« previous next »
Pages: [1] 2   Go Down

Author Topic: Solution? Chinese character'd programs running in MSConfig  (Read 10894 times)

0 Members and 3 Guests are viewing this topic.

Jive Dadson

  • Guest
Solution? Chinese character'd programs running in MSConfig
« on: July 08, 2012, 09:45:06 AM »
I am having the problem that was described in an old thread. http://forum.avast.com/index.php?PHPSESSID=69deet8rj0v9ohirrpcnmh84a1&topic=67218.45
(Quick description below.)

The old thread is four pages long, and I have not figured out what it says the solution is. Can someone give the Cliff Notes version of how to smite the virus?

I am still running Windows XP, with the latest and greatest service packs and updates. I use all the Avast realtime shields. (I am currently running a full system scan. Nothing so far, but it will take hours.)

The symptoms are as follows:

In the "startup" section of msconfig, there are two entries with Chinese character names.



If I un-check them, then the next time I boot up the computer, I get popup messages during startup complaining that programs referenced from the registry could not be found. The names appear to be the same or similar to the ones that I un-checked.

I have reverted to system restore points as old as I dare use, but the msconfig entries remain.

« Last Edit: July 08, 2012, 09:56:40 AM by Jive Dadson »
Logged

Offline CraigB

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 11259
  • No support PM's thanks
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #1 on: July 08, 2012, 11:15:02 AM »
Please read this section http://forum.avast.com/index.php?topic=53253.0 and provide the neccesary logs back here for one of our malware specialists to look at.
Logged

Jive Dadson

  • Guest
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #2 on: July 08, 2012, 11:27:31 AM »
Quote from: craigb on July 08, 2012, 11:15:02 AM
Please read this section http://forum.avast.com/index.php?topic=53253.0 and provide the neccesary logs back here for one of our malware specialists to look at.

Okay. Doing it now.
Logged

Jive Dadson

  • Guest
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #3 on: July 08, 2012, 12:07:43 PM »

Malwarebytes came back clean. OTL.tx attached.
« Last Edit: July 08, 2012, 01:05:24 PM by Jive Dadson »
Logged

Jive Dadson

  • Guest
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #4 on: July 08, 2012, 01:13:10 PM »
OTL Extras.txt attached.
« Last Edit: July 08, 2012, 01:30:36 PM by Jive Dadson »
Logged

Jive Dadson

  • Guest
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #5 on: July 08, 2012, 01:29:54 PM »
aswMBR.txt attached
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #6 on: July 08, 2012, 02:07:17 PM »
Hi did you set the proxies in Firefox ?

Also when you run OTL next, prior to the run re-enable the weird ones from MSconfig (do not reboot) then I will remove them

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


    Quote
    :OTL
    O3 - HKU\S-1-5-21-1547161642-1454471165-1177238915-1118\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
    O3 - HKU\S-1-5-21-1547161642-1454471165-1177238915-1118\..\Toolbar\WebBrowser: (no name) - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No CLSID value found.
    O3 - HKU\S-1-5-21-1547161642-1454471165-1177238915-1118\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    [2011/09/05 12:21:43 | 000,014,186 | -HS- | C] () -- C:\Documents and Settings\djones\Local Settings\Application Data\2633817848
    [2011/09/05 12:21:43 | 000,014,186 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\2633817848
    [2011/09/05 12:20:38 | 000,013,986 | -HS- | C] () -- C:\Documents and Settings\djones\Local Settings\Application Data\321439609
    [2011/09/05 12:12:29 | 000,014,154 | -HS- | C] () -- C:\Documents and Settings\djones\Local Settings\Application Data\46w58177lyms67eg2e4te31744e21tok3vvfwl1yqf08
    [2011/09/05 12:12:29 | 000,013,986 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\321439609
    [2011/09/05 12:03:13 | 000,014,154 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\46w58177lyms67eg2e4te31744e21tok3vvfwl1yqf08

    :Files
    C:\WINDOWS\Installer\{14c0ff95-2553-8e56-48b8-2b787ffaba50}
    C:\Documents and Settings\djones\Local Settings\Application Data\{14c0ff95-2553-8e56-48b8-2b787ffaba50}

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks
  • Allow the installation of the recovery console




  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.[/b]
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Logged

Jive Dadson

  • Guest
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #7 on: July 08, 2012, 02:40:28 PM »
Quote from: essexboy on July 08, 2012, 02:07:17 PM
Hi did you set the proxies in Firefox ?

