system
February 27, 2009, 3:54pm
1
i have some issues with my pc its been running slow and i am not able to connect to the internet but all the settings are good so there should be no reason why im blocked from accessing
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076 http://www.yahoo.com/ http://www.crawler.com/search/ie.aspx?tb_id=60076 http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076 http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html http://www.yahoo.com http://www.crawler.com/search/ie.aspx?tb_id=60076 http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076 http://www.hp.com/ @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://go.microsoft.com/fwlink/?linkid=67633 http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1200073076531 Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
–
system
February 27, 2009, 4:21pm
2
The entry O20 - AppInit_DLLs: frqntr.dll, looks very dodgy, Google shows only 1 hit. I personally would fix that entry.However I believe fixing it using HJT only removes the registry key,and you will have to then boot in safe mode,locate frqntr.dll, and remove the file manually.
system
February 27, 2009, 4:31pm
3
Ok ill wait to see if anyone else can help me the other symptom is that my superanitspyware program will not load at all
system
February 27, 2009, 4:39pm
4
What happens when you click on a link,is that redirected ?http://www.filehippo.com/download_malwarebytes_anti_malware/
system
February 27, 2009, 4:44pm
5
no nothing happened the pc just froze and not doing anything at all
system
February 27, 2009, 4:45pm
6
How are you accessing the forum, do you have access to another pc
system
February 27, 2009, 4:47pm
7
through a server connection and another pc
system
February 27, 2009, 4:52pm
8
If you have another pc, you could download MBAM and the updates onto cd and transfer them to the infected machine.Then install MBAM in safe mode ,the update file needs to be double clicked to update the database.http://www.filehippo.com/download_malwarebytes_anti_malware/
Updates http://www.gt500.org/malwarebytes/database.jsp
You may have to rename MBAMsetup.exe to something else in order to install
system
February 27, 2009, 5:42pm
9
ok i did as u requestd and the software was renamed and would not load either
system
February 27, 2009, 5:44pm
10
Did the program install ? But not run ? Or would it not even install
system
February 27, 2009, 5:50pm
11
SUPERAntiSpyware Application has encountered a problem and needs to close. We are sorry for the inconvenience.
system
February 27, 2009, 5:54pm
12
Right go to C/ program files / malwarebytes antimalware / find mbam.exe and rename. Try and run by double clicking on whatever you renamed it to. If this fails , rename mbam.exe and reboot in safe mode by tapping the f 8 key on boot up before windows loads, from the advanced options choose safe mode, try and run the RENAMED FILE in safe mode
system
February 27, 2009, 5:59pm
13
ok i followed ur directions as stated in the last post and the program is scanning and running
system
February 27, 2009, 6:09pm
14
Thats good,one other thing, try looking for TDSSserv.sys
Is there anything by that name ?
system
February 27, 2009, 6:16pm
15
no there is nothing by the name TDSSserv.sys
there was something that is not working properly the file is SASKUTIL
system
February 27, 2009, 6:17pm
16
No forget about that, it was just a hunch
system
February 27, 2009, 6:27pm
17
here are the results of the scan from malwarebytes
2/27/2009 12:26:38 PM
Scan type: Full Scan (C:|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:) Good: (“%1” % ) → Quarantined and deleted successfully.
Folders Infected:
Files Infected:
system
February 27, 2009, 6:34pm
18
and tryied the internet explorer and i seem to be able to go to websites now with out being redirected im happy. now should i do anything else?
the thing is that my pc is still running a bit slower than before should i do a hijack this log again?
system
February 27, 2009, 6:35pm
19
Post another HJT log please. Also did you REBOOT ?
system
February 27, 2009, 6:42pm
20
here is the hjack log and yes i rebooted
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076 http://www.yahoo.com/ http://www.crawler.com/search/ie.aspx?tb_id=60076 http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076 http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html http://www.yahoo.com http://www.crawler.com/search/ie.aspx?tb_id=60076 http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076 http://www.hp.com/ @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://go.microsoft.com/fwlink/?linkid=67633 http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1200073076531 Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
–
