Official Intrusion Detection System

View previous topic View next topic Go down

Official Intrusion Detection System

Post by Pokerking98 on 29th November 2009, 6:02 pm

A warning box pops up saying

"Attention! System detected a potential hazard (TrojanSPM/LX) on your computer that may infect executable files. You private information and PC saftey is at risk. To get rid of unwanted spyware and keep your computare safe you need update your current security software. Click OK to download official intrusion detection system (IDS software)"

On everything ive googled the message has come up different from mine. As mine says. "You private information and PC saftey is at risk." Where as everyone elses says "Your private information and PC saftey is at risk."

It has changed my backround to "Your system is infected"

It has disabeled Malware Bytes Anti Malware and Hi-jack this. I tried running combo fix. The combo fix box came up with the loading bar. It finished loading and nothing happened. It had disabled my Task manager. I'm feeling pretty screwed.

Any help would much be appreciated...

~Poker

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 29th November 2009, 6:43 pm

Please download the current version of HijackThis from [You must be registered and logged in to see this link.]

  • Double click and run the installer.
  • It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  • After installing, you should get the user agreement, press accept and Hijack This will run.
  • Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 29th November 2009, 6:52 pm

It wont allow me to do so. The install box disappares after 10-15 seconds

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 29th November 2009, 7:11 pm

Please download exeHelper from one of the two links.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

  • Double-click on exeHelper.com or exeHelper.scr to run the fix.
  • A black window should pop up, press any key to close once the fix is completed.
  • Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 29th November 2009, 7:24 pm

exeHelper by Raktor
Build 20091122
Run at 14:24:28 on 11/29/09
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Killed process winupdate86.exe
Checking for bad files...
Deleting file C:\WINDOWS\system32\41.exe
Deleting file C:\WINDOWS\system32\critical_warning.html
Deleting file C:\WINDOWS\system32\logon.exe
Error deleting C:\WINDOWS\system32\logon.exe - Set for removal on reboot - PLEASE REBOOT
Deleting file C:\WINDOWS\system32\winupdate86.exe
Checking for bad registry entries...
Removing HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdate86.exe
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 30th November 2009, 12:03 am

Can you run Hijack This now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 30th November 2009, 12:04 am

Nope, nor can I run MBAM.

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 30th November 2009, 12:12 am

Hmm, lets try this.

  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run.
  • When complete, two logs will open. Save both of the report to your Desktop.
  • Copy and paste BOTH LOGS back here, use more than one post if needed.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 30th November 2009, 3:57 am

[You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 30th November 2009, 8:45 pm

Wow, what a mess.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 30th November 2009, 9:00 pm

I cant install it. At end of setup it says

"Unable to execute file
..file path...

CreateProcess Failed code2
The system cannot find the file specified

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 1st December 2009, 12:58 am

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 1st December 2009, 2:03 am

Ergh, I didn't see your post and my computer needed immediate attention. So I kind of went and did my own thing. It was trying to send stuff back out through my interenet at a rapid rate and my firewall was blocking it. I used one of my other spyware removers to remove a bulk of the problem. Which then allowed me to run Malware Bytes. Malware bytes finished the job I think. Here is the

HiJack This (Before MBAM): [You must be registered and logged in to see this link.]
HiJack This (After MBAM):http://pastebin.com/m1b7b3a15

MBAM*:http://pastebin.com/m3eadcb52

* I am not positive this is my MBAM log. My computers time and date had been reset so I am not 100% sure but I am pretty sure thats it.

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 1st December 2009, 9:51 pm

Well, that helped a little bit,. but were still gonna need Combofix. Can you give it a run please.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 1st December 2009, 10:46 pm

[You must be registered and logged in to see this link.]

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 1st December 2009, 11:28 pm


  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    RenV::
    c:\program files\Common Files\Ahead\Lib\nerocheck .exe
    c:\program files\Dell\Media Experience\dmxlauncher .exe
    c:\program files\McAfee.com\Agent\mcagent .exe
    c:\program files\McAfee.com\Personal Firewall\mpftray .exe
    c:\program files\McAfee.com\VSO\mcvsshld .exe
    c:\program files\McAfee.com\VSO\oasclnt .exe
    c:\windows\system32\DLA\dlactrlw .exe

    Registry::
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Login Services"=-
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 2nd December 2009, 10:49 pm

[You must be registered and logged in to see this link.]

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 3rd December 2009, 1:45 am

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTM.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    c:\program files\Common Files\Ahead\Lib\nerocheck .exe
    c:\program files\Dell\Media Experience\dmxlauncher .exe
    c:\program files\McAfee.com\Agent\mcagent .exe
    c:\program files\McAfee.com\Personal Firewall\mpftray .exe
    c:\program files\McAfee.com\VSO\mcvsshld .exe
    c:\program files\McAfee.com\VSO\oasclnt .exe
    c:\windows\system32\DLA\dlactrlw .exe


  • Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 4th December 2009, 1:06 am

:files
c:\program files\Common Files\Ahead\Lib\nerocheck .exe
c:\program files\Dell\Media Experience\dmxlauncher .exe
c:\program files\McAfee.com\Agent\mcagent .exe
c:\program files\McAfee.com\Personal Firewall\mpftray .exe
c:\program files\McAfee.com\VSO\mcvsshld .exe
c:\program files\McAfee.com\VSO\oasclnt .exe
c:\windows\system32\DLA\dlactrlw .exe

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 4th December 2009, 1:27 am

Think you pasted the wrong bit, that's the script and not the log. LOL Banner


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 4th December 2009, 1:42 am

lol, it said everything went successfull.

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 4th December 2009, 1:49 am

Okay, good.
Some programs may not work because the malware corrupted them, so you may need to uninstall/re-install to get them functioning as normal again.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 4th December 2009, 1:50 am

[You must be registered and logged in to see this link.] wrote:Okay, good.
Some programs may not work because the malware corrupted them, so you may need to uninstall/re-install to get them functioning as normal again.

I guess that is what is messing up my skype. So am I all clear now? And any ideas on how I got this? I hadn't downloaded anything or used any p2p stuff.

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 4th December 2009, 1:51 am

You can get it just from visiting a bad website, as that website may contain an i-frame from another site, so basically you are accessing a bad website via a good website.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 4th December 2009, 1:52 am

Okay thanks a ton. I will be sure to donate since this is like the 5th time you guys have helped. Thanks again

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 4th December 2009, 1:56 am

Uh, any other suggestions for fixing programs besides installing/ uninstalling ? My skype closes out after 2 minutes of being opened. I uninstalled and re-installed.

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 4th December 2009, 2:05 am

Are you using the most updated version of Skype? 4.1 seems to be the most recent.

[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Pokerking98 on 4th December 2009, 2:09 am

[You must be registered and logged in to see this link.] wrote:Are you using the most updated version of Skype? 4.1 seems to be the most recent.

[You must be registered and logged in to see this link.]

Yep ive tried uninstalling / reinstalling twice now. Any ideas?

Pokerking98
Intermediate
Intermediate

Posts Posts : 77
Joined Joined : 2009-06-10
OS OS : XP
Points Points : 27717
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Official Intrusion Detection System

Post by Belahzur on 4th December 2009, 10:06 pm

Did you delete the leftover folders when you uninstalled it? sometimes files get left behind, including some that may have been damaged by the malware, but not replaced when re-installed.

Uninstall again, then remove these 3 folders.
C:\documents and settings\David's\Application Data\Skype
C:\documents and settings\David's\Application Data\SkypePM
C:\Program Files\Skype

Then re-install.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum