malware removal - I don't its name!

Like a good boy I thought I would follow the procedure as spelled out and I looked at Read and Run me before posting details of my problem, but came up against another major obstacle. I don't know what sort of malware is afflicting my PC, never mind its name!!

Since I believe I have malware of some sort, I should be grateful if someone would tell me whether it is essential to Read and Run me before taking the next step. If yes, how the hell can I find out the name of the malware on my PC?

mgb

 

OK, I followed the procedure specified in GetRunKey and ShowNew and attach the two resulting text files.

I'm not sure whether it is relevant at this stage, but my problem is a very, very, very, slow responding PC - particularly after a restart and my desktop is displayed. I have to wait at least 10mins. before I can open, for example ZoneAlarm or Opera. Once they are open the response variies from slooow to veeery slooow.:confused

I might add, I reformatted my HD and re-installed XP Pro 1 week ago because of the same (sort of) problem.

I really hope someone can help!

 

Hello TimW,

Thanks very much for your interest.

When I try to run BitDefender online scan from Opera, I get a message saying I need to download IE 7 which I already have installed. I then cannot proceed further than the page telling me to download IE 7. When I try to run BiutDefender online scan from IE 7, I see a message that IE internet security may be blocking BitDefender. Since I ran an online BitDef scan before I reformatted my HD and re-installed XP Pro 3 or 4 weeks ago, I gave up and ran an online Panda Totalscan (which incidentally took about 12hrs. to complete instead of the 1hr. indicated on the download page).

I attach the TotalScan log instead of BitDef and what there is of CounterSpy. In a second post I attach ActiveScan and HJT log files.

Having noted there looks like no serious malware is present on my PC and noting your observation about program clashes, I now suspect that in fact ZoneAlarm will prove to be the culprit. It appears that I downloaded ZoneAlarm on 8/8/07 and the first thing I noticed after that was some or all BitDef modules were turned off. Also some shield or service in both programs was disabled at one time or another.

mgb

 

Follow-up to previous post

As for the HJT file renaming, I am confused about which HJT file I should rename - is it the .exe or the .log? I attach the log file (analysethis.log) created after I renamed the .exe.

 

May I relate, in a couple of paragraphs, the events of the last few hours, in case they are relevant?

I uninstalled ZoneAlarm anyway because I read in the procedures elsewhere in these forums that the author recommended only the firewall, not the suite that is offered by default on the download site. Actually locating the firewall only required careful looking!

I also downloaded a-squared Free, as suggeasted in the same forum, and found to my extreme frustration that I had lost the ability to connect to the Internet with Opera or IE7. So I tried to uninstall a-squared Free and the Deleting process froze and nothing short killing the thing freed it. I finally managed to delete ZoneAlarm suite, although the Add or Remove screen is frozen open and showing ZoneAlarm in the list of programs. I presume ZoneAlarm is gone because I saw a pop-up showing Deleting files.

However, at least I restored my internet connection. I would mention that I have resolved to download nothing that is not a link from a Major Geeks forum or a manufacter's site!

Now to your last post.

The obvious reply to your implied question is I am still sinking slowly further into the mire, although your suggestion to eliminate ZoneAlarm was a good one!

Excuse my ignorance, but what do I do with the following?:

Also, what do I select? The above quote and then what? - paste it somewhere?

 

Please ignore the last perfect example of opening mouth before engaging brain (or in this case, opening eyes).

 

I tried CCCleaner to no avail, but you'll never believe that all I had to do was right-click the minimzed file icon in the taskbar - and Add or Remove was gone and so is ZoneAlarm!!

I ran HJT, put a tick in the specified box, and HJT froze (not responding) even at the fifth attempt.

As another indication of the slowness of my PC, I accessed this forum at between 90 B/s and 1.2KB/s!

Sorry about the ommision of the TotalScan and CounterSpy logs, but in any event TotalScan indicated 3 cookies and CounterSpy "nothing to declare", as you will see this time.

 

Finally got HJT to behave as it should on scan only, just after I ran it with a report. I really do attach it as a second post. This post has the three logs you requested in your last post.

 

I ran HJT scan only - this time I "fixed" the item specified, but when I ran Fixme.reg, the Registry Editor showed an error message saying "the specified file is not a registry script. You can only import binmary registry files".

On a completely different subject, I seem to be doing or not doing something with regard to attachments. I look at my previous post below and do not see the three attachments I put with it. I saw them in Preview, so I know they were attached when I hit Submit. To attach a file, I click Manage Attachments, then Choose, select the file(s), click Upload, and there the file is below the message text. I may preview my post, and then hit Submit. The message arrives without the attachnent(s)!!!? Any suggestions?

 

Another withdrawal of question. This time about attachments in my last post - I have just seen the answer!!

 

I'm afraid I'm :confused by this - how can two files of the same details reside in the same directory? I attach two screen shots which are the basis of my understanding of the state of HJT and the (name) change you requested. Doesn't the attached screen shot confirm that?

Yes I did, but when the deletion hung-up, I desisted and some time later I over-wrote it with a fresh download after it was clear that a-squared Free was not concerned in my problem.

I am about to do the chodefix.

 

I ran HJT but R0 was already set to ......Start Page = http://www.ask.com without my ticking anything (see my previous post for HJT listing).

When I ran fixme.reg I saw the same error message as before i.e. ...not a binary file (see attached file).

 

Sorry about the apparent confusion of my last post - crossed posts, I think.

There is evidently something fundemental about log files that I do not understand. - but I'll forget about that for now.

My PC is definitively running faster than a week ago, but things are still not normal, for example:
1. a STOPzilla Alert pop-up, entitled Spyware Alert, cannot be removed/deleted. The message says STOPzilla has deleted and blocked the infection named System Policies.DisableRegistryTools. I am offered the choice of scan and remove now Yes/No, but the pop-up is frozen. It disappears immediately I try to take a screen shot of it, but returns immediately I close the PrintScreen utility. I'll try a reboot when I close this browser.
2. opening a file from a desktop icon takes a minimum of 15 seconds, which is ridiculously slow for a 2,8GHz PC with 1G of RAM which was about 10 times faster (very subjectively) a few weeks ago.
3. BitDefender is being disabled by something or other (no other firewall is installed/enabled except Windows Defender which is enabled only when BitDef is disabled).

 

Just an addendum to the present state of my PC.

An hour after my last post and after a reboot I saw another STOPzilla pop-up (see attached screen shot). I deleted all and the pop-up went away. However, when I tried to logon to e-mail I could not. However, I was still able to access this forum thanks to Opera's tabs (I just love this browser) and from here I checked and find I can now connect to my on-line mailbox.

 

First of all may I say that I really, really appreciate the time and effort you are putting into solving my problem:clap:clap:clap:clap - I couldn't be more satisfied if I were paying $300/hr. yet you do this for me and others free!!!
I feel sure I thus express the sentiment of all the strangers you have helped over the years. As we say in French "Chapeau".

Back to business
When I ran chodefix I saw exactly as you described (as an aside, I was asked to hit the F5 key.....etc./.. to see the effect with the last line of hit any key to continue which is bloody silly because hitting anything causes the DOS window to disappear without showing anything!!) Incidentally, it took a lot longer than 3 secs. to start and run - about 15-20 is my guess.

I ran HJT renamed to analyse.exe and saved the log file hijackthis30_08_07 which I attach. The fixme.reg file gave the same result as before (not a binary file).

I attachFetNew to a second post hereafter.

 

I attach the file shownew.txt.

.

I trust my last post answers the point about Chode Fix.
As for my installed programs, you are quite correct in your implied supposition that I was "suckered" into scanning and downloading Spyware Detector but when I was presented with approx. 350 threats by Spyware Detector, I realized it was a "con" because I had just run STOPzilla, and Trojan Hunter, in addition to having BitDef Intertnet Security suite running, all of which showed no threats. I have now deleted it.

On the question of resident anti-malware programs am I not correct in thinking that they are non-operational until I run them? Just like Notepad, for example?

