last topic

if its not too much problem could i ask you to write a detailed list for my step dad to look threw saying that P2P problems are bad cus i cant stop him to install it and everytime he does the computer keeps popping up internet.

so if u have time please do

Hi janne932,

"janne932" wrote: The bittorrent was not my idea for once because my step dad wants to keep downloading but he dosent even listen to the professionals that its bad for the computer.

There are a number of very nasty infections being spread at this time that are becoming increasingly difficult to remove. As previously stated, anyone using P2P software should expect to become infected. Please make sure that your Step-Dad understands that continued use of P2P software could turn this computer into an expensive doorstop. He should also understand that, having been warned about the risks of using P2P software, we may choose to decline to help disinfect this computer in the future if it becomes re-infected as a result of having used P2P software.


Please print these instructions because you will not have access to the Internet while performing some of the tasks below.

1. Create a System Restore Point
   
   1. Go to Start, right-click on Computer and select Properties.
   2. In the left pane under Tasks, click System protection.
   3. If UAC prompts for an administrator password or approval, type the password or give your "permission to continue".
   4. Select System Protection ...then choose Create.
   5. In the System Restore dialog box, type a description for the restore point (e.g., Before BitTorrent removal) and click Create again.
   6. A window should pop up with "The Restore Point was created successfully" message.
   7. Click OK and close the System Restore dialog.
      
      Note: If the message window was not displayed stating that the system restore point was created successfully then STOP - Do not continue with the steps below but rather reply to let me know what happened.
   
   
   
2. Remove Programs Using Control Panel
   
   1. Click Start > Control Panel and then click on Programs and Features.
   2. For each program below, if it exists in the list of installed applications, right-click the Entry, choose Uninstall/Change, and give permission to Continue:
      
      Babylon toolbar on IE
      BitTorrent
      
      Take extra care in answering questions posed by any Uninstaller.
   
   
   
3. Perform a Custom Fix with OTL
   
   1. Close all running applications.
   2. Right-click the OTL icon on your Desktop and select Run As Administrator to run the program.
   3. In the Custom Scans/Fixes box at the bottom, paste in the following lines from the Code box (Do not include the word "Code"):
      

      
      
      :OTL
      
      CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
      
      O3 - HKU\S-1-5-21-1184369744-1170133325-3825712106-1001\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found. 
      
      FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
      
      FF - prefs.js..keyword.URL: "http://search.babylon.com/?AF=109130&babsrc=adbartrp&mntrId=4aeb23da000000000000402cf4088d1b&q="
      
      FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
      
      FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
      
      FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?AF=109130&babsrc=HP_ss&mntrId=4aeb23da000000000000402cf4088d1b"
      
      O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
      
      O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
      
      
      
      :Files
      
      C:\Program Files (x86)\BitTorrent
      
      C:\Users\NFC\AppData\Roaming\BitTorrent
      
      C:\Users\NFC\AppData\Local\uTorrent
      
      C:\Users\Public\Desktop\BitTorrent.lnk
      
      C:\Users\NFC\AppData\Roaming\mozilla\Firefox\Profiles\6n02iup0.default\extensions\[redacted]
      
      C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
      
      C:\Program Files (x86)\BabylonToolbar
      
      C:\Users\NFC\AppData\Local\Babylon
      
      C:\Users\NFC\AppData\Roaming\Babylon
      
      C:\ProgramData\Babylon
      
      
      
      :Commands
      
      [EMPTYTEMP]
      
      [CREATERESTOREPOINT]
      
      
      
      

   4. Close all running applications other than OTL.
   5. Click the Run Fix button at the top.
   6. Let the program run unhindered and reboot the PC when it is done.
   7. When the computer Reboots, and you start your usual account, a Notepad text file will appear.
   8. Copy the contents of that file and post it in your next reply. The log can also be found, based on the date/time it was created, as C:\_OTL\MovedFiles\MMDDYYYY_HHMMSS.log.

Please include in your reply:

1. The text of any error messages and/or a description of any problems you encountered while performing these steps.
2. The contents of the OTL Fix log.
3. Please let me know if you are experiencing any problems which require our attention.

mambass

i had no errors while doing this, all worked out fine.

All processes killed
========== OTL ==========
File C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.
Registry value HKEY_USERS\S-1-5-21-1184369744-1170133325-3825712106-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename
Prefs.js: "http://search.babylon.com/?AF=109130&babsrc=adbartrp&mntrId=4aeb23da000000000000402cf4088d1b&q=" removed from keyword.URL
Prefs.js: "Search the web (Babylon)" removed from browser.search.selectedEngine
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: "http://search.babylon.com/?AF=109130&babsrc=HP_ss&mntrId=4aeb23da000000000000402cf4088d1b" removed from browser.startup.homepage
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
File C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ not found.
File C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll not found.
========== FILES ==========
File\Folder C:\Program Files (x86)\BitTorrent not found.
File\Folder C:\Users\NFC\AppData\Roaming\BitTorrent not found.
File\Folder C:\Users\NFC\AppData\Local\uTorrent not found.
File\Folder C:\Users\Public\Desktop\BitTorrent.lnk not found.
File\Folder C:\Users\NFC\AppData\Roaming\mozilla\Firefox\Profiles\6n02iup0.default\extensions\[redacted] not found.
File\Folder C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml not found.
File\Folder C:\Program Files (x86)\BabylonToolbar not found.
File\Folder C:\Users\NFC\AppData\Local\Babylon not found.
File\Folder C:\Users\NFC\AppData\Roaming\Babylon not found.
File\Folder C:\ProgramData\Babylon not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NFC
->Temp folder emptied: 69332227 bytes
->Temporary Internet Files folder emptied: 1140538415 bytes
->Java cache emptied: 3971 bytes
->FireFox cache emptied: 31619565 bytes
->Google Chrome cache emptied: 6726328 bytes
->Flash cache emptied: 6573 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 81934 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 66867 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,191.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.31.0 log created on 01082012_203250

Files\Folders moved on Reboot...
C:\Users\NFC\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...


and i'm not experiencing any more problems what so ever so ty.

Hi janne932,

"janne932" wrote: i'm not experiencing any more problems what so ever so ty.

You're welcome.

"janne932" wrote: if its not too much problem could i ask you to write a detailed list for my step dad to look threw saying that P2P problems are bad cus i cant stop him to install it and everytime he does the computer keeps popping up internet.

Please ask your Step-Dad to read our reasons for requiring P2P software to be removed before we will work on a computer here and the InfoWorld article referenced therein. He may also be interested in reading How to Prevent the Online Invasion of Spyware and Adware.

You're logs are looking good so far. Let's get two more scans to make sure there's nothing else lingering out there. After that it's important that you come back so we can do some things to help you to keep from getting infected again.

1. Download and run Malwarebytes Anti-Malware (Free for non-business use)
   
   1. Please hold down Ctrl then click here to open a new Malwarebytes window and then click on Download in the Free column.
   2. If a c/net download page is displayed then click on Download Now whereas if a Major Geeks page is displayed click on the Official Mirror button. In either case save the installer to your Desktop.
      
   3. You should now have a desktop icon named mbam-setup-(version).exe. (If the download was saved somewhere else, locate it and copy or move it to your desktop).
   4. Right click it, choose Run as administrator and Continue
   5. Let it install where it wants to, with the default settings, and click Finish.
   6. If an update is found, it will download and install the latest version. A shield symbol will show on the desktop icon while it is updating, and will disappear when it's done.
   7. If necessary, start Malwarebytes Anti-Malware again.
      (You can Decline any Offer for a Trial if you don't want the paid version)
   8. Once the program has started up, select Perform Quick Scan, then click Scan.
   9. When the scan is complete, click OK, then Show Results to view the results.
   10. If it found any malware items, check all items except items in the C:\System Volume Information folder... and click Remove Selected.
   11. When completed, a log will open in Notepad. Please save it to a convenient location, and post the contents in your reply.
   12. The log can also be found using the "Logs" tab in the program. You can click any "Scan" log listed to open its contents. The logs are listed and named by time/date stamp.
   
