Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Automatic updates turning off and pop ups! [RESOLVED]

Started by skywitit23 , Jul 05 2008 02:44 AM

  • This topic is locked This topic is locked

#1
skywitit23
Posted 05 July 2008 - 02:44 AM

skywitit23

    New Member

  • Member
  • Pip
  • 7 posts
Heys guys all the sudden my automatic updates are turning off and im getting aton or pop ups like crazy..I have a log from combo fix, i dunno what you guys do with it but here it is. plz guys i hope you can help me, cause i really dont know what im doing, im alittle rusty in this type of computering, so more detail is helpfull.

ComboFix 08-07-04.3 - Jonah & Elizabeth 2008-07-05 4:00:36.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.609 [GMT -4:00]
Running from: C:\Documents and Settings\Jonah & Elizabeth\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jonah & Elizabeth\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\avunculx.dll
C:\WINDOWS\system32\BKknmnmp.ini
C:\WINDOWS\system32\BKknmnmp.ini2
C:\WINDOWS\system32\ecbvmo.dll
C:\WINDOWS\system32\fdxmcrnc.dll
C:\WINDOWS\system32\gmwtbkgu.ini
C:\WINDOWS\system32\iiffeBUn.dll
C:\WINDOWS\system32\kbgoen.dll
C:\WINDOWS\system32\khjfabqf.ini
C:\WINDOWS\system32\kwtdadao.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\oadadtwk.dll
C:\WINDOWS\system32\pmnmnkKB.dll
C:\WINDOWS\system32\pmnnKASk.dll
C:\WINDOWS\system32\qmvqgdvs.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 )))))))))))))))))))))))))))))))
.

2008-07-04 03:15 . 2008-07-04 03:15 <DIR> d-------- C:\Program Files\Lavasoft
2008-07-04 03:15 . 2008-07-04 03:15 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-04 02:57 . 2008-07-04 02:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-04 02:50 . 2008-07-04 02:50 <DIR> d-------- C:\Documents and Settings\Jonah & Elizabeth\Application Data\McAfee
2008-07-04 02:46 . 2008-07-04 02:46 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-07-03 23:03 . 2008-07-05 04:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-03 23:03 . 2008-07-03 23:03 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-03 21:24 . 2008-07-03 21:24 1,694,256 --ahs---- C:\WINDOWS\system32\gmwtbkgu.tmp
2008-06-10 16:16 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-10 16:16 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-06-05 00:29 . 2008-06-05 00:30 <DIR> d-------- C:\Program Files\LimeWire

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-05 07:17 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-04 07:47 --------- d-----w C:\Program Files\Common Files\Webroot Shared
2008-07-04 07:03 --------- d-----w C:\Program Files\McAfee
2008-07-04 06:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-07-04 04:31 --------- d-----w C:\Program Files\Windows Live
2008-07-03 01:36 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Apple Computer
2008-06-29 22:11 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Azureus
2008-06-29 20:43 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-06-27 04:25 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\LimeWire
2008-06-17 21:18 --------- d-----w C:\Program Files\Azureus
2008-06-13 11:05 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-03 17:27 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-29 22:15 --------- d-----w C:\Program Files\Apple Software Update
2008-05-29 16:56 --------- d-----w C:\Program Files\MagicISO
2008-05-29 16:55 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-05-29 16:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-29 16:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-29 16:42 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Media Player Classic
2008-05-29 16:31 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-05-29 16:28 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-29 16:28 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\DAEMON Tools
2008-05-29 16:18 --------- d-----w C:\Program Files\ImgBurn
2008-05-29 16:18 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\ImgBurn
2008-05-23 06:14 --------- d-----w C:\Program Files\AWS
2008-05-23 06:14 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\WeatherBug
2008-05-23 06:10 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Viewpoint
2008-05-23 06:04 --------- d-----w C:\Program Files\iTunes
2008-05-23 06:04 --------- d-----w C:\Program Files\iPod
2008-05-23 06:03 --------- d-----w C:\Program Files\QuickTime
2008-05-23 06:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-23 06:01 --------- d-----w C:\Program Files\Common Files\Apple
2008-05-23 06:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-23 05:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Webroot
2008-05-23 05:45 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\MSN6
2008-05-23 05:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
2008-05-23 05:34 --------- d-----w C:\Program Files\Diskeeper Corporation
2008-05-23 05:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation
2008-05-23 05:23 --------- d-----w C:\Program Files\McAfee.com
2008-05-23 05:23 --------- d-----w C:\Program Files\Common Files\McAfee
2008-05-23 05:12 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-05-23 05:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-05-23 05:00 --------- d-----w C:\Program Files\AIM6
2008-05-23 05:00 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\acccore
2008-05-23 04:59 --------- d-----w C:\Program Files\Viewpoint
2008-05-23 04:59 --------- d-----w C:\Program Files\Common Files\AOL
2008-05-23 04:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-05-23 04:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2008-05-23 04:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-05-23 04:57 --------- d-----w C:\Program Files\Java
2008-05-23 04:56 --------- d-----w C:\Program Files\Common Files\Java
2008-05-23 02:57 --------- d-----w C:\Program Files\Webroot
2008-05-23 02:57 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Webroot
2008-05-23 02:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-23 02:48 --------- d-----w C:\Program Files\Creative
2008-05-23 02:48 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Creative
2008-05-23 02:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2008-05-23 02:38 --------- d-----w C:\Program Files\Analog Devices
2008-05-23 02:36 --------- d-----w C:\Program Files\Intel
2008-05-23 02:02 558,142 ----a-w C:\WINDOWS\java\Packages\E607ZH7Z.ZIP
2008-05-23 02:02 155,995 ----a-w C:\WINDOWS\java\Packages\NDBNNLVL.ZIP
2008-05-23 02:02 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-16 15:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-14 09:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 09:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 09:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 299,520 ----a-w C:\WINDOWS\system32\drmclien.dll
2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 21:00 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:27 2,188,928 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31 2,065,792 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14 76,800 ----a-w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll
2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Window Washer"="C:\Program Files\Webroot\Washer\wwDisp.exe" [2007-11-26 14:47 1206600]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-03-25 16:21 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"Weather"="C:\Program Files\AWS\WeatherBug\Weather.exe" [2007-08-29 10:55 1347584]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 05:39 486856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-04-04 13:38 774144]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
"CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-20 01:00 28672]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-02-24 09:32 5537792]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-02-24 09:32 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-11-30 05:42 1164576]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 13:59 4838952]
"MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 05:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"nwiz"="nwiz.exe" [2005-02-24 09:32 1495040 C:\WINDOWS\system32\nwiz.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= C:\WINDOWS\System32\ctmp3.acm
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
R2 wwEngineSvc;Window Washer Engine;C:\Program Files\Webroot\Washer\WasherSvc.exe [2007-11-26 14:47]