The programs I consider as being my major protection are indeed:
1. BitDef as my firewall, with anti-virus and anti-spyware modules active,
2. STOPzilla as anti-spyware,
3. asquaredfree as a supplement to BitDef or STOPzilla, (not yet quite clear about what this does)
4. TrojanHunter as my anti-trojan protection.

Any other anti-malware programs are:
....either part of my attempt to decide "what does this do? will it protect me? and from what?"
....or part of my increasing toolbox of diagnostic tools (which I will put in a sandbox if their presence in a Windows directory ....causes problems).

I will follow the How to Protect yourself from malware! link tomorrow.

 

Where does it say that? Am I supposed to guess?

The file is now attached.

 

Dear, oh dear, oh dear. Is this going to develop into a pi**ing contest? I really don't give a s**t about F5 and seeing the effect. But the fact remains that in addition to

You forgot to mention that "the message that you get from ChodeFix.bat" also includes

and the natural reaction is to hit F5. Just as one's finger is descending the eye sees the last line, but too late and the screen is gone! Which is no more than mildly irritating (since I don't give a sh*t about seeing the effect, as I said above) and gave rise to my observation that it is a bloody silly way to run the country. I still think so, but would not hold it against the programmer. As my penultimate post shows I have the greatest respect and admiration for the experts who run this forum, but they are liable to minor cockups like the rest of us.

 

Hi Mgbinnewhaw,
I'm convinced after many years on the internet, that no set of instructions yet written will ever be understood by all of the people all of the time. Too many variables involved.
abri

 

Hello abri,

As a user-document technical author of many years standing I have to disagree with you about all the people all the time, but when the text is written by a programmer I would agree with you wholeheartedly.

Please do not take this as a provocation - I repeat what I said before about my respect for you experts (in computing but not necessarily in authoring)

 

I cannot find this program - I can find many programs to uninstall SmitfraudFix but not one to install it!! The name S!Ri is rejected by Opera as having invalid characters in it.

Can you provide more details?

 

I ran AtfCleaner and timed the opening of 3 or 4 programs. Each one took at least 1min 45secs to open - Opera took at least 3mins. to open 7 or 8 tabs. So the answer to how how things are running is - sloooooow.

Unfortunately, you didn't reply to my question:

so I don't know exactly what to keep and what to delete.

 

Tried it, but no difference in opening time of the same 4 applications as previously timed and mentioned.

I attach the log file.

Done part 1 and attach the log file. I'll do part 2 tomorrow (it's now 01:45 and I'm almost too tired to type correctly).

 

The bloody attachment thing foiled me again! Here is the missing log file.

 

Sorry about the break in service - family affairs occupied my time.

I could not get the bloody thing to boot into safe mode, despite rebooting 7 or 8 times and hitting F8 until I nearly broke my finger in frustration. I cannot understand this because I rebooted in Safe Mode a month ago when I reformatted and re-installed XP. So I ran SmitfraudFix in normal mode - I hope this doesn't invalidate the run.

I attach the three log files.

 

I forgot to mention that opening any application or Windows file takes about 2mins. minimum. So this PC is now slower than my first Commodore!!

 

Do you mean smitfraud run in Safe Mode?

By the way, I am using a Logitech keyboard which defaults on start-up to media mode for the F1 through F12 keys (as I discovered after my great frustration trying to accept Windows EULA). Can you say whether there is any other (than this crap default) reason for F8 not performing its function?

Yes, I disabled BitDef and came off-line and it made no difference at all.

 

Did that and got this:

 

It is full of host names - I'l rename it after I send this message.

Two things happened after Hoster couldn't open the host file:

1.When I rebooted I still couldn't get into Safe Mode, but I saw an error message from I think CounterSpy saying it had blocked an attempt to open the Host file.

2.I rebooted this morning and, lo and behold, I got into Safe Mode!! However when I tried to run Smitfraudfix, it kept telling me to unzip all the files when they were already unzipped!! So I haven't yet managed to run Smitfraudfix in Safe Mode.

 

I couldn't rename the Hosts file because "it is being used by another file or person". Does that mean I have to stop all the processes with host in their title? Or could I simply move the file to another HD?

Is this in Safe Mode?

 

Sorry, am I being obtuse, but if I still can't do what?