   
   
2. ESET online scannner
   
   Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
   
   1. Please disable your AVG 2012 antivirus as shown in How To Disable Individual AVG Components.
   2. Hold down Ctrl then click on the following link to open a new window to ESET online scannner
      
      • If Internet Explorer is being used then check Yes, I accept the Terms of Use and then click the Start button.
        Allow the ESET Scanner Active-X component to be installed if asked and click the Retry button if prompted to restart the download.
        
        
      • If a browser other than Internet Explorer is being used then click the esetsmartinstaller_enu.exe link and save the installer to your Desktop.
        Right-click on the installer and select Run As Administrator to run it.
        Check Yes, I accept the Terms of Use and click the Start button.
        
   3. Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
   4. Now click on Advanced Settings and select the following:
      • Scan for potentially unwanted applications
      • Scan for potentially unsafe applications
      • Enable Anti-Stealth Technology
   5. Now click on Start.
   6. The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
   7. When completed the Online Scan will begin automatically.
   8. Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
   9. When completed, do not check (tick) Uninstall application on close.
   10. Now click on Finish.
   11. Use notepad to open the logfile located at C:\Program Files (x86)\ESET\EsetOnlineScanner\log.txt .
   12. Copy and paste that log as a reply to this topic.
   13. Re-enable your Antivirus software.

Please include in your reply:

1. The text of any error messages and/or a description of any problems you encountered while performing these steps.
2. The contents of the Malwarebytes log.
3. The contents of the ESET log.

mambass

i'll post the logs as fast as i can its just that the problem is still running somewere in my computer because i had some problems yesterday without any P2P programs installed

Hi janne932,

"janne932" wrote:the problem is still running somewere in my computer because i had some problems yesterday without any P2P programs installed

When you post the logs, please also describe in detail the problems that you are experiencing.

Thanks!

mambass

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK




Malwarebytes Anti-Malware 1.60.0.1800
http://www.malwarebytes.org

Databasversion: v2012.01.10.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
NFC :: NFC-HP [administratör]

2012-01-10 14:43:50
mbam-log-2012-01-10 (14-43-50).txt

Skanningstyp: Snabbskanning
Aktiverade skanningsalternativ: Minne | Start | Register | Filsystem | Heuristik/Extra | Heuristik/Shuriken | PUP | PUM
Inaktiverade skanningsalternativ: P2P
Antal skannade objekt: 175047
Förfluten tid: 3 minut(er), 7 sekund(er)

Upptäckta minnesprocesser: 0
(Inga skadliga poster hittades)

Upptäckta minnesmoduler: 0
(Inga skadliga poster hittades)

Upptäckta registernycklar: 0
(Inga skadliga poster hittades)

Upptäckta registervärden: 0
(Inga skadliga poster hittades)

Upptäckta registerdataposter: 0
(Inga skadliga poster hittades)

Upptäckta mappar: 0
(Inga skadliga poster hittades)

Upptäckta filer: 0
(Inga skadliga poster hittades)

(klar)


the problem is that after the computer has been on for a while, internet explorer starts popping up by its own if you use the keyboard.
i've seen alot of people having similar problems with laptops and i dont know if it has something to do with it overheating or not.


PS: i did not find any more in the eset log than that but it found 2 threats although i cant remember them :S

Hi janne932,

Let's try the ESET scan again with slightly different instructions.

