Trying to be sure my system is clean 1/2

AlisenV · Feb 11, 2007

Followed all your instructions - logs attached. Panda Active Scan found lots of spyware that was not removed - and I am not sure how to remove it.

Thanks in advance,
Alisen

AlisenV · Feb 11, 2007

Trying to be sure my system is clean 2/2

I did run counter-spy, but am not seeing an output from it. Should I run it again?

Thanks in advance,
Alisen

chaslang · Feb 13, 2007

Re: Trying to be sure my system is clean 2/2

Welcome to Majrogeeks!

Please stay in one thread for your problems! I merged your other message back to your first thread.

AlisenV said: ↑

I did run counter-spy, but am not seeing an output from it. Should I run it again?
Click to expand...

Did it report anything at all? If it does not work for you, uninstall CounterSpy and run AVG Antispyware as requested in the READ & RUN ME.

You also need to attach the log from ShowNew

Panda did not find anything that is important and if you had followed the directions in step 1 of the READ ME, it would not have even wasted your time with that misleading information. I quote from the READ ME

Download and install CCleaner

MAKE SURE you download from the above link to avoid getting the Yahoo Toolbar version. We do not want to install any unnecessary baggage.

Also it is recommeded to login to all other User Accounts on the PC including the Administrator account which will only show when you boot in safe mode. Run CCleaner on each account. This can greatly reduce scan time and log sizes from the later scanning you will do below.

Click to expand...

Notice the last bullet item! This is the key. Following the READ ME in the order written and completing all steps will reduce scan time and all log file sizes. However also note that as I already implied, Cookies are not problems!

Are you or were you having any malware problems?

AlisenV · Feb 12, 2007

OK - I went back and started over. I ran CCleaner on both Administrator and Owner accounts - that is all that is on this PC.

I ran Counter-Spy again, and it found nothing.
Attaching BitDefender log
Attaching Panda ActiveScan
Attaching GetRunKey

More to follow next reply...

AlisenV · Feