|
Answer» Hello!!!
My Girlfriends Computer is having a problem with IE & windows explorer freezing on her or encountering problems and needs to close... also computer has been lagging bad.
Have done defrag, scandisk, and disk cleanup. Did an a-squared scan which didn't find anything!! Also did an avg scan which found Trojans. Thinking maybe she has a mess of infections? I Have gone through your guidelines and have logs you recommended.. I'm not quite sure what to do within my lacking knowledge of viruses and Trojans.
Any help would be greatly appreciated!
Thank you in Advance!!
O/S - Microsoft Windows XP Professional
Version 2002, SP2
Intel Pentium III processor , 930MHz
System Manufacturer - D815EA
System Model - EA81510A
512 MB of Ram
80 GB hardrive
Following are logs!
[file cleanup - saving space - attachment deleted by admin]Go to add/remove programs and look for Windows Messenger. If found please uninstall it.
Note: This is different from MSN Messenger.
----------
Click Start > Run and type in: services.msc
Click OK
In the Services window find: Boonty Games - BOONTY
Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK
Now, go to Start > Run, and copy/paste the following into the Open box:
sc delete Boonty Games - BOONTY
Click: OK
----------
Open Hijackthis and select Do a system scan only.
Place a check mark next to the following entries: (if there)
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://www.gamehouse.com/games/gamehouse/ghplayer.cab
O16 - DPF: {775879E2-7309-4619-BB02-AADE41F4B690} (CPlayFirstdreamControl Object) - http://www.gamehouse.com/games/DreamChronicles.cab
O16 - DPF: {8FA2192F-B95D-40E3-898F-8D7ABB8E00D0} - http://www.gamehouse.com/games/SpinTopGamesLauncher.cab
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} (DVC Download Control) - http://www.gamehouse.com/games/dvcode/DVCControl.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-us.cab
O16 - DPF: {F09BFD07-20B5-46D8-A6D5-BE4EF22F1F4D} (DGTx.uc1) - http://69.57.132.82/DGTx.CAB
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
Important: Close all windows except for Hijackthis and then click Fix checked.
Exit Hijackthis.
Restart the computer.
----------
Please download Combofix by sUBs from one of the below links.
(Try all three if necessary) Important! Combofix.exe MUST be saved to and ran from the Desktop.- Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting Combofix.
- Important! Temporarily disable your antivirus, script blocking and any antispyware real time protection before performing a scan.
- Click this link to see a list of security programs that should be disabled and how to disable them.
- If yours is not listed and you don't know how to disable it, please ask.
- Warning: Combofix disconnects your computer from the internet. The CONNECTION is automatically restored before Combofix completes its run.
- Double click combofix.exe & follow the prompts.
- From the keyboard select 1 and press Enter[/COLOR]
- When finished, it will produce a log for you.
- Post that log in your next reply.
Warning: Do not mouseclick combofix's window while it is running. That may cause it to stall
- If Combofix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your computer.
- Important: Remember to re-enable your antivirus and antispyware before reconnecting to the Internet.
----------
Next post please add
Combofix log
NEW Hijackthis log
Thanks!!!... for the Quick response evilfantasy!!
OK.. I didn't find windows messenger in the add/remove programs.. I did however remove it from the windows components.
Also in the service status on Boonty games.. you said to click the stop button, It was already stopped. dunno if makes a difference but figured I should tell you.
OK I did all you asked and I am sending the logs. will be waiting if something else needs to be done...once again thanks so much for the help!!
[file cleanup - saving space - attachment deleted by admin]Everything looks fine on the malware front.
We will want to do some cleanup at this point.
LET's clear out the programs we've been using to clean up your computer, they are not suitable for
general malware removal and could cause damage if launched accidentally.
- Click START then RUN
- Now type Combofix /u in the runbox
- Make sure there's a space between Combofix and /u
- Then hit Enter.
The above procedure will:
- Delete:
- ComboFix and its ASSOCIATED files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
- Reset the clock settings.
- Hide file extensions, if required.
- Hide System/Hidden files, if required.
- Set a new, clean Restore Point.
.
This is a good time to clear your infected system restore points and establish a new clean restore point:
- Go to Start > All Programs > Accessories > System Tools > System Restore
- Select Create a restore point, and click Next.
- Next, go to Start > Run and type in cleanmgr
- Select the More options tab
- Next to System Restore click Clean up...
This will remove all restore points except the new one you just created.
Here are some great tools to help you keep from getting infected again.
Spybot Search & Destroy - A safe and effective spyware scanner.
* Official Spybot Tutorial
* Spybot FAQ
AVG Anti-Spyware Free Edition - Very reliable with a high detection rate.
* AVG Anti-Spyware User Manual
SpywareBlaster - SECURE your Internet Explorer to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* SpywareBlaster Tutorial
Comodo BOClean - Stops trojans and many more malicious attacks.
Use a Firewall - It can not be stressed enough how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over.
* Click here for a list of free firewalls.
* Why would I consider a third party firewall?
UPDATE!!! UPDATE!!! UPDATE!!! - If you do not have automatic updates enabled then visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer.
* Help with Windows updates
Learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?
Let us know how things are now.Hey There.. evilfantasy!!!
Thanks so Much for the help!!! Did the clean up you said and cleaned out the restore points. The Computer is running like I had done a reformat on it..lol... Girlfriend was stressing about it big time! ... She is so happy now that it is running smooth again.. and she wants to say thank you too! Really appreciate the time you put in to help us less knowledgeable folks!! Think I will take you up on some of the advice of adding a few more tools like the comodo firewall.
I Have the a-squared scanner and avg antivirus on here. Was wondering about the superantispyware and if I should leave it on here too!! Also should I keep the Dr. Web cureit?
You have a Great Day and Again Thank You!! Definately leave the SuperAntispyware and Dr. Web. They are free and make a great ADDITION to the arsenal. I will alternate scanning weekly (or so) AVG, Super and Dr Web are among the best and most reliable. Be careful with aSquared. It is powerful and has been known to pick up legit items and flag them as malicious.
Glad everything worked out. Regular maintenance with CCleaner and a spyware scan now and then will do wonders.
Safe surfing...........
|