1. ESET online scanner
   
   Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
   
   1. Please disable your AVG 2012 antivirus as shown in How To Disable Individual AVG Components.
   2. Hold down Ctrl then click on the following link to open a new window to ESET online scannner
      
      • If Internet Explorer is being used then check Yes, I accept the Terms of Use and then click the Start button.
        Allow the ESET Scanner Active-X component to be installed if asked and click the Retry button if prompted to restart the download.
        
        
      • If a browser other than Internet Explorer is being used then click the esetsmartinstaller_enu.exe link and save the installer to your Desktop.
        Right-click on the installer and select Run As Administrator to run it.
        Check Yes, I accept the Terms of Use and click the Start button.
        
   3. Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
   4. Now click on Advanced Settings and select the following:
      • Scan for potentially unwanted applications
      • Scan for potentially unsafe applications
      • Enable Anti-Stealth Technology
   5. Now click on Start.
   6. The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
   7. When completed the Online Scan will begin automatically.
   8. Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
   9. When the scan completes, press the text:
   10. Press the text: and then save the file to your Desktop as ESETScan.txt.
   11. Press the [Back] button and then press the [Finish] button.
   12. Copy and paste the contents of ESETScan.txt in your next reply.
       Note: If no threats are found, there is no option to create a log. Just report back to me there was nothing found.
   13. Re-enable your Antivirus software.
   
   
   
2. Questions related to new behavior
   I need to gain a better understanding of the new behavior involving Internet Explorer.
   
   1. Is there already an Internet Explorer window open when the new windows start to appear?
   2. What is displayed in the new windows that open?
   3. What are you doing with the keyboard when the new windows open (i.e., are you typing in the browser window or some other application)?
   4. Where have you seen other people having this problem? Do you know how they resolved the issue?
   5. Have you ever seen this behavior on this computer before?

Please include in your reply:

1. The text of any error messages and/or a description of any problems you encountered while performing these steps.
2. The contents of the ESET log.
3. The answers to my questions about the new behavior.

mambass

Hi janne932,

It's been 72 hours since I posted my instructions. I just wanted to remind you that, per Forum policy here, this thread may now be closed.

Could you please let me know if you still need help and, if so, if you require additional time to perform the requested tasks?

Thank you.

mambass

still need the help and sorry for not letting you know that it would take some time i will post the log as quick as i can

Hi janne932,

It's been almost a week since I posted my last instructions here.

If you cannot post the requested log within the next 24 hours then this thread will be closed. If that happens, please feel free to start a new thread at a time when you are in a position to post timely replies and include new DDS.txt and Attach.txt logs in the initial post along with a description of the problems that you are experiencing.

Thank you.

mambass

i have had alot to do at home right now so sorry for not relpying at all but it seems like the problem has been solved anyways so feel free t close the topic and archive it.

Thanks for all your help and hope i wont come back

Hi janne932,

"janne932" wrote: Thanks for all your help and hope i wont come back

You're welcome and I'll pass that on to the Teacher who helped me with your logs. I doubt that you'll need our services in the future if you can keep your Step-Dad away from P2P programs and follow the advice provided below.

Your computer appears to be clear of malware. Good job.

Please stay with me a bit longer because there are a few important things that we still need to do to cleanup and make sure that you don't get infected again.

Please print these instructions because you will need to close this browser window in a step below.

1. Create a System Restore Point
   
   1. Go to Start, right-click on Computer and select Properties.
   2. In the left pane under Tasks, click System protection.
   3. If UAC prompts for an administrator password or approval, type the password or give your "permission to continue".
   4. Select System Protection ...then choose Create.
   5. In the System Restore dialog box, type a description for the restore point (e.g.,All Clean![/color]) and click Create again.
   6. A window should pop up with "The Restore Point was created successfully" message.
   7. Click OK and close the System Restore dialog.
      
      Note: If the message window was not displayed stating that the system restore point was created successfully then STOP - Do not continue with the steps below but rather reply to let me know what happened.
   
   
   
2. Delete old System Restore Points
   We can now remove any old System Restore Points that may be infected.
   Note: This step should not be done regularly but rather only as a Special Case after the removal of malware or changes in the Restore settings.
   
