Author Topic: Need help recovering after viruses  (Read 6885 times)

0 Members and 1 Guest are viewing this topic.

S-100

  • Guest
Need help recovering after viruses
« on: August 30, 2009, 10:53:59 AM »
Hi, I ran a scan the other day and got rid of several viruses. However, I can't figure out how to repair the damage they did to my computer.

Lots of stuff is malfunctioning, including Avast. There is a little red circle with a bar over the toolbar logo. The On-Access Scanner isn't running. VRDB won't work.

I also can't do a system restore because that isn't working. I can barely get Firefox to launch...it keeps crashing on me. My virus scans are SUPER slow. CheckDisk isn't working right. On and on and on.

I need some advice on how to get things working right again. I can't even reboot without tons of tries before it works.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37614
  • Not a avast user
Re: Need help recovering after viruses
« Reply #1 on: August 30, 2009, 12:06:52 PM »
Are you sure you are clean  ???

Try
Malwarebytes Antimalware http://malwarebytes.org/  and press "remove slected" after scan

S-100

  • Guest
Re: Need help recovering after viruses
« Reply #2 on: August 30, 2009, 12:28:01 PM »
No, I'm not sure.  :-\

MBAM is what I used initially. After I restarted to finish the removal is when all my problems began.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37614
  • Not a avast user
Re: Need help recovering after viruses
« Reply #3 on: August 30, 2009, 12:28:35 PM »
Also download an run HijackThis and post the logg her, then someone who can read these loggs will help you
http://filehippo.com/download_hijackthis/

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37614
  • Not a avast user
Re: Need help recovering after viruses
« Reply #4 on: August 30, 2009, 12:30:31 PM »
Do you also have the name of the Virus ?

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37614
  • Not a avast user
Re: Need help recovering after viruses
« Reply #5 on: August 30, 2009, 12:35:37 PM »
you can also try these cleaning tools

Norman Malware Cleaner http://www.norman.com/support/support_tools/58732/en

Dr.Web CureIt http://www.freedrweb.com/

S-100

  • Guest
Re: Need help recovering after viruses
« Reply #6 on: August 30, 2009, 12:45:59 PM »
I don't remember the names off the top of my head. Here is my HjT log:

--------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:28 AM, on 8/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Compaq_Owner.SHAWN\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\semabawe.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: STSRL - Sysinternals - www.sysinternals.com - C:\DOCUME~1\COMPAQ~1.SHA\LOCALS~1\Temp\STSRL.exe

--
End of file - 7232 bytes

S-100

  • Guest
Re: Need help recovering after viruses
« Reply #7 on: August 30, 2009, 12:59:05 PM »
This is the list from the MBAM log:

------------------

Files Infected:

C:\WINDOWS\system32\Microsoft\avastform.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\mui\JazzHackerPro.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\en-US\csrrs.exe (Spyware.Banker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Default User\Templates\_svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\drvindex.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ie.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\mdmusrg.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\mfcem56.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\netbrdgs.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ps5333.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\sonypvu1.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\tridkb.inf (Trojan.Agent) -> Quarantined and deleted successfully.

YoKenny

  • Guest
Re: Need help recovering after viruses
« Reply #8 on: August 30, 2009, 01:02:25 PM »
This is bad:
O20 - AppInit_DLLs: C:\WINDOWS\system32\semabawe.dll

Install User Profile Hive Cleanup Service:
Brief Description
A service to help with slow log off and unreconciled profile problems.
http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en


S-100

  • Guest
Re: Need help recovering after viruses
« Reply #9 on: August 30, 2009, 01:16:57 PM »
How is that program supposed to work? All it's doing for me is opening the black box, blinking for a few seconds, and then closing.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37614
  • Not a avast user
Re: Need help recovering after viruses
« Reply #10 on: August 30, 2009, 01:44:25 PM »
what program?

S-100

  • Guest
Re: Need help recovering after viruses
« Reply #11 on: August 30, 2009, 01:58:01 PM »
UPH Cleanup

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37614
  • Not a avast user
Re: Need help recovering after viruses
« Reply #12 on: August 30, 2009, 02:15:18 PM »
Im not sure, i think it is only a fix for windows

Quote
Overview
The User Profile Hive Cleanup service helps to ensure user sessions are completely terminated when a user logs off. System processes and applications occasionally maintain connections to registry keys in the user profile after a user logs off. In those cases the user session is prevented from completely ending. This can result in problems when using Roaming User Profiles in a server environment or when using locked profiles as implemented through the Shared Computer Toolkit for Windows XP.

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 89348
  • No support PMs thanks
Re: Need help recovering after viruses
« Reply #13 on: August 30, 2009, 03:32:16 PM »
UHP Cleanup doesn't do anything like a malware scanner, etc. you install it and it does its work at shutdown, to close stubborn processes. So this isn't specifically a malware solution, but if malware was causing shutdown problems then it could help.

So if you aren't suffering shutdown problems in XP (check your windows event viewer logs) then this is unlikely to help.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Spiritsongs

  • Guest
Re: Need help recovering after viruses
« Reply #14 on: August 30, 2009, 07:58:15 PM »
 :)  Hi S-100 :

 Since your problems started after using Malwarebytes Anti-Malware, it seems
 wise to seek Help on THEIR Support Forums at www.malwarebytes.org/forums
 particularly their "General Malwarebytes' Anti-Malware Forum" . Their Forums
 are staffed by trained, CERTIFIED, Volunteer "Malware Removal Specialists" .

 That 1st Entry in their Log ( "avastform.exe [Trojan.Agent]" ) looks highly
 suspicious !?