Contracted a Virus Yesterday

Hello,

Maybe you can help me. You have in the past (even after I paid someone who couldn't fix my computer).

I think I contracted a virus yesterday from a well-known advertiser (I'd been getting their newsletters to over a year). Yesterday when I opened the newsletter & went to delete it, a warning came up saying it may be dangerous. But I'd already clicked the delete button when it popped up & think I hit that warning as well. After that, every link I clicked took/redirected me to some shopping type page like greatfeedmill.com, toseeka, iProwl, etc. & when I hit the "back" button it sends me to another one. I used Spybot Search & Destroy & it removed some. And when I restarted my computer last night, it seemed fine. I had AVG antivirus but it recently expired (my own fault).

When I started my computer this morning, all my desktop icons showed up but only for a couple of minutes. Then a blue screen (default background) came up & a "SecurityTool" (brand name) page came up to try to get me to pay a yearly fee in order to protect my computer & remove 20 viruses it found (down from the 32 it showed the first time I logged on). I restarted my computer several times. This "SecurityTool" had installed itself on my computer (the shortcut is on my desktop) & it's not in the Add/Remove programs but was the last one under the "All Programs" in the "Start" menu. It says it's at C:\Documents and Settings\All Users\Application Data\30743825. I found it (2 versions - one that installed last night) & deleted them. It doesn't say who the manufacturer of SecurityTool is. I use Firefox & I Googled to find out who makes "Security Tool" & couldn't find the name. Windows Defender found Trojan:Win32/Winwebsec on my computer (which it said was severe) & quarantined it. (I run WinXP.)

I noticed from the SUPERAntiSpyware scan that "SecurityTool" is termed a "Rogue Agent."

Thanks in advance,
Cynthia

BTW, when I clicked on the "Support Forum" link at the bottom here, a very real looking "My Computer" screen came up looking like my computer doing a scan & said I needed to install the antivirus software from http://spyware-remover-free.org. I know it's not my screen because I have some other drives on it that this one isn't showing & I had another tab open on the browser. It wouldn't allow me to cancel/exit out. My only choice was to install the software. (I didn't.) I had to shut down the entire browser & come back to try again.

 

This is my 2nd posting with logs attached.

When I boot up & log on after the SUPERAntiSpyware scan, 2 dialog boxes come up.

One says:
RUNDLL
Error loading C:\WINDOWS\system32\calc.dll
The specific module could not be found

& the other says:
RUNDLL
Error loading C:\DOCUME~1\Owner\ntuser.dll
The specific module could not be found

I can still log on but those 2 dialog boxes come up.

I am not running a 64 bit version of Windows but RootRepeal hangs up on initializing so I was never able to install or run it.

When running MGtools, a dialog box with Error Message Type 2 came up:

16 bit MS-DOS Subsystem
C:\WINDOWS\system32\cmd.exe
C:\PROGRA~1\Symantec\S32EVNTI.DLL. An installable Virtual Device Driver failed Dll initialization. Choose 'Close' to terminate the application. I clicked "Ignore" & the program ran.

I'm not getting the redirects to the shopping site & things seem to be working fine...so far (fingers crossed).

You guys are the greatest!

Thanks Again,
Cynthia

 

I've uninstalled Viewpoint Media (I missed it the first time) & J2SE Runtime Environment 5.0 Update 10. I've also rebooted & installed Java Runtime 6.

I did renew my AV...for 2 years (AVG 9.0 - which comes with its own firewall now).

I never changed MSconfig back (I'm not sure how) so I think it's still running on Start up because I'm getting a different blue screen that scans my external hard drive first before it boots up (mentioning something about it being dirty).

When I tried to uninstall ComboFix (& copied & pasted the line you posted), it asked me to run it. Then an 'Error - Win32 only' box showed up saying: Incompatible OS. ComboFix only works for workstations with Windows 2000 and XP (I have WinXP.)

AVG detected malware, file name: C:\32788R22FWJFW\NIRCMD.CFXXE; Threat name: Tool-NirCmd. Category: PUA - Potentially Unwanted Application. (I'm guessing this is the ComboFix application). The only 2 options were "Quarantine" & "Allow." I hit "Allow." After a few clicks, ComboFix uninstalled.

I did a Disable System Restore & rebooted to Enable.

It seems to be running fine & I have no more problems.

Thanks Again,

Cynthia