Suspected spyware

Page 2 of 2 Previous  1, 2

View previous topic View next topic Go down

Solved Suspected spyware

Post by siouxlini on Mon 27 Aug 2012, 7:25 am

First topic message reminder :

On startup i get a error window that states
"Server Busy"
"Action cannot be completed because the program is busy. Choose switch to to activate the busy program"
when "Switch To" is clicked it brings up the Start Bar

When I ran OTL it did not give me the "Extras.txt" window.

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-26 15:53:14
-----------------------------
15:53:14.638 OS Version: Windows x64 6.1.7601 Service Pack 1
15:53:14.639 Number of processors: 8 586 0x1E05
15:53:14.640 ComputerName: MARK-PC UserName: Mark
15:53:17.305 Initialize success
15:53:25.406 AVAST engine defs: 12082600
15:53:30.525 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
15:53:30.530 Disk 0 Vendor: ST950042 0006 Size: 476940MB BusType: 3
15:53:30.544 Disk 0 MBR read successfully
15:53:30.550 Disk 0 MBR scan
15:53:30.558 Disk 0 unknown MBR code
15:53:30.569 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
15:53:30.590 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 463516 MB offset 409600
15:53:30.625 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 13120 MB offset 949690368
15:53:30.659 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 103 MB offset 976560128
15:53:30.725 Disk 0 scanning C:\Windows\system32\drivers
15:53:42.949 Service scanning
15:54:06.884 Modules scanning
15:54:06.904 Disk 0 trace - called modules:
15:54:06.929 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll
15:54:06.942 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005910790]
15:54:06.954 3 CLASSPNP.SYS[fffff8800115543f] -> nt!IofCallDriver -> [0xfffffa800582e900]
15:54:06.966 5 hpdskflt.sys[fffff880023f7189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004b43050]
15:54:09.964 AVAST engine scan C:\Windows
15:54:12.975 AVAST engine scan C:\Windows\system32
15:57:27.196 AVAST engine scan C:\Windows\system32\drivers
15:57:40.768 AVAST engine scan C:\Users\Mark
16:06:17.018 File: C:\Users\Mark\Downloads\bbtrainer.exe **INFECTED** Win32:MiniMal [Trj]
16:08:56.158 Disk 0 MBR has been saved successfully to "C:\Users\Mark\Desktop\MBR.dat"
16:08:56.170 The log file has been saved successfully to "C:\Users\Mark\Desktop\aswMBR.txt"



siouxlini

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-03-10
Operating System : windows xp

View user profile

Back to top Go down


Solved Re: Suspected spyware

Post by siouxlini on Mon 03 Sep 2012, 3:34 pm

sorry but there was some miscalculation in running the latest fix.
I did run it and it found 8 threats which it automatically removed but
unfortunatly I was unable to export the threats due to a error displaying the retreaving the info you were looking for.

however here is what is listed in the quarantine

c:\Backup Folders\Mark\Local Settings\Temp\tt1.tmp.vbs
c:\Backup Folders\Mark\Local Settings\Temp\tt1A6.tmp.vbs
c:\Backup Folders\My Documents\Downloads\media.player.codec.pack.v.3.6.0.setup.exe
c:\ProgramData\Spybot - Search & Destroy\Recovery\FunWebProducts1.zip
c:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSeatch93.zip
c:\ProgramData\Spybot - Search & Destroy\Recovery\MyWayMyWebSeatch93.zip
c:\Qoobox\Quarantine\C\Program Files (x86)\Vid-Saver\Vid-Saver.dll.vir
c:\Users\Mark\Documents\From Thumb\Downloads\media.player.codec.pack.v3.6.0.setup.exe

siouxlini

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-03-10
Operating System : windows xp

View user profile

Back to top Go down

Solved Re: Suspected spyware

Post by DragonMaster Jay on Mon 03 Sep 2012, 7:25 pm

Remove Spybot S&D

I recommend that you uninstall Spybot S&D, as it is no longer capable of detecting the latest threats. Much better anti-malware solutions exist, and I will point those out later.

Any more issues?

We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

Many of the things to note for us would be:

  • Slow computer
  • Error messages
  • Fake antivirus alerts or the icon in the system tray
  • svchost.exe running at 100%
  • System crashes or blue screen of death


[You must be registered and logged in to see this link.] - Get $30 off Kaspersky products.

~DMJ
GeekPolice Academy Manager


Donations/Contributions

DragonMaster Jay

Manager | Tech Officer
Manager | Tech Officer

Posts : 13451
Joined : 2009-09-07
Operating System : Windows 7 Ultimate

View user profile http://www.twitter.com/jaypfoutz

Back to top Go down

Solved Re: Suspected spyware

Post by siouxlini on Tue 04 Sep 2012, 2:18 am

I removed spybot S&D and also removed google chrome (due to lack of use). I am no longer getting the "Server busy" message on start up even after several restarts.

I see no other issues at this time. I would be interested in what programs (preferrably free) to have to prevent and immunize virus, spyware and malware.

I currently use AVG Free antivirus, Malwarebytes, Spywareblaster. I also use Smart Defrag 2 utility.

Is there any advise to reduce the number of programs running in the background (to improve performance).

Thank you very much for all your help

siouxlini

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-03-10
Operating System : windows xp

View user profile

Back to top Go down

Solved Re: Suspected spyware

Post by DragonMaster Jay on Tue 04 Sep 2012, 7:25 am

I will advise that once we get your machine protected by vulnerabilities...

Clean up System Restore

Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."
  • Select Start > All Programs > Accessories > System tools > System Restore.
  • On the dialogue box that appears select Create a Restore Point
  • Click NEXT
  • Enter a name e.g. Clean
  • Click CREATE

You now have a clean restore point, to get rid of the bad ones:
  • Select Start > All Programs > Accessories > System tools > Disk Cleanup.
  • In the Drop down box that appears select your main drive e.g. C
  • Click OK
  • The System will do some calculation and the display a dialogue box with TABS
  • Select the More Options Tab.
  • At the bottom will be a system restore box with a CLEANUP button click this
  • Accept the Warning and select OK again, the program will close and you are done


Run OTC to remove our tools

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:
  • Save it to your Desktop.
  • Double click OTC.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Purge old temporary files

Download CCleaner Slim and save it to your Desktop - Alternate download link

When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
Follow the prompts to install the program.

* Double-click the CCleaner shortcut on the desktop to start the program.
* Click on the Options block on the left, then choose Cookies.
* Under Cookies to Delete, highlight any cookies you would like to retain permanently
* Click the right arrow > to move them to the Cookies to Keep window.
* Go into Options > Advanced & uncheck Only delete files in Windows Temp folders older than 48 hours
* Click Cleaner on the left then Run Cleaner on the right to run the program.
* Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

Caution: Only use the Registry feature if you are very familiar with the registry.
Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

Security Check

Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


[You must be registered and logged in to see this link.] - Get $30 off Kaspersky products.

~DMJ
GeekPolice Academy Manager


Donations/Contributions

DragonMaster Jay

Manager | Tech Officer
Manager | Tech Officer

Posts : 13451
Joined : 2009-09-07
Operating System : Windows 7 Ultimate

View user profile http://www.twitter.com/jaypfoutz

Back to top Go down

Solved Re: Suspected spyware

Post by siouxlini on Tue 04 Sep 2012, 12:34 pm

Results of screen317's Security Check version 0.99.50
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG Anti-Virus Free Edition 2012
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
SpywareBlaster 4.6
Malwarebytes Anti-Malware version 1.61.0.1400
JavaFX 2.1.1
Java(TM) 6 Update 35
Java(TM) 7 Update 5
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox 12.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgtray.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

siouxlini

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-03-10
Operating System : windows xp

View user profile

Back to top Go down

Solved Re: Suspected spyware

Post by DragonMaster Jay on Tue 04 Sep 2012, 7:06 pm

Adobe Reader Update!

Please download the newest version of Adobe Acrobat Reader from Adobe.com

Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.

Java Update!

Please download the newest version of Java from Java.com.

Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment). Please uninstall/remove each of them.

Once old versions are gone, please install the newest version.

Read more about Java exploit problems

Adobe Flash Player Update!

Please download the newest version of Adobe Flash Player from Adobe.com

Before installing: it is important to remove older versions of Flash Player since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Adobe Flash Player. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.

Firefox Update
Firefox is out of date. Firefox is a very popular web browser, and if it is out of date, it is very vulnerable to security bugs, and other holes. To update it now, click Help > About Firefox, Check for Updates.

Personal Tips on Preventing Malware

See this page for more info about malware and prevention.

Any other questions before I mark this topic solved?


[You must be registered and logged in to see this link.] - Get $30 off Kaspersky products.

~DMJ
GeekPolice Academy Manager


Donations/Contributions

DragonMaster Jay

Manager | Tech Officer
Manager | Tech Officer

Posts : 13451
Joined : 2009-09-07
Operating System : Windows 7 Ultimate

View user profile http://www.twitter.com/jaypfoutz

Back to top Go down

Solved Re: Suspected spyware

Post by siouxlini on Wed 05 Sep 2012, 12:03 am

No. Thank you very much for your help

siouxlini

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-03-10
Operating System : windows xp

View user profile

Back to top Go down

Solved Re: Suspected spyware

Post by DragonMaster Jay on Wed 05 Sep 2012, 7:20 pm

You're welcome!


[You must be registered and logged in to see this link.] - Get $30 off Kaspersky products.

~DMJ
GeekPolice Academy Manager


Donations/Contributions

DragonMaster Jay

Manager | Tech Officer
Manager | Tech Officer

Posts : 13451
Joined : 2009-09-07
Operating System : Windows 7 Ultimate

View user profile http://www.twitter.com/jaypfoutz

Back to top Go down

Solved Re: Suspected spyware

Post by Sponsored content Today at 8:00 am


Sponsored content


Back to top Go down

Page 2 of 2 Previous  1, 2

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum