1.

Solve : Internet Explorer very hard to open?

Answer»

For some time we have suffered from redirects when browsing. This problem was becoming more persistent. We also had a recurring message about a threat on a WIN file which AVG was patching but could not remove.
Over the last few days it was becoming nearly impossible to get IE to connect. When IE was double clicked it flashed on briefly then closed almost immediately with a message that it had encountered a problem and needed to close.
I installed SP3 for XP and IE8 but this made no difference. I have now completed all Malware removal steps and attach logs.
Both users can now access the internet from their desktops.
I will be grateful for any other steps I should take

[Saving space, attachment deleted by admin]Hello moreagh.

You had some pretty nasty stuff on the computer so I need to warn you of the potential hazards.

The computer was infected by a worm and backdoor trojan(s), which has Backdoor Functionality. This can give intruders complete control of the computer, logging key strokes, stealing information, etc.

You are strongly advised to do the following immediately!

* Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
* From a clean computer, change [color=redall[/color] of your online passwords -- for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
* Because of its backdoor functionality, your PC is very likely compromised and there is no way to be sure it can ever again be trusted.
* Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.

To help you make a more informed decision, please read the following articles:

* Danger: Remote Access Trojans.
* When should I re-format? How should I reinstall?
* How Do I Handle Possible Identify Theft, Internet Fraud and Credit Card Fraud?

Should you have any questions, please feel free to ask.
Please let me know your decision and we'll get started with clean up if that's what you choose.


If you decide to continue with cleaning please follow the below steps.

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

  • O4 - HKLM\..\Run: [lphcafoj0e7er] C:\WINDOWS\system32\lphcafoj0e7er.exe
  • O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdpjv.exe] C:\WINDOWS\system32\kdpjv.exe
.
Important: Close all open windows EXCEPT for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

----------

If you already have ComboFix be sure to delete it and download a new copy.

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

DO NOT run it yet!

Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]KillAll::

File::
C:\WINDOWS\system32\kdpjv.exe
C:\WINDOWS\system32\lphcafoj0e7er.exe


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while DRAGGING the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

Thanks for the help.
I'll go with trying to clean the system.
I've DONE everything described however when combofix began to execute it asked me to disable the AVG antivirus scanner or risk damage to the machine.
Is it possible to disable this? If so how? Quote from: moreagh on February 03, 2010, 10:04:17 AM
Is it possible to disable this? If so how?

See here. http://www.bleepingcomputer.com/forums/topic114351.htmlThese are the Combofix logs.
I have noticed that Windows Firewall is not active and the system will not let me turn it on. Is this because this is the base computer for a wireless network

[Saving space, attachment deleted by admin]Quote
AV: Windows Live OneCare *On-access scanning disabled* (Updated) {427ADFC3-B354-4A51-BE34-A9D4218E45C4}
FW: Windows Live OneCare Firewall *disabled* {A3899D22-27E6-4A7E-AE4E-2C106646DAAB}

You can't turn it on because OneCare is still there. I suggest uninstalling both Windows Live OneCare and Windows Live OneCare firewall.


Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger or Windows Live Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.

----------

Go to Start > Run and type notepad.exe then click OK

Copy the text in the Code box below and paste it into Notepad.

Code: [Select]REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
In Notepad go to File > Save as...

Next to File name: type fixme.reg Use the dropdown box next to Save as type: and select All files. Save it to the Desktop.

There should now be a file on the Desktop that looks like this

Double-click fixme.reg it and ALLOW it to merge with the Registry.

You may not see anything happen but give it a few seconds or so to finish.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it did not work.

Now delete the fixme.reg file from the Desktop.

----------

* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
* Now type Combofix /Uninstall in the runbox
* Make sure there's a space between Combofix and /Uninstall
* Then hit Enter

* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* RESET the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.

----------

Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

----------

ESET Online Scan

Scan your computer with the ESET FREE Online Virus Scan

* Click the ESET Online Scanner button.

* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.

* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the <<Back button then click Finish.

In your next reply please include the ESET Online Scan Log
Merging with the registry was a success.
I also have Windows Firewall again.
ESETScan file attached

[Saving space, attachment deleted by admin]Looks good. How is the computer running now?

For a good free firewall. Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo HopSurf..", Ask.com search provider" and "Make Comodo HopSurf.com Search my homepage"
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

Computer running very well.
Good connections
Sharp response
No virus alerts
No redirects

I am really grateful for your help. The steps have been extremely clear, accurate and easy to follow.
Are there any of the programs I should now delete or any that I should now use on a regular basis in case of recurring problems?
Thanks again
RobertYour welcome.

Final suggestions.

Use the Secunia Software Inspector to check for out of date software.
  • Click Start Now
  • Check the box next to Enable thorough system inspection.
  • Click Start
  • Allow the scan to finish and scroll down to see if any updates are needed.
  • Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

If you are using or have installed IE6 you are using an outdated and soon to be unsupported version of Internet Explorer and I strongly suggest you update to the latest version directly from Microsoft Internet Explorer 8: Home page.

----------

I recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no realtime protection so will not interfere with each other. They do not use any significant amount of resources (except a little disk space) until you run a scan.

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.


Discussion

No Comment Found

Related InterviewSolutions