AV Security - major problems

BookPusher · June 27, 2010

BI apparently posted to the wrong area and got the standard "Try this" message (which appears to be full of great ideas), but I am unable to access any websites with my PC due to that nasty AV suite (why do those sociopaths do that anyway?). I'm really at a loss. I have MB installed, but not updated (current db info is 2/14) and cannot access the internet even in safe mode w/networking.

Any suggestions?

MrCharlie · June 28, 2010

If you can't connect to the internet, try this:

Open up Internet Explorer, and when the program is open, click on the Tools menu and then select Internet Options.
Now click on the Connections
Now click on the Lan Settings
Under the Proxy Server section, please uncheck the checkbox labeled Use a proxy server for your LAN. Then press the OK button to close this screen. Then press the OK button to close the Internet Options screen.
Now that you have disabled the proxy server you will be able to browse the web again with Internet Explorer

MrC

BookPusher · June 28, 2010

I Have tried this in both safe mode and regular. Unfortunately Apply is not an option in regular mode - it's not bright and I can't click the box. I Can choose OK, but the next time I go into LAN settings, the proxy server setting is checked again.

MrCharlie · June 28, 2010

Let me do a little research and I'll get back to you, MrC

MrCharlie · June 28, 2010

See if you can somehow download the attachment, uzip it, double click on it and allow it to merge into the registry.

Let me know, MrC

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"=-
"ProxyEnable"=-

BookPusher · June 28, 2010

I can't download anything. I'm on my phone right now; my pc can't connect to the internet. Well except for the AV Suite site and those porno sites it keeps throwing at me.

MrCharlie · June 28, 2010

I Have tried this in both safe mode and regular. Unfortunately Apply is not an option in regular mode - it's not bright and I can't click the box. I Can choose OK, but the next time I go into LAN settings, the proxy server setting is checked again.

Do you have another computer that you could download on and then transfer it to a usb flash drive and then to the sick computer?

Try this: Go to your Start button > Settings > Control Panel > Internet Options > open it up

Now click on the Connections
Now click on the Lan Settings
Under the Proxy Server section, please uncheck the checkbox labeled Use a proxy server for your LAN. Then press the OK button to close this screen.
Check to see if any of the other boxes are checked, Automatically detect settings and Use auto configuration,
if so try it with them unchecked
Then press the OK button to close the Internet Options screen. (There's no apply)
Now that you have disabled the proxy server you will be able to browse the web again with Internet Explorer

Let me know, MrC

BookPusher · June 28, 2010

No, no other computer. I'm actually on vacation right now, so there is really no way for me to get the file, unless I can somehow use my phone.

I can't open my internet options the way you described - it keeps giving me that security warning and the internet options screen goes away.

I was hoping there might be some exe files I could go in and manually delete, even if it meant doing it from a dos prompt, just to get me to where I'm able to get to the internet.

MrCharlie · June 28, 2010

Here's the two of the best examples of the malware and files associated with it:

http://forums.malwarebytes.org/index.php?showtopic=53741

http://www.bleepingcomputer.com/virus-remo...-security-suite

See if you can locate and delete them.

There's tools available to stop the malware but you can't download them...that's a big problem.

I've updated that reg file if needed.

Let me know, It's late where I'm at so that's it for tonight...be back tomorrow.

MrC

BookPusher · June 28, 2010

So far so good! I'm still working (I didn't have winzip installed - long story), but I'm hopeful! Deleting some of those values in my registry helped me to at least get this far. Thanks! I'll let you know when all is well, and MB is UPDATED.

MrCharlie · June 28, 2010

Sounds GOOD

MrC

BookPusher · June 28, 2010

Yipee! Back in business! I have happily purchased my consumer license and registered. FYI, I had trouble with the Fix file. I had to download winzip (long story), but it said the file was invalid or corrupted. As it turns out, I was able to update MB after deleting those values from the registry, so the fix file wasn't really necessary (I hope).

MrC, you are a beautiful, beautiful man. Thank you so much for your help, and thanks for being out there!

MrCharlie · June 28, 2010

OK, Great!

Yes...I had the same problem with that reg file, it must have gotten messed up during the zipping or upload.

I'm going to replace it.

Just to make sure your clean...lets take a look at a HJT log of the system.

You can find info on that at the link below:

http://forums.malwarebytes.org/index.php?s...st&p=275682

Please post the HJT log, MrC

BookPusher · June 28, 2010

Okay, here goes. I hope this means something to you!

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:26:07 AM, on 6/28/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17055)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\Program Files\AVG\AVG9\avgemc.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\SetPoint\SetPoint.exe

C:\Program Files\PdaNet for Android\PdaNetPC.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe

O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe

O4 - HKLM\..\Run: [sigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

O4 - HKLM\..\Run: [iJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Program Files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe -t

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Startup: PdaNet Desktop.lnk = C:\Program Files\PdaNet for Android\PdaNetPC.exe

O4 - Global Startup: SetPoint.lnk = ?

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1266122816000

O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://systemrequirementslab.com.s3.amazon...etect_intel.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

O18 - Filter hijack: text/html - {11d3a0e3-9aa8-49cb-929c-1cd939610ad7} - C:\WINDOWS\msvideo.dll

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 7892 bytes

MrCharlie · June 28, 2010

OK there's one showing, MBAM should have gotten it but please check:

Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:

O18 - Filter hijack: text/html - {11d3a0e3-9aa8-49cb-929c-1cd939610ad7} - C:\WINDOWS\msvideo.dll

Click on Fix Checked when finished and exit HijackThis.

Can you please also post the log from MBAM...Thanks

Just open up MBAM > Logs > double click on the log > copy and paste it back here.

---------------------------------------------

Enable hidden files as described in the link below: (please hide them when we're done)

http://www.bleepingcomputer.com/tutorials/...al62.html#winxp

Delete this file if found:

C:\WINDOWS\msvideo.dll

Post back a fresh HijackThis log and we will take another look. MrC

BookPusher · June 29, 2010

Okay, first the MBAM log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

6/28/2010 9:41:55 AM

mbam-log-2010-06-28 (09-41-55).txt

Scan type: Quick scan

Objects scanned: 118182

Time elapsed: 6 minute(s), 14 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 2

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\typqofus (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\typqofus (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\me\Local Settings\Application Data\htuvloqvu\brldsrbtssd.exe (Rogue.AntivirusSuite.Gen) -> Delete on reboot.

BookPusher · June 29, 2010

I looked in the Windows directory, but no msvideo.dll there. There is one in both Windows\system and in windows\system32. Should I delete those?

BookPusher · June 29, 2010

And the latest HiJackThis log (msvideo is still there, even after requesting a fix twice):

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:20:03 PM, on 6/28/2010