Sorry, I do not know what that means, "Did you set the proxies in Firefox?" Was I supposed to as part of this process? If so, I missed it. Or are you asking about what I might have done in the past? I do not have a proxy set in Firefox.

I followed the instructions, and by golly the stupid Chinese character entries are gone! Yippee! THANKS!

There was one small glitch (so far): My default browser got set to IE. No big deal. I have not noticed any other problems, but I have not done much yet.

The log you asked for is attached.
« Last Edit: July 08, 2012, 02:44:12 PM by Jive Dadson »
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #8 on: July 08, 2012, 02:57:00 PM »
Aye these are the proxies I was asking about - If you do not know why they are there I will remove them for you 

Quote
FF - prefs.js: network.proxy.ftp - 10.0.0.1
FF - prefs.js: network.proxy.ftp_port - 88
FF - prefs.js: network.proxy.gopher - 10.0.0.1
FF - prefs.js: network.proxy.gopher_port - 88
FF - prefs.js: network.proxy.http - 10.0.0.1
FF - prefs.js: network.proxy.http_port - 88
FF - prefs.js: network.proxy.socks - 10.0.0.1
FF - prefs.js: network.proxy.socks_port - 88
FF - prefs.js: network.proxy.ssl - 10.0.0.1
FF - prefs.js: network.proxy.ssl_port - 88
Logged

Jive Dadson

  • Guest
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #9 on: July 08, 2012, 02:59:17 PM »
Quote from: essexboy on July 08, 2012, 02:57:00 PM
Aye these are the proxies I was asking about - If you do not know why they are there I will remove them for you 

Quote
FF - prefs.js: network.proxy.ftp - 10.0.0.1
FF - prefs.js: network.proxy.ftp_port - 88
FF - prefs.js: network.proxy.gopher - 10.0.0.1
FF - prefs.js: network.proxy.gopher_port - 88
FF - prefs.js: network.proxy.http - 10.0.0.1
FF - prefs.js: network.proxy.http_port - 88
FF - prefs.js: network.proxy.socks - 10.0.0.1
FF - prefs.js: network.proxy.socks_port - 88
FF - prefs.js: network.proxy.ssl - 10.0.0.1
FF - prefs.js: network.proxy.ssl_port - 88

Those are probably left over from when this was my office computer at work. How do I remove them?

UPDATE: Never mind. I found it. I did set those way back when, but I disabled them when I moved the computer home. I just clicked the "no proxy" radio button. I deleted them just now. Just out of curiosity, how could you have removed them for me?
« Last Edit: July 08, 2012, 03:25:56 PM by Jive Dadson »
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #10 on: July 08, 2012, 03:43:51 PM »
I would have used OTL  ;D

How is the computer behaving ?

Logged

Jive Dadson

  • Guest
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #11 on: July 08, 2012, 03:46:26 PM »
Quote from: essexboy on July 08, 2012, 03:43:51 PM
I would have used OTL  ;D

How is the computer behaving ?

You would have used OTL. Why does that seem a little scary?

The computer is behaving quite nicely, as best I can tell. But like I said, I have not done much with it. Just cruising the net.

Thanks again. I think I will rest now.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #12 on: July 08, 2012, 03:54:33 PM »
If you are happy tomorrow let me know and I will uninstall my tools
Logged

Jive Dadson

  • Guest
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #13 on: July 08, 2012, 03:56:28 PM »
Quote from: essexboy on July 08, 2012, 03:54:33 PM
If you are happy tomorrow let me know and I will uninstall my tools

Whoa. You will uninstall your tools? Please explain.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Solution? Chinese character'd programs running in MSConfig
« Reply #14 on: July 08, 2012, 04:01:01 PM »
I will use OTL to run an uninstall sequence to ensure that the tools are removed cleanly and safely
Logged
Pages: [1] 2   Go Up
« previous next »