Problem removing rootkit

I agree that avira and avast are good, the best antivirus is nod 32. I dont agree avg is good, if you look at how many viruses etc it misses you will know why. Here is a link to the graphs of what the top antiviruses miss and what they actually picked up and avg misses more than any other antivirus out there

http://www.eset.com/products/compare-NOD32-vs-competition.php

And also only 17 out of 37 antivirus programs passed the VB100 tests
so it's not just bitdefender. 2oldgeek was wrong because if you look at the graphs on the link bitdefender missed less viruses than avg
but avg passed more tests than bitdefender.Avg missed over 745 on acccess and 234 viruses on demand and bitdefender missed 32 on access and 82 on demand so avg is not better

 

@LauraAnne,

I agree that I should not have included AVG (that was just a typo or brain fart)

If you compare AV’s then it is better to use data from an independent, impartial reviewer and not the company that sells it.. You will notice your link is from eset.com and in no way could it be biased.. lol

You will notice also, that they are only comparing based on “in the wild” known viruses that have already been corrected. A true test uses new viruses that have popped up over the last few months in order to see if they have been keeping up and updating.
From your link:

Not a true test! Think about it..



My favorite one liner is: “Never kick a cow chip on a hot day”. In other words, if you stir it up, it’s going to stink!

I wasn’t going to mention this, but since raebie kicked the cow chip, I will.

@raebie,

I guess you are the “Bright Spark” that installed Azureus.exe, on your Mom’s computer, that shows up in the ComboFix Log. You can run but you can’t hide…

It’s a P2P program for downloading Torrent files, infested with malware, like that that showed up in your logs, for your poor old Mother to have to put up with.. Real bright……

No more need be said except; May you be blessed with Hindsight to know where you have been, Foresight to know where you are going and the Insight to know when you have gone too far….

Have a beautiful, rewarding day..

2oG

 

i have never even bothered using azureus and the file itself is not infected but some things you download through it can be. I'm unsubscribing from this thread now. All i wanted to do was ask for help, maybe i asked in the wrong way but there was no need to respond the way you did. Anyway forget about it, thanks for the help, much appreciated bye

 

I would like to thank 2oldGeek For the advice he gave to the ungrateful user who he helped getting rid of the viruses and rookits by using Combofix.exe. While the advice to the user wasn't appreciated it really did help me removing an infection that I had not been able to get rid of. Sometimes when helping others you end up helping a lot of others(like me). Most just come here and learn from the wise ones and never interact, just sit back in the corner and listen (like me). Thank You Very Much, Your advice was right-on and correct!
Robert....

 

@rarthurb,

No, Thank you very much, Robert, for this reply…. It is so gratifying to know that all is not in vain. After over 40 years of programming, rebuilding and Geeking computers, that someone can benefit from my input on this forum is pay back enough. I guess you know the pay here “sucks pond water” lol.

If you ever need any extra help just post to: “for 2oldGeek” and I’ll pick it up as soon as possible….. I am Simi-retired and work weird hours… Guess I’ll still be working when they pat me on the belly with a shovel. LAMO…

Thanks again, Robert..

Live simply. Love generously. Care deeply. Speak kindly. Leave the rest to God.

2oldGeek - That’s “2” not “Too”, old with a small “o” and Geek with a Capital “G”

 

Hi, 2oldGeek... thanks for you input, please, don't mind some of these morons stupidity! I have question, not urgent by any means. I have try to installed this Smitfraudfix program for future reference, done number of times and not able to complite the installation. If you happen to know what might be is screwing up installation...

Again, I wish you all the best!

 

First, why would you need to install Smitfraudfix in the first place??

This virus can be removed with Malwarebytes’ AntiMalware or SuperAntiSpyware. Either of which will probably do a more complete removal of any other malware on your machine.

To answer your question; Smitfraudfix has some files that are picked up by many AntiVirus programs as a virus and, if running, will not allow you to install it.
Try turning off your AV..

2oG

p.s. you run Smitfraudfix to remove a smitfraud virus and then un-install it - not something you need hanging around.. lol

 

Hi, 2oldGeek,
Thanks for quick respond!

I was wondering to have it in with USB, as I got few month ago this "blue screen" etc., and was forced to pay $80 computer repair shop clean crap out of my computer. As advanced, if it happens again would be great to fixed my self!

The best future game plan if happens again, to clean-out dirt, blue-screen, pop-up, Bull, etc!..and is it have it with USB??

By the way end-up to reformat whole thing afterwords anyway, after the fact, I pick my files to USB stick.. it was total waste of money!

Currently using, Spyware Doctor, Avista, (switch from AVG)works great, better then AVG, (don't know Avira) Malwarebites, added SpywareBlaster just yesterday, (by you recommendation for somebody else)

Still not sure if all is okay in my computer, all virus scans raports; clean! I had incident a week ago were my Firefox out of blue-sky crassed every time I try to open it, jump to Explorer, the same thing. I was out of acces to an Internet, for a moment, went program files, extracted Firefox wich did the "trick," so got access back to an Internet and download again Explorer, everything supposedly okay, ..! Haven't able to fix original reason on this crap as of today....what it is, or am I better of again reformat my computer....you opinion on this?

THANK YOU, YOU ARE GREAT HELP FOR OUR WEB-SITE COMMUNITY & FRIENDS IN THIS AFTERDAWN WEB-SITE !

Henry

 

Hi henry,

You may have noticed that Spy Sweeper, Spyware Doctor, Spybot, and Ad-Aware are not mentioned in any of my threads. At one time all of them were considered premier tools. A lot has changed over the years, as malware has become much more complex, and all of the aforementioned programs have inferior detection/removal capabilities compared to programs like Malwarebytes’ AntiMalware and SuperAntiSpyware. Please do not waste your time using them.

I don’t recognize Avista? I always recommend Avira Antivir, Avast or AVG as good free AV’s.

Smitfraudfix is a specialized program and not a general purpose malware cleaner..

I never recommend reformatting except in an extreme case…
When you can’t boot or run antiMalware programs the first thing to do is this:

AntiVir Rescue disk

Using a clean computer download and burn a rescue disk from here:
http://www.free-av.com/en/products/12/av...cue_system.html

Then use this guide to clean your machine:
http://forum.avira.com/wbb/index.php?page=Thread&threadID=82163

Then run Malwarebytes’ AntiMalware to finish the cleaning…

2oG

 

Hi 2oldGeek,
Again, thank you for you reply,

I got it, I meant Avast & Spy-Doctor as current AV and just added also Avira in my computer, ... just haven't never operated ISO files, as the back-up format, that's how I was able to copy in CD.

Frankly, I did and still have copied, "vacuumed" torrent" Spanish Learning by Stone as ISO format & copied, saved in CD - still don't even know how open & transfer from ISO to computer with useful format,...that's another subject matter....!

You are probably thinking this guy is loaded with all kind of....! No, it's all about this Computer related issues,...but still if I end-up to have an issue with my computer,... is it correct format (ISO) how I got saved in my rescue CD?! If there is an issue other words, I just insert rescue CD which has download and is it able to read the ISO format I got it?

Yes, I am a piece of work...I apologized all these million questions!

Thank you,
Henry

PS. Avira web-site with all member forum help look pretty impressive.

 

Hi, Second..continnue from a beginning...I went back rescue & pick rightway direct save in; CD it looks as it's loading to destination at my CD driver...still dowloading...let's see..didn't happen..still backing first desktop & from there in CD, as ISO format.

 

Hi, Second..continnue from a beginning...I went back rescue & pick rightway direct save in; CD it looks as it's loading to destination at my CD driver...still dowloading...let's see..didn't happen..still backing first desktop & from there in CD, as ISO format.

 

Here is my Avira raport, just one very bottom have warning ; hiberfill.sys don't know what it could be as well two other unable to access available were probably Spy-doctor & Avast:

I just try to learn ISO, but ...

 

Report By Avira:


Avira AntiVir Personal
Report file date: Sunday, June 14, 2009 14:50

Scanning for 1439934 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : Henry
Computer name : LENOVO-3E0AF35C

Version information:
BUILD.DAT : 9.0.0.403 Bytes 6/3/2009 17:05:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 5/11/2009 14:14:47
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 15:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 16:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 15:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 17:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 2/11/2009 01:33:26
ANTIVIR2.VDF : 7.1.4.0 2336768 Bytes 5/20/2009 17:16:38
ANTIVIR3.VDF : 7.1.4.37 382976 Bytes 5/29/2009 17:25:16
Engineversion : 8.2.0.180
AEVDF.DLL : 8.1.1.1 106868 Bytes 4/30/2009 16:52:04
AESCRIPT.DLL : 8.1.2.0 389497 Bytes 5/27/2009 21:07:20
AESCN.DLL : 8.1.2.3 127347 Bytes 5/14/2009 16:02:01
AERDL.DLL : 8.1.1.3 438645 Bytes 10/29/2008 23:24:41
AEPACK.DLL : 8.1.3.18 401783 Bytes 5/27/2009 21:07:20
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 2/27/2009 01:01:56
AEHEUR.DLL : 8.1.0.129 1761655 Bytes 5/14/2009 16:02:01
AEHELP.DLL : 8.1.2.2 119158 Bytes 5/29/2009 18:51:15
AEGEN.DLL : 8.1.1.44 348532 Bytes 5/14/2009 16:02:01
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 19:32:40
AECORE.DLL : 8.1.6.12 180599 Bytes 5/27/2009 21:07:20
AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 19:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 13:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 15:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 19:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 15:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 3/24/2009 20:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 15:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 20:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 13:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 15:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/15/2009 20:39:58
RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/17/2009 15:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: Sunday, June 14, 2009 14:50

