[RESOLVED] Trojan or Virus - Registry infected - Softupdate107_2129 - Page 2
Page 2 of 2 FirstFirst 12
Results 16 to 21 of 21

Thread: [RESOLVED] Trojan or Virus - Registry infected - Softupdate107_2129

  1. #16
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Call Qwest and let me know what they found out.

  2. #17
    Join Date
    May 1999
    Location
    Colorado
    Posts
    194
    Qwest chat was available online so I got the router worked out last night.

    Ran all the tasks from IPconfig commands to ESET. The OTL and Security Check are listed below. ESET did not give an option of "List of threats found", so I'm guessing it didn't find any.

    I did a Malwarebytes scan for fun and no errors found in the registry. (Yippy Skippy!)

    WinPatrol is acting normal again - no "Scotty" barking every 2 minutes! I think that happened after the IPConfig commands.

    System seems to be running fine - not slow, no problems with internet, no problems with opening files...

    Phew, I hope this means things are good and there aren't any [unseen] issues. That last bit I will leave up to you... I'm looking forward to a "clean bill of health"...!

    Inurdreams


    All processes killed
    ========== OTL ==========
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\Windows\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
    C:\ProgramData\SPL30E7.tmp deleted successfully.
    C:\ProgramData\SPL741.tmp deleted successfully.
    C:\ProgramData\SPL81FB.tmp deleted successfully.
    C:\ProgramData\SPL975.tmp deleted successfully.
    C:\ProgramData\SPLD123.tmp deleted successfully.
    C:\ProgramData\SPLDF08.tmp deleted successfully.
    C:\ProgramData\SPLFC59.tmp deleted successfully.
    C:\Users\Hodorowski\AppData\Roaming\3327FA moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Alexis & Quinn
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 151252514 bytes
    ->Java cache emptied: 89380 bytes
    ->FireFox cache emptied: 43252517 bytes
    ->Flash cache emptied: 101809 bytes

    User: All Users

    User: ALLUSE~1~BCH
    ->Temp folder emptied: 0 bytes

    User: Bonnie
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 8392272 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 7009356 bytes
    ->Flash cache emptied: 1280 bytes

    User: Bonnie2
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: georgess
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes

    User: Hodorowski
    ->Temp folder emptied: 902437 bytes
    ->Temporary Internet Files folder emptied: 3205709 bytes
    ->Java cache emptied: 127622335 bytes
    ->FireFox cache emptied: 36416378 bytes
    ->Google Chrome cache emptied: 105538470 bytes
    ->Flash cache emptied: 264153 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 2466596 bytes
    RecycleBin emptied: 1774 bytes

    Total Files Cleaned = 464.00 mb


    [EMPTYFLASH]

    User: Alexis & Quinn
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: ALLUSE~1~BCH

    User: Bonnie
    ->Flash cache emptied: 0 bytes

    User: Bonnie2

    User: Default

    User: Default User

    User: georgess

    User: Hodorowski
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.21.0 log created on 02222011_232638

    Files\Folders moved on Reboot...
    File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

    Registry entries deleted on Reboot...


    Results of screen317's Security Check version 0.99.7
    Windows Vista Service Pack 2 (UAC is enabled)
    Internet Explorer 7 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Disabled!
    avast! Free Antivirus
    ESET Online Scanner v3
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    WinPatrol 2009
    Malwarebytes' Anti-Malware
    HijackThis 2.0.2
    Java(TM) 6 Update 24
    Java(TM) SE Runtime Environment 6
    Out of date Java installed!
    Adobe Flash Player 10.1.102.64
    Adobe Reader 8.2.5
    Out of date Adobe Reader installed!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    WinPatrol winpatrol.exe
    Alwil Software Avast5 AvastSvc.exe
    BillP Studios WinPatrol WinPatrol.exe
    ``````````End of Log````````````

  3. #18
    Join Date
    May 1999
    Location
    Colorado
    Posts
    194
    Just when I thought it was safe to go back in the water...!

    I have MS Office 2007. Somehow I lost the ability to use my dictionary or thesaurus - it comes up as "no results found" when I click "look up" on a word. Eeeks! Being a fulltime student I can't have that not working. Double eeks!

    So I tried running the diagnostics in the program and it didn't find anything wrong. So I am trying to see what is offered on the disk in the way of repair. I'll get back to you on my progress.

    inurdreams

  4. #19
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    At least our main problem seems to be resolved

    Uninstall Java(TM) SE Runtime Environment 6 .

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.

    ===============================================================

    Your computer is clean

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:


    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.


    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.


    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.

  5. #20
    Join Date
    May 1999
    Location
    Colorado
    Posts
    194
    Sorry I didn't get back to you sooner but have been working with Microsoft to fix MSOffice. It's been 3 days, and it still isn't working right. Go figure...!

    I did the OTL for a good restore point and below is the log.

    Everything is working well (except for MSOffice). WinPatrol is no longer a problem. (I even received an email reply from Bill P. about fixing it, but it had already started running correctly by then.) Had to reinstall my printer which was a pain.

    Downloaded PSI and WOT and am working to clean up my system once and for all. I'm going to work on my laptop next. It seems to take a lot of tools to be safe out there...

    Thank you so very much for your time and patience. What you and others do here on VirtualDr is truly admirable. Your efforts in assisting so many that would be so totally screwed without help (like me!) don't go unappreciated.

    inurdreams


    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Alexis & Quinn
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: ALLUSE~1~BCH
    ->Temp folder emptied: 0 bytes

    User: Bonnie
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Bonnie2
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: georgess
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes

    User: Hodorowski
    ->Temp folder emptied: 33196 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 8570535 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 456 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1226 bytes
    RecycleBin emptied: 1942 bytes

    Total Files Cleaned = 8.00 mb


    [EMPTYFLASH]

    User: Alexis & Quinn
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: ALLUSE~1~BCH

    User: Bonnie
    ->Flash cache emptied: 0 bytes

    User: Bonnie2

    User: Default

    User: Default User

    User: georgess

    User: Hodorowski
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb



    OTL by OldTimer - Version 3.2.21.0 log created on 02232011_194154

    Files\Folders moved on Reboot...
    File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

    Registry entries deleted on Reboot...

  6. #21
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Way to go!!
    Good luck and stay safe

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •