefox, everything works ok in chrome.

  1. I went to the nvidia site but nothing happened.

  2. I’ve downloaded everything that seemed suitable from that page you gave me a link to - which was pretty much everything - except that I use sumatra rather than foxit and CCleaner rather than TFC. The only other thing I didn’t do was, I run malwarebytes but it also suggests spywareguard and spywareblaster - are these necessary?

  3. Finally, I use windows firewall, can I stick with that or should I download zonealarm for example?

  4. By the way, what does opendns do?

25
but it also suggests spywareguard and spywareblaster - are these necessary
No as MBAM and Avast have these covered

As you are on XP I would recommend a third party firewall there are some suggestions about firewalls on the forum I think private firewall is the most recommended http://www.privacyware.com/personal_firewall.html

I am not sure about noscript as I do not use Firefox

For the driver try Slimdrivers http://www.driverupdate.net/downloads/SlimDrivers-setup.exe install and then run

26

www.google.com also looks a little funny in firefox now. A huge G and O and the rest of the letters are missing.

Is there anyway to fix firefox - I hate chrome etc.

27

You could try a Firefox reset http://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems

28

I worked out what the problem is - with no scripts I have to initially “accept” certain sites.

Nearly finished with slimdrivers now - there were a lot of drivers to update.

My only problem now would be that I know have problems with BitMeter2 and Webcake (I know what the first is and its very useful, the second I don’t know). I tried to fix it myself and found a program called Advanced Fix but it found 1000s of errors so I thought it better to leave it alone and ask you what to do. It seems to be runtime errors.

Also, can I reuse that thing you told me about which got rid of the Windows Update folders - they’re back again after the new updates?

29

There are about four of these errors - one is webcake, another is bitmeter2 (I love bitmeter2 and would hate to lose it) - they seem to be related to .net

30

Advanced Fix, Advanced Care, etc,., generally cause more problems than they purport to solve. Suggest using WOT (see my sig below) to preview trustworthiness and vendor reputation before visiting any site. Link in sig is clickable.

31

I think you’re 100% spot on. I’m massively reinfected again.

I left avast and malwarebytes running last night when I went to bed and avast found:
C:\WINDOWS\assembly\NativeImages\v2.050727_32\System.ServiceModel\256c29338ead8ec627fa32ff4fa881ef\System.ServiceModel.ni.dll - says its a high severity - and says its a Threat: Rootkit: hidden file

I chose to move it to the chest and avast won’t allow me - it only allows me to delete which I have it set up to do - it tells me action postponed until the next reboot.

I’m letting malwarebytes run to conclusion before doing anything though because it says there are 31 infections - and its still not finished.

I will attach logs once done - either I am doing something very seriously wrong or there is something very seriously wrong with my computer.

32

First line of defence is YOU, not avast!, Malwarebytes, or any other malicious file protection/remover or program.

A review of posts here reveals a lot of adware cr*p, but not any real serious infections. Now, I’m assuming Malwarebytes is finding stuff related to Advanced Fix, so that is to be expected, if so. It’s there because you likely put it there. Stop doing that. Free programs are not really free, as you have seen.

If you can, avoid rebooting your system until essexboy comes back in, and do not make any more changes to your system without checking with him first. This would include downloading and running a program similar to Advanced Fix. Makes the job of cleaning your system much easier and you will get there much faster.

Please post the mbam log after it is finished, and a screenshot of the avast! threat detection will help. ;D

Wait for essexboy to come back.

33

Yeah, I accept the abject stupidity of having had problems with having downloaded free software, getting help to resolve the issue, and then going out and doing exactly the same thing again - for some reason when I saw the Advanced Fix icon I thought I recognised the icon as legitimate (it looked like something else) hence the mistake.

Sorry.

Unfortunately, I had already rebooted by the time I read your message but I will upload the relevant logs. I also promise to be very careful about adding free software in future (is there anyway of telling what is a legitimate free program though and what is not - for example I have never had problems with VLC).

34

Malwarebytes log.

35

Adware Cleaner log.

Btw, is there any way to reduce the sensitivity of Private Firewall? I couldn’t get on the internet for a minute because it asked me about a program - I said “block” and the internet was gone.

36

When I was running the OTL scan I hit run fix instead of run scan by accident.

I got this log.

I hope I haven’t messed up.

37

OTL scan

38

Last log - asw - says pwipf6 is locked.

I’m really sorry about all this after getting loads of help to fix my system. I’ve learned my lesson with free programs now.

39

Not a problem, we live and learn. If you are after a free programme then ask here someone may be able to help :slight_smile:

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe -- (vToolbarUpdater15.4.0)
SRV - [2013/02/05 16:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
DRV - [2013/08/02 21:45:29 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
[2013/08/03 09:30:07 | 000,000,000 | ---D | C] -- C:\Avenger
[2013/08/02 21:46:32 | 000,037,664 | ---- | C] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/08/02 21:46:09 | 000,003,717 | ---- | C] () -- C:\Program Files\Mozilla Firefoxavg-secure-search.xml
[2013/08/03 10:38:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Bitmeter2
[2013/01/05 20:52:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\Bitmeter2
[2013/01/05 20:53:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\AskToolbar
[2013/01/05 20:53:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\BitMeter2
[2013/01/05 20:53:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Emma\Application Data\BitMeter2

:Files
C:\Program Files\Common Files\AVG Secure Search
C:\Program Files\McAfee Security Scan

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

40

Fix log is here, thanks!