Starting search for hidden objects.
An ARK library instance is already running.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'avira_antivir_personal_en.exe' - '1' Module(s) have been scanned
Scan process 'CancelAutoplay.exe' - '1' Module(s) have been scanned
Scan process 'burningstudio9.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'pwmgr.exe' - '1' Module(s) have been scanned
Scan process '1XConfig.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mozystat.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'AcMurocHlpr.exe' - '1' Module(s) have been scanned
Scan process 'DLG.exe' - '1' Module(s) have been scanned
Scan process 'BTTray.exe' - '1' Module(s) have been scanned
Scan process 'LPMLCHK.EXE' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'TSMResident.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'AwaySch.EXE' - '1' Module(s) have been scanned
Scan process 'scheduler_proxy.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'GoogleDesktopDisplay.exe' - '1' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'GoogleDesktopIndex.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'ACWLIcon.exe' - '1' Module(s) have been scanned
Scan process 'ACTray.exe' - '1' Module(s) have been scanned
Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
Scan process 'PicasaMediaDetector.exe' - '1' Module(s) have been scanned
Scan process 'pdservice.exe' - '1' Module(s) have been scanned
Scan process 'cssauth.exe' - '1' Module(s) have been scanned
Scan process 'IBMTBCTL.exe' - '1' Module(s) have been scanned
Scan process 'Amsg.exe' - '1' Module(s) have been scanned
Scan process 'LPMGR.EXE' - '1' Module(s) have been scanned
Scan process 'TpScrex.exe' - '1' Module(s) have been scanned
Scan process 'TPONSCR.exe' - '1' Module(s) have been scanned
Scan process 'SMax4PNP.exe' - '1' Module(s) have been scanned
Scan process 'TPOSDSVC.exe' - '1' Module(s) have been scanned
Scan process 'EZEJMNAP.EXE' - '1' Module(s) have been scanned
Scan process 'TpShocks.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'tabtip.exe' - '1' Module(s) have been scanned
Scan process 'tp4serv.exe' - '1' Module(s) have been scanned
Scan process 'tcserver.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'tabbtnu.exe' - '1' Module(s) have been scanned
Scan process 'wisptis.exe' - '1' Module(s) have been scanned
Scan process 'SUService.exe' - '1' Module(s) have been scanned
Scan process 'AcSvc.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'tvtsched.exe' - '1' Module(s) have been scanned
Scan process 'rrservice.exe' - '1' Module(s) have been scanned
Scan process 'ibmtcsd.exe' - '1' Module(s) have been scanned
Scan process 'TpKmpSvc.exe' - '1' Module(s) have been scanned
Scan process 'TPHDEXLG.exe' - '1' Module(s) have been scanned
Scan process 'tvt_reg_monitor_svc.exe' - '1' Module(s) have been scanned
Scan process 'TSMService.exe' - '1' Module(s) have been scanned
Scan process 'SMAgent.exe' - '1' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mozybackup.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'btwdins.exe' - '1' Module(s) have been scanned
Scan process 'ASRSVC.exe' - '1' Module(s) have been scanned
Scan process 'AcPrfMgrSvc.exe' - '1' Module(s) have been scanned
Scan process 'IPSSVC.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned
Scan process 'keyboardsurrogate.exe' - '1' Module(s) have been scanned
Scan process 'EvtEng.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ibmpmsvc.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
101 processes with 101 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '104' files ).


Starting the file scan:

Begin scan in 'C:\' <IBM_PRELOAD>
C:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.


End of the scan: Sunday, June 14, 2009 15:37
Used time: 46:28 Minute(s)

The scan has been done completely.

6129 Scanned directories
386322 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
2 Files cannot be scanned
386320 Files not concerned
9280 Archives were scanned
2 Warnings
2 Notes

 

henry,

Download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <-- Don't forget this.
• When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt

• Please post the MBAM Log and a fresh HJT log in your next reply.


Remember – Never run more than One anti-virus program at the same time….

2oG

 

I also have to say Thank you Very Much 2oldGeek. First, for offering to help, and secondly, for those great sayings that will stick with me for many years to come. God Bless You.

 

Thanks for the flowers, smg…

You have made my day. When I got up this morning I was “Lower than a snakes belly in a wagon track” now there’s sunshine over my shoulder…

I haven’t posted on here in over a year, I don’t think, and it’s great to know someone is still reading my old posts…

God bless you and yours,
2oldGeek