[ykanaa1]

For some reason these programs won't open in normal boot but can open and run in safe boot.

Also, I can't run streaming videos from IE. It will play 1 sec of the vid then close IE.

What do you guys think?

[Advertisements]

This is just a hunch, but I know some viruses/trojans can block known programs from running. Maybe Safe Mode went around this?

Try renaming those programs in Normal Mode and then run it. For example, rename Ad-aware.exe to something like Ad-aware1.exe and run it. If that works, then there's definitely something working behind the scenes.

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro http://uk.trendmicro...call_launch.php. Just follow the instructions on the site to run the online scan. If any viruses/trojans are detected, try to delete or clean them in that site. You may use Panda ActiveScan also at http://www.pandasoft...ucts/activescan. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

[greyknight17]

This is just a hunch, but I know some viruses/trojans can block known programs from running. Maybe Safe Mode went around this?

Try renaming those programs in Normal Mode and then run it. For example, rename Ad-aware.exe to something like Ad-aware1.exe and run it. If that works, then there's definitely something working behind the scenes.

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro http://uk.trendmicro...call_launch.php. Just follow the instructions on the site to run the online scan. If any viruses/trojans are detected, try to delete or clean them in that site. You may use Panda ActiveScan also at http://www.pandasoft...ucts/activescan. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

[ykanaa1]

For some reason I cannot run live update either, even in safe boot w/ networking.

Nevertheless, I ran norton and trend housecall and got nothing. I will run panda and let you know.

thanks

[greyknight17]

Have you tried renaming the main executable file? I know some infections will block the known anti-spyware/antivirus programs and renaming it does help.

OK, post the followup on panda when you are done.

[ykanaa1]

I renamed Ad-aware, spyware doctor and Norton and only ad-aware fully worked, spyware ran but had some errors, and norton gave me nothing. I am able to run all of them in safe boot, but they are not finding anything.

I am running Panda and I will give you the followup on it...

ps - I am in medical school right now, and you guys are truly drs of the pc.

Thanks so far for all the help.

[ykanaa1]

the Panda Results are attached:

Attached Files

•  Activescan.txt   8.08KB   646 downloads

[greyknight17]

OK, delete these files in Safe Mode:

C:\WINDOWS\System32\flsmngr.dll
C:\WINDOWS\System32\unicoa10.exe
C:\WINDOWS\System32\wmplayer.exe
C:\WINDOWS\System32\thun32.dll
C:\WINDOWS\pagjfwu.exe
C:\WINDOWS\system32\flsmngr.dll
C:\WINDOWS\system32\thun.dll
C:\WINDOWS\system32\thun32.dll
C:\WINDOWS\system32\unicoa10.exe
C:\WINDOWS\system32\vyismaaa.exe
C:\WINDOWS\system32\wmplayer.exe
C:\WINDOWS\system32\wrljkiru.exe
C:\WINDOWS\wjfbkyc.exe
D:\Programs\Programs\NOCD-Drives\Alcohol120\Cracks.zip[alcohol120v1.4.6build711trialcrackfff.zip][FFF-ALCOHOL.120.V1.4.6.(BUILD.711)-TRIAL_CRK.RAR][crack.exe]

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/Cleanup.exe ) and install it. Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Restart. Will the programs work now?

[smartXP]

the Panda Results are attached:

This looks like you visited *evil* websites and downloaded some inoculated software.
You should delete the infected files as recommended by greyknight17.
This will save you this time, for the future I strongly recommend to be aware of what downloading ;-)

To be honest, a good virus scanner should have saved you in advance of those malware. Think about it!

[ykanaa1]

OK, delete these files in Safe Mode:

C:\WINDOWS\System32\flsmngr.dll                 
C:\WINDOWS\System32\unicoa10.exe   
                                                                                                                                                        C:\WINDOWS\System32\wmplayer.exe                                                                                                                                                                                                                               
C:\WINDOWS\System32\thun32.dll                                                                                                                                                                                                                                 
C:\WINDOWS\pagjfwu.exe                                                                                                                                                                                                                                         
C:\WINDOWS\system32\flsmngr.dll                                                                                                                                                                                                                               
C:\WINDOWS\system32\thun.dll                                                                                                                                                                                                                                   
C:\WINDOWS\system32\thun32.dll                                                                                                                                                                                                                                 
C:\WINDOWS\system32\unicoa10.exe                                                                                                                                                                                                                               
C:\WINDOWS\system32\vyismaaa.exe                                                                                                                                                                                                                               
C:\WINDOWS\system32\wmplayer.exe                                                                                                                                                                                                                               
C:\WINDOWS\system32\wrljkiru.exe                                                                                                                                                                                                                               
C:\WINDOWS\wjfbkyc.exe                                                                                                                                                                                                                                                 
D:\Programs\Programs\NOCD-Drives\Alcohol120\Cracks.zip[alcohol120v1.4.6build711trialcrackfff.zip][FFF-ALCOHOL.120.V1.4.6.(BUILD.711)-TRIAL_CRK.RAR][crack.exe]   

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there.  Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/Cleanup.exe ) and install it.  Run CleanUp! and click on CleanUp! button.  When it asks you if you want to logoff, click on Yes.

Restart.  Will the programs work now?

I deleted everything except for flsmngr.dll, windows did not allow it to delete.

Ran clean sweep.

reboot - windows error occurred (blue screen during startup)

started again and windows ran.

Still not working.

[greyknight17]

OK, it's probably malware or a virus that's doing this.

I want you to go here and then read the sticky ...before posting a HijackThis log... and then create a new topic and post your HijackThis log there. If you want, PM me the link to your thread so that it won't get lost there. I will take a look at it.

[starjax]

ok greyknight, he posted up his hjt log in the malware forum:

http://www.geekstogo...37&t=19318&st=0

[ykanaa1]

Here it is. The latest is posted on the bottom of the page.

http://www.geekstogo...326

[greyknight17]

Thanks starjax.

ykanaa1, I posted a reply there. No need to reply here anymore.

[vertabrett]

Gray Knight 17, great suggestion.

Found you using a Google search for Spybot won't start. Renamed it to spybotSDs.exe, and voila, behold the glory of the best spyware killing application.

I will remember your website and your 13000th post. Very helpful.

Best Regards,
-Brett