problem running defogger

Maniac · January 18, 2011

Please go to www.virustotal.com and upload the following file:

C:\WINDOWS\Secure.dll

Post the resaults in your next reply.

Tom717 · January 18, 2011

Please go to www.virustotal.com and upload the following file:
C:\WINDOWS\Secure.dll
Post the resaults in your next reply.

File name:

Secure.dll

Submission date:

2011-01-18 19:42:28 (UTC)

Current status:

queued queued analysing finished

Result:

0/ 42 (0.0%)

VT Community

not reviewed

Safety score: -

Compact

Print results

Antivirus Version Last Update Result

AhnLab-V3 2011.01.18.00 2011.01.17 -

AntiVir 7.11.1.174 2011.01.18 -

Antiy-AVL 2.0.3.7 2011.01.18 -

Avast 4.8.1351.0 2011.01.18 -

Avast5 5.0.677.0 2011.01.18 -

AVG 10.0.0.1190 2011.01.18 -

BitDefender 7.2 2011.01.18 -

CAT-QuickHeal 11.00 2011.01.18 -

ClamAV 0.96.4.0 2011.01.18 -

Commtouch 5.2.11.5 2011.01.18 -

Comodo 7434 2011.01.18 -

DrWeb 5.0.2.03300 2011.01.18 -

eSafe 7.0.17.0 2011.01.18 -

eTrust-Vet 36.1.8106 2011.01.18 -

F-Prot 4.6.2.117 2011.01.17 -

F-Secure 9.0.16160.0 2011.01.18 -

Fortinet 4.2.254.0 2011.01.16 -

GData 21 2011.01.18 -

Ikarus T3.1.1.97.0 2011.01.18 -

Jiangmin 13.0.900 2011.01.18 -

K7AntiVirus 9.77.3570 2011.01.18 -

Kaspersky 7.0.0.125 2011.01.18 -

McAfee 5.400.0.1158 2011.01.18 -

McAfee-GW-Edition 2010.1C 2011.01.18 -

Microsoft 1.6402 2011.01.18 -

NOD32 5798 2011.01.18 -

Norman 6.06.12 2011.01.18 -

nProtect 2011-01-18.01 2011.01.18 -

Panda 10.0.2.7 2011.01.18 -

PCTools 7.0.3.5 2011.01.18 -

Prevx 3.0 2011.01.18 -

Rising 22.83.01.03 2011.01.18 -

Sophos 4.61.0 2011.01.18 -

SUPERAntiSpyware 4.40.0.1006 2011.01.18 -

Symantec 20101.3.0.103 2011.01.18 -

TheHacker 6.7.0.1.116 2011.01.18 -

TrendMicro 9.120.0.1004 2011.01.18 -

TrendMicro-HouseCall 9.120.0.1004 2011.01.18 -

VBA32 3.12.14.2 2011.01.18 -

VIPRE 8114 2011.01.18 -

ViRobot 2011.1.18.4261 2011.01.18 -

VirusBuster 13.6.152.1 2011.01.18 -

Additional information

Show all

MD5 : f739b2bc15de2f05150303f012295871

SHA1 : eb07331969b3c851744bcfa9533d52927d4f211a

SHA256: 23b3492f4e615abf3d9768dc51fb6021c4e524e16267973749a75dfff7230c6d

Maniac · January 18, 2011

Thanks!

Run OTL.exe
Under Custom Scans/Fixes post the following script:

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8075

:files
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\WINDOWS\tasks\229B350D-034F-4c01-BAF2-3EA03DCAE0B9.job
C:\Documents and Settings\Tom Krisa\Application Data\systemFP.$dk
C:\WINDOWS\System32\epoPGPsdk.dll.sig
C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
C:\Documents and Settings\Tom Krisa\Application Data\BitTorrent

:Commands
[purity]
[emptytemp]
[emptyflash]

Then click the Run Fix button at the top
Let the program run unhindered,when it is done it will say "Fix Complete press ok to open log"
Please post that log in your next reply.

Tom717 · January 18, 2011

I ran the scan, and it said the computer needed to reboot in order to finish deleting files. This appeared on my screen after the reboot:

All processes killed

========== OTL ==========

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

========== FILES ==========

C:\WINDOWS\System32\CONFIG.TMP moved successfully.

C:\WINDOWS\System32\SET19C.tmp moved successfully.

C:\WINDOWS\System32\SET19E.tmp moved successfully.

C:\WINDOWS\System32\SET1A2.tmp moved successfully.

C:\WINDOWS\System32\SET1A3.tmp moved successfully.

C:\WINDOWS\System32\SET1AA.tmp moved successfully.

C:\WINDOWS\002790_.tmp moved successfully.

C:\WINDOWS\tasks\229B350D-034F-4c01-BAF2-3EA03DCAE0B9.job moved successfully.

C:\Documents and Settings\Tom Krisa\Application Data\systemFP.$dk moved successfully.

C:\WINDOWS\System32\epoPGPsdk.dll.sig moved successfully.

C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x64\x64 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x64 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} folder moved successfully.

C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} folder moved successfully.

C:\Documents and Settings\Tom Krisa\Application Data\BitTorrent\dlimagecache folder moved successfully.

C:\Documents and Settings\Tom Krisa\Application Data\BitTorrent\apps folder moved successfully.

C:\Documents and Settings\Tom Krisa\Application Data\BitTorrent folder moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 9540090 bytes

->Temporary Internet Files folder emptied: 204952 bytes

User: All Users

User: Default User

->Temp folder emptied: 49152 bytes

->Temporary Internet Files folder emptied: 32969 bytes

User: LocalService

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 45566 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 229430384 bytes

User: Tom Krisa

->Temp folder emptied: 1037255010 bytes

->Temporary Internet Files folder emptied: 313614695 bytes

->Java cache emptied: 71997958 bytes

->FireFox cache emptied: 54047266 bytes

->Flash cache emptied: 216345 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 324017711 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 79552072 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 2,022.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Tom Krisa

->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.20.2 log created on 01182011_151831

Files\Folders moved on Reboot...

File\Folder C:\WINDOWS\temp\logishrd\LVPrcInj01.dll not found!

File\Folder C:\WINDOWS\temp\NSM-{256BE7ED-C0F4-40C8-9319-8C2DC2AB3902}.dat not found!

File\Folder C:\WINDOWS\temp\Perflib_Perfdata_9bc.dat not found!

File\Folder C:\WINDOWS\temp\Perflib_Perfdata_a40.dat not found!

Registry entries deleted on Reboot...

Maniac · January 18, 2011

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Tom717 · January 18, 2011

I have a problem getting the updater to run. Though I can update the anti-malware on this computer, I cannot update it on the infected computer or transfer the updated version to that computer via USB. Is it alright to use the outdated version? (28 days outdated)

Maniac · January 18, 2011

So there is a problem with your internet connection?

Tom717 · January 18, 2011

The computer is connected to the internet, and Skype works, but I cannot use any browsers. In Firefox, I get the error message "server not found."

Maniac · January 18, 2011

Note: You will need to save any work before double clicking the fix.bat file because it will automatically restart your computer

Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):

@echo off
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 10
del /f /q %0

Once you've done that click on File and select Save As...
In the Save dialogue box click on the drop down menu next to Save as type and select All Files
Name the file fix.bat (the .bat extension is very important)
Save the file to your desktop and double click it to run it.
Once it runs it will automatically restart your computer
Once your computer boots again, check to see if your internet performance has improved

Please try again with Firefox.

Tom717 · January 18, 2011

Ok, I managed to get the internet working fine again, and I went back and ran the anti-malware. This is the report I got:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5549

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

1/18/2011 4:36:13 PM

mbam-log-2011-01-18 (16-36-13).txt

Scan type: Quick scan

Objects scanned: 155322

Time elapsed: 5 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\yr87fk3d2dnszapq2 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\myhhysry (Trojan.FakeAlert.Gen) -> Value: myhhysry -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Maniac · January 18, 2011

How are things now?

Tom717 · January 18, 2011

It appears to be running normally. Is there anything else I should check or do?

Maniac · January 18, 2011

It's not a bad idea for one last check:

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.

Please go here then click on:
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Now click on Advanced Settings and select the following:

- Remove found threats
- Scan archives
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology

[*]Now click on:

[*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.

[*]When completed the Online Scan will begin automatically.

[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.

[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!

[*]Now click on:

[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.

[*]Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Tom717 · January 19, 2011

Unfortunately I had a problem getting the log copied and lost it, but I can tell you that it said that there were no threats found. can run it aagain if you think I should.

Maniac · January 19, 2011

Do you remember that found something and if so what? I need a similar information.

Tom717 · January 19, 2011

I ran the avast! antivirus, and it found two infected .dll files, and I used the option "move to chest." Now, neither the avast nor the eset scans report any problems, though those two files have still not been dealt with. In addition, my internet browser has stopped working again - the screen is completely blank when I try to go to a website.

Maniac · January 19, 2011

Note: You will need to save any work before double clicking the fix.bat file because it will automatically restart your computer

Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):

@echo off
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 10
del /f /q %0

Once you've done that click on File and select Save As...
In the Save dialogue box click on the drop down menu next to Save as type and select All Files
Name the file fix.bat (the .bat extension is very important)
Save the file to your desktop and double click it to run it.
Once it runs it will automatically restart your computer
Once your computer boots again, check to see if your internet performance has improved

Please try again with your web browser.

LDTate · January 25, 2011

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

problem running defogger

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information