   
   1. Click Start > All Programs > Accessories > System Tools > Disk Cleanup.
   2. If provided with the option, select the appropriate drive letter (usually C:).
   3. A progress window will be displayed while the program scans files. Please be patient because this can take a few minutes.
   4. Click the Clean up system files button. Another progress window will be displayed while the program scans files.
   5. If provided with the option, again select the appropriate drive letter (usually C:).
   6. Click the More Options tab.
   7. In the System Restore and Shadow Copies section click the Clean up button.
   8. Click Delete when asked Are you sure you want to delete all but the most recent restore point?
   9. Click the OK button in the Disk Cleanup window and then click the Delete Files button in the confirmation window.
   10. Reboot your computer after the files have been deleted.
   
   
   
3. Cleanup with OTL
   
   1. Close all windows/applications.
   2. Right-click the OTL icon on your Desktop and select Run As Administrator.
   3. Click the CleanUp button in the OTL window. The cleanup will begin after which a dialog will be displayed indicating that a reboot is required.
   4. Click the OK button in the message window. The system will reboot.
   
   
   
   
4. Cleanup remaining tools used and files created by our work
   Delete the following files on your Desktop:
   
   MGADiag.exe
   WVCheck.exe
   
   
   
5. Address other security vulnerabilities
   The version of Firefox that is installed on your system is old and poses a security risk. Please go to www.mozilla.org and download the current version (9.0.1).
   
   
6. Stay clean
   The important thing now is to actively do things that will help keep you from getting infected in the future.
   
   
   1. Keep Antivirus and applications updated
      This is the MOST IMPORTANT thing that you can do to keep from becoming infected.
      
      • Keep Microsoft products up-to-date with the latest security patches. Either
        
        • Enable some level of Automatic Updates
          
          • Click Start > Control Panel. The Control Panel window will be displayed.
            
          • Click the Windows Update entry. The Windows Update frame will be displayed.
          • Click the Change setting link in the left column of the window. The Choose how Windows can install updates frame will be displayed.
            
          • Select the option which best fits your needs.
        • Or use Internet Explorer (not Firefox) to visit the Microsoft Update site on a regular basis.
        
        
        
      • I personally use and recommend the free Secunia Personal Software Inspector (PSI). This program will keep you aware of software that is installed on your computer that contains security vulnerabilities for which security patches exist. I have mine set to automatically scan my computer weekly.
        
        
      • All updates are important but pay particular attention to updates for Microsoft, Firefox, Java and Adobe products. These are widely-used products that Malware writers frequently target.
      
      
      
   2. There are a number of free programs that you can install to improve your computer's security: Many people feel that having a "layered" protection scheme is beneficial. You will have to decide what works best for your situation. Here are a few you may want to look into.
      
      Malwarebytes Anti-malware
      You already have it on your computer. Malwarebytes can thoroughly remove even advanced malware. Run scans at least weekly and always allow the databases to be updated if asked. It's powerful, easy to use and free. For real-time protection you will have to purchase the product. If you have other computers then it can be download from Malewarebytes © Malwarebytes Corporation. Tutorials are available for installing and running , Malwarebytes' Anti-Malware.
      
      
      SiteAdvisor
      SiteAdvisor is a toolbar for Microsoft Internet Explorer and Mozilla Firefox which alerts you if you're about to enter a potentially dangerous website.
      You can find more information and download it from here
      
      
      WinPatrol
      As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
      For more information, please visit here
      
      
      MVPS Hosts
      You can learn about and download the MVPS Hosts File here
      The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
      You can Find the Tutorial here
      
      
   3. Read and stay informed!
      
      To help minimize the chances of becoming re-infected, please read.
      Computer Security - a short guide to staying safer online
      
      If your computer is running slowly after your clean up, please read.
      What to do if your Computer is running slowly

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!


mambass

janne932