Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Help!


  • Please log in to reply

#16
blueraider

blueraider

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
I uninstalled then reinstalled Firefox. It was working fine but now it crashes every time. Here are the details:

Add-ons: {3112ca9c-de6d-4884-a869-9855de68056c}:3.1.20081127W,{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}:6.0.05,{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}:6.0.03,[email protected]:1.0.0.07103010,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8
BuildID: 2009032609
CrashTime: 1239196793
InstallTime: 1238418719
ProductName: Firefox
SecondsSinceLastCrash: 4283
StartupTime: 1239196188
Theme: classic/1.0
URL: http://www.weather.c...opnav_allergies
Vendor: Mozilla
Version: 3.0.8

This report also contains technical information about the state of the application when it crashed.
  • 0

Advertisements


#17
BHowett

BHowett

    OT Moderator

  • Moderator
  • 4,649 posts
Hi blueraider,

Lets get another look at some things,

ATF Cleaner

Re-run ATF cleaner that I already had you download…

[/b]Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

===============================================

Malwarebytes' Anti-Malware

Re-run MBAM that I had you download….

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

===============================================

And lets get another scan…

Kaspersky WebScanner
please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply. Along with the fresh MBAM log

  • 0

#18
blueraider

blueraider

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Here's Malware:

Malwarebytes' Anti-Malware 1.36
Database version: 1954
Windows 5.1.2600 Service Pack 2

4/8/2009 6:22:35 PM
mbam-log-2009-04-08 (18-22-35).txt

Scan type: Quick Scan
Objects scanned: 79283
Time elapsed: 5 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Kaspersky:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, April 8, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, April 09, 2009 01:37:24
Records in database: 2024005
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 88053
Threat name: 3
Infected objects: 3
Suspicious objects: 0
Duration of the scan: 01:49:13


File name / Threat name / Threats count
C:\Program Files\Trend Micro\Internet Security\Quarantine\urqNDTNh.dll Infected: Trojan.Win32.Pakes.mmg 1
C:\_OTMoveIt\MovedFiles\04072009_112300\Program Files\Trend Micro\Internet Security\Quarantine\8AB.tmp Infected: Trojan-Downloader.WMA.GetCodec.i 1
C:\_OTMoveIt\MovedFiles\04072009_112300\Program Files\Trend Micro\Internet Security\Quarantine\FCB.tmp Infected: not-a-virus:AdWare.Win32.Agent.hzg 1

The selected area was scanned.
  • 0

#19
BHowett

BHowett

    OT Moderator

  • Moderator
  • 4,649 posts
Hello again,

Please navigate to below folder and delete everything inside.. Don't delete the folder itself.. Just leave it empty.. After that, please empty your Recycle Bin..

C:\Program Files\Trend Micro\Internet Security\Quarantine

after that your log appears clean :)

Now lets uninstall Combofix:
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /u, it needs to be there.
    Posted Image

===============================================

Click Here to download OTCleanIt
Double-click OTCleanIt.exe to run it.
Click the Clean up button
Click Yes to the reboot.

Now delete any logs that you have left over on your desktop.

===============================================

For some useful tips on staying clean, along with links to some freeware to help, have a look at this page.

To find out more information about how you got infected in the first place, you can read this article.

===============================================

Follow this list and your potential for being infected again will reduce dramatically.

let me know if you can't get FF working after that, I may have to refer you to the tech's as you are now clean of malware?
  • 0

#20
blueraider

blueraider

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Everything worked great except I wasn't able to move one of the files to the recycle bin. The file is urqNDTNh.dll and it days access is denied.
  • 0

#21
BHowett

BHowett

    OT Moderator

  • Moderator
  • 4,649 posts
I don't use Trend Micro so I'm not 100% familiar with it, do you have a button that say remove Quarantine or delete Quarantine? see if you can get rid of it like that. its not hurting as it is in Quarantine, but I would still like to get rid of it as its part of vundo infection.
  • 0

#22
BHowett

BHowett

    OT Moderator

  • Moderator
  • 4,649 posts
this is what i found on the Trend Micro site....

Files tagged for quarantine are encrypted and moved to a protected folder, preventing them from further executing and causing any more harm to the user's system. Each product has a Quarantine Manager where users can then permanently delete or restore files from quarantine.


so you should have a Quarantine Manager wheere you can delete it?
  • 0

#23
blueraider

blueraider

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
I just looked in the quarantinein the actual program and there's nothing in there. But it's still in the file.
  • 0

#24
BHowett

BHowett

    OT Moderator

  • Moderator
  • 4,649 posts
its still at this path C:\Program Files\Trend Micro\Internet Security\Quarantine\urqNDTNh.dll correct?
  • 0

#25
blueraider

blueraider

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Yes.
  • 0

Advertisements


#26
BHowett

BHowett

    OT Moderator

  • Moderator
  • 4,649 posts
we will get rid of it one way or another :)

1) Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

2) Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.

3) Once in Safe Mode, please run Killbox.

4) Select "Delete on Reboot".

5) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\Program Files\Trend Micro\Internet Security\Quarantine\urqNDTNh.dll

6) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

7) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again..

Let the system reboot.


after that let know how it goes :)
  • 0

#27
blueraider

blueraider

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
That got it.
  • 0

#28
BHowett

BHowett

    OT Moderator

  • Moderator
  • 4,649 posts
Thats what I like to hear, good job :) if everything is running good we are good to go. Any problems or questions?
  • 0

#29
blueraider

blueraider

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
That seems to do it. I do have a couple of questions. How do I remove killbox? Should I download SP3?
  • 0

#30
BHowett

BHowett

    OT Moderator

  • Moderator
  • 4,649 posts
you can just delete killbox, and you keep your service packs up to date :)
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP