Computer Problems

[Pokey86]

Hello i apologise for taking some of your time, but i am having problems with my computer. Any help would be greatly appreciated

i followed all previous Steps though for i am unable to run Panda Active Scan or other internet scans as after a short while the page that the scan uses changes to a "Purchase Anti-Virus Software" page. I am also unable to download "Microsoft Windows Defender" as it is stating i do not have a Verified Version of Windows XP

OK, the Symptoms (After running the scans in safe mode) So far i have experienced quite a significant slowdown on my internet connection, my Homepage though set as google.com has now changed to:

http://www.ieuptodate.com/

Despite still being Google in the Internet settings page. I am not sure if these Anti-Virus pop-ups are safe or not so have chosen not to use them. I am also getting a warning message every now & then on the site above warning me about a Virus. On top of those i am getting Pop ups of Advertisements & sometimes pornographic images


Any help would be GREATLY appreciated, & please find the HJT log attached

[jholland1964]

Hi Pokey, welcome! You certainly are not taking up our time, that is why we are here! Give me a bit to look through your log and I will get back, ASAP.
Judy

[Pokey86]

I managed to get a Panda-Active Scan, here is the log

[jholland1964]

Holy Moley!
First of all, notice you obviously have programs disabled at start up via msconfig. Please go back into msconfig and place the checkmarks back into any you have disabled. We need to see EVERYTHING in these scans.
You need to disconnect from the internet, I mean actually remove the plug from the computer. Shut the computer down and then reboot in Safe Mode

After rebooting in safe mode I want you to run Spybot S & D.
Click “Check for Problems.” Allow SpyBot to fix what it finds.

Next run AdAwareSE. Click START > Check the Perform full system scan box > Click NEXT. Allow Ad-Aware to fix what it finds.

Next run AVG Anti-Spyware, please OPEN EWIDO and click Scanner > Complete System Scan.
Allow it to fix what it finds and click on Save Report. Save the log to where it can be easily found and please attach it along with your HijackThis log when you post back.

Once you have completed all of these scans in SAFE MODE. Then reboot the computer in NORMAL MODE and with ALL BROWSERS CLOSED run HJT again, save the log.
Post back here with both the Ewido log and the NEW HJT log.

[jholland1964]

Ok Pokey86,
There are several other things you need to do. Seems like I am going backwards here and I am sorry. Grandkids and other things sort of took precedence here;
If you have not yet, download and run, in SAFE MODE, CCleaner. Run the Default Scan only, do not scan for issues. Clean out what it finds.
Next go to Add/Remove and look for and remove;
Yazzle.
Next Go to My Computer and double click. Next Double Click on "C" Drive.
Go to the Program Folder, next go to the Common Files folder that may be within the Program Folder. Delete the following if found;
Yazzle1122OinAdmin.exe
Yazzle1122OinUninstaller.exe
Yazzle1162OinAdmin.exe
Yazzle1162OinUninstaller.exe
??mantec\msdtc.exe
Next look in C:\ Program Files for these and delete if found;
ipwins\Uninst.exe[²ÜÇ\nsProcess.dll]
?icrosoft\winlogon.exe

Follow the instructions above and then run a new HJT scan and post the log here.

[Pokey86]

Ok Pokey86,
There are several other things you need to do. Seems like I am going backwards here and I am sorry. Grandkids and other things sort of took precedence here;
If you have not yet, download and run, in SAFE MODE, CCleaner. Run the Default Scan only, do not scan for issues. Clean out what it finds.
Next go to Add/Remove and look for and remove;
Yazzle.
Next Go to My Computer and double click. Next Double Click on "C" Drive.
Go to the Program Folder, next go to the Common Files folder that may be within the Program Folder. Delete the following if found;
Yazzle1122OinAdmin.exe
Yazzle1122OinUninstaller.exe
Yazzle1162OinAdmin.exe
Yazzle1162OinUninstaller.exe
??mantec\msdtc.exe
Next look in C:\ Program Files for these and delete if found;
ipwins\Uninst.exe[²ÜÇ\nsProcess.dll]
?icrosoft\winlogon.exe

Follow the instructions above and then run a new HJT scan and post the log here.

Anything in bold i couldn't find... i have already run CCleaner. the AVG & HJT files are attached, sorry for the delay. I was tired & needed some sleep.

[jholland1964]

There are still some items remaining in your log. Please do the following;


1. Print out these instructions as we will need to close every window that is open later in the fix.

2. Download roguescanfix_setup.exe from here:

roguescanfix_setup.exe

Confirm that the file roguescanfix_setup.exe now resides on your desktop.

3. Double-click on the roguescanfix_setup.exe file found on your desktop.

4. Select your language from the drop down menu and then press the OK button.

5. Now press the Next button.

6. Select the option that says I accept the agreement and press the Next button

7. Press the Next button again.

8. Now click on the Install button.

9. The installation program will start installing RogueScanFix into C:\Program Files\Roguescanfix and then display a new screen. At the next screen, leave the checkmark in the Launch RogueScanFix and press the Finish button.

10. RogueScanFix will automatically be started and you will be presented with the Credits screen. At this screen press the spacebar and you will be presented with a menu. Press the number 1 on your keyboard and press enter. At the next screen simply press the spacebar on your computer to start the removal process.

Note: Please note that when the program starts it will download a program from the Internet that it needs to use during the cleanup. If your firewall gives an alert about this, please allow the download.exe or run.bat program to access the Internet.

When the program starts, your desktop will disappear, which is normal, so please do not be concerned. It will then start the SpywareQuake uninstallation program. When that program starts, click on the Uninstall button. When it has finished uninstalling, you can then press the OK button to finish the uninstalling of SpywareQuake.

When this program is finished, and it was able to delete all the files, you will see a small prompt that says Completed script execution. Simply press the OK button. It will then open the Brute Force Uninstaller program. Close this by press ing the Exit button. If there a notepad open called task.txt, you can close that as well. Now continue to Step 11.

If there were more files that needed to be deleted, the program will prompt you to reboot your computer. Press the Yes button and allow the computer to reboot. When you are back at the desktop, close the task.txt notepad if it is open, and proceed to Step 11.

11. Go to this page and click on the smitRem Download Link to download smitRem.exe. When downloading smitRem.exe save it to your desktop.

12. Double-click on the smitRem.exe file.

Click on the Start button and the program will start extracting the files into a folder on your desktop called smitRem. When it is finished, click on the OK button. If you look on your desktop you will now see a folder called smitRem.

13. Next, please reboot your computer into Safe Mode by doing the following:

1. Restart your computer

2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.

3. Instead of Windows loading as normal, a menu should appear

4. Select the first option, to run Windows in Safe Mode.

5. When you are at the logon prompt, log in as an Administrator

14. When your computer has started in safe mode and you see the desktop.

15. Close all open Windows.

16. Open the smitRem folder on your desktop. Double-click on the RunThis.bat file

17. When the tool starts you will see a series of screens with information on them. Read each screen, and when you are finished reading it, simply press any key on your keyboard. After reading the various screens that appear, the program will start the removal process.

If there is an uninstaller present for an infection that smitRem removes it will start this uninstaller.

Simply click on the Uninstall button and allow the uninstaller to finish. When it is completed, it will close automatically and smitRem will prompt you to continue. Now you should press any key to continue.

When no more uninstallers can be found, the tool will continue. Your desktop will disappear and you will start seeing text scroll across the screen. This is normal and nothing to be concerned about. When smitRem has finished running it will automatically start the Disk Cleanup program
This program will remove all Temp, Temporary Internet Files, and empty your Recycle Bin in order to remove any leftover files installed by this infection. This process can take up to a few hours depending on your computer, so please be patient. When it is complete, it will close automatically and you will be back at your desktop.

18. When the tool is finished, it will will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or the partition where your operating system is installed. Examining that log should show that the infection was cleaned.

19. Reboot your computer back to normal mode.

Now run a new HJT scan and post the log here.

[jholland1964]

Go ahead to the smitrem and follow those directions. Don't worry about the roguescan. Follow the directions beginning with the smitrem and then we will see where things stand.
Judy

[Pokey86]

OK i ran smitrem & also after running that Rogue scan worked, so i ran that also (On normal mode)

Here is the new HJT log, & thanks for the help.

[jholland1964]

Hi Pokey86,
Give me a bit to check out your newest log and I will get back to you ASAP.
Judy