I have a problem (completed all but 1 step)

Hi all,

I have read the post and have done all that was asked except loading the virus scan, as i tried to a couple of times and my PC shuts down and reboots saying a have recovered from a critical error.

I've ran Adaware, Spybot, and Microsoft in safe mode deleting just minor stuff.

thing is when i ran spybot not in safe mode it said it detected smitfraud (6) and it said it could not be healed. It doesn't detect this in safe mode though.

Now, here's some of the problems I'm having:

when i connect online, my main page is a blank microsoft screen saying "action canceled". the url to this "action canceled" screen is the file res://C:\WINDOWS\System32\shdoclc.dll/navcancl.htm.

that file then becomes syserrors.com promoting psguard and spytrooper where it tells me that w32.sinnaka.a@mm is gathering all my info.

i am getting nailed with pop ups as well, and also have a couple icons installed on my desktop promoting the spyware products from the people that probably gave me the problem.

I also have lost my Google tool bar.

any help is appreciated.

 

Please see the thread below and then attach a current HJT log from normal mode.

Downloading, Installing, and Running HijackThis

 

• Edit by bjgarrick: Inline HJT log removed!

 

Please follow my instructions very carefully. Go back and go thru the thread I previously posted.

1. ATTACH all logs as attachments to your post.

2. Relocate you HJT as requested in the thread.

 

sorry,

i tried right clicking on the file, but no extract option was available.

please treat me as if i am an 8 year old because PC's are the devil to me.

 

Read thru that thead and it will guide you thru the entire process. If you have just the file, just move the file into the folder C:\Program Files\HJT and run it from there where you will get backups.

 

i read through it but am still struggling.

i dragged the HJT file that i downloaded and put it in the HJT folder i created, but i try opening the file and it doesn't work, so i know i'm messing something up.

when i right click on start and then click explore i see no cdrive, just cdisk. is this the right file to click on to create the HJT folder? if so, i did that and then dragged the downloaed HJT to the folder with no luck.

what am i missing?

thanks again.

 

Click Start > Select RUN > type in the box C:\Program Files

Once this has opened right click in any blank space, select NEW FOLDER and name HJT.

Download Hijack This again and save it to this folder, doube click to run. Now attach this log to your next post.

Hijack This 1.99.1

 

i know you have to be about done with me and i appreciate your help so far as i am challenged to say the least, but i did as you said and created the folder where you told me to, but i clicked on the HJT to download it again and i clicked on the "save" and the cdisk and the folder i created was not in there.

where to i find the folder?

 

Open C:\Program Files and look for the folder HJT. Download the file again, save to your desktop and then drag the file to this folder.

If you cant get this done, just run HJT from the desktop.

 

hi bjg,

i put the file inside the folder as you said, but when i run it i still just get the same thing that i posted that was deleted before, which is:

Inline log attached!

i think i realy should go back to web-tv

 

Please download Spy Sweeper

• Click the link above to download the program.
• Install it. Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Options on the left side.
• Click the Sweep Options tab.
• Under What to Sweep please put a check next to the following:
  
  • Sweep Memory
  • Sweep Registry
  • Sweep Cookies
  • Sweep All User Accounts
  • Enable Direct Disk Sweeping
  • Sweep Contents of Compressed Files
  • Sweep for Rootkits
  • Please UNCHECK Do not Sweep System Restore Folder.
• Click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into notepad and save it as spysweeper.txt and attach it to your next post along with a fresh HJT log.

 

i installed and ran the program as directed, but being a total moron have no idea how to attach a file as you did, so here's the info:

Inline logs attached!

i still have the issues so may run the program in safe mode to see if that helps.

thanks again for your time.

 

Download this trial version of Ewido Security Suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
• After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report along with a fresh HJT log.

 

i ran ewido in safe mode as directed with the phone line disconnected and here are the results:

Inline logs attached!

here are the new HJT reports as well:

i appreciate your time. thank you.

 

From now on please attach ALL logs as attachments to your post!

Please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

Spy Sweeper

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch

O2 - BHO: HomepageBHO - {e9ccf15d-4c68-4b5a-9e9a-8e12e4bd39bd} - C:\WINDOWS\System32\hpA8C3.tmp (file missing)

O3 - Toolbar: SecurityToolbar - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - C:\Program Files\Security Toolbar\Security Toolbar.dll (file missing)

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

After you complete the above, reboot and attach a fresh HJT log.

 

hi bjg,

i really don't know how to do an attachment, hence why i'm not doing them. i really suck at the whole pc thing.

i'm writing down the instructions now and will complete them asap.

forgive my ignorance.

 

Click on "Post Reply" and near the bottom of this box (where you type your message) click the "Manage Attachments" button and upload your log.

If you can't find this, just keep doing as you are and I will continue to attach them for you.

 

sorry, i can't find the figgin file i want to attach.

i performed all steps and made sure all windows were closed when i deleted (fixed) the HJT, but it looks like some might still be there?

Inline log attached!

 

Your log is clean, are you having any further problems?

 

the only thing that seems o be different now is i still haven't been able to get my google search tool bar back, but other than that all seems fine.

thanks again for all of your help.

 

Just click the link below and download it again. Afterwards install and it should be there.
http://toolbar.google.com

You should see this article on How to Protect yourself from malware!

Surf Safely!