.
Contents of the 'Scheduled Tasks' folder
"2008-07-03 02:14:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-23 05:23:22 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-07-01 05:00:06 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{01667648-9237-4a62-a863-6120f5842639} - C:\WINDOWS\system32\kbgoen.dll
BHO-{427B37EF-B6C5-4823-A97C-10B88977E398} - C:\WINDOWS\system32\pmnnKASk.dll
BHO-{7D162D68-AD16-49EF-9BD6-0C29525D53EC} - C:\WINDOWS\system32\pmnmnkKB.dll
HKLM-Run-84578c55 - C:\WINDOWS\system32\oadadtwk.dll
HKLM-Run-TCASUTIEXE - TCAUDIAG.exe
ShellExecuteHooks-{427B37EF-B6C5-4823-A97C-10B88977E398} - C:\WINDOWS\system32\pmnnKASk.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 04:08:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&3?????\??? ??? ???\???\???????????5?B~e?B~\???\?????????a??????C@?\???\??????s????\??????s\????&3?A??s?&3??C@?x???`|?w\?????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\SETUPAPI.dll
-> ?:\WINDOWS\System32\msvcp60.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-07-05 4:10:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-05 08:10:45

Pre-Run: 141,152,575,488 bytes free
Post-Run: 141,100,892,160 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

262 --- E O F --- 2008-07-05 07:26:57
  • 0

Advertisements

#2
Essexboy
Posted 05 July 2008 - 01:29 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
If you stop posting multiple topics we may get round to you

Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    C:\WINDOWS\system32\gmwtbkgu.tmp
Purity
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

THEN

Lets try the Automated Windows Update Fix from Castlecops
  • Download WUFix.zip and unzip to your desktop.
  • Double-Click WUFix.bat to run fix.
  • You will see a window open and commands processing. When the window closes the fix will have completed.
  • Restart the computer.
This fix will clear the proxy cache, places Windows Update sites in the Trusted Zone, places Windows Update sites in the exception list of IE Popup Blocker, starts all dependent services, registers required DLLS, empties the Windows Update temporary folder (with backup), renames the catroot2 folder, retains update history and Event log, and deletes BITS pending download queue.

Once done, go back to the Windows Update Website (You must use the Microsoft Internet Explorer to do this). Check your history to see if the update is already installed.

FINALLY FOR NOW

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Logs required : OTMoveit, MBAM and a new Hijackthis log
  • 0

#3
skywitit23
Posted 06 July 2008 - 05:13 PM

skywitit23

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Okay heres OTMove It

File/Folder C:\WINDOWS\system32\gmwtbkgu.tmp not found.
< Purity >

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07062008_191158




MBAM

Malwarebytes' Anti-Malware 1.19
Database version: 927
Windows 5.1.2600 Service Pack 3

7:07:36 PM 7/6/2008
mbam-log-7-6-2008 (19-07-36).txt

Scan type: Quick Scan
Objects scanned: 40825
Time elapsed: 10 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

It didnt ask me to to delete anything so i guess there nothing theeir anymore?
  • 0

#4
Essexboy
Posted 07 July 2008 - 12:48 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Does windows update work and are you experiencing any more symptoms ?
  • 0

#5
skywitit23
Posted 10 July 2008 - 05:30 PM

skywitit23

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Yeah updates work, no more pops up so i guess everything is okay.. Is there anything i should run weekly for this not to happen again?

Thanks alot tho buddy. :)
  • 0

#6
Essexboy
Posted 11 July 2008 - 09:20 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Now the best part of the day ----- Your log now appears clean :)

Double click OTMoveIt2 once again and you should see a CleanUp! button, press that button, you may get prompted by your firewall that OTMoveIt2 wants to contact the internet, allow this, a cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself


Now to get you off to a good start we will re-set your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your your restore point but this is my method:

1. Select Start > All Programs > Accessories > System tools > System Restore.
2. On the dialogue box that appears select Create a Restore Point
3. Click NEXT
4. Enter a name e.g. Clean
5. Click CREATE

You now have a clean restore point, to get rid of the bad ones:

1. Select Start > All Programs > Accessories > System tools > Disk Cleanup.
2. In the Drop down box that appears select your main drive e.g. C
3. Click OK
4. The System will do some calculation and the display a dialogue box with TABS
5. Select the More Options Tab.
6. At the bottom will be a system restore box with a CLEANUP button click this
7. Accept the Warning and select OK again, the program will close and you are done



Now that you are clean, to help protect your computer in the future I recommend that you get the following free program: It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?


Keep safe :)
  • 0

#7
Essexboy
Posted 12 July 2008 - 07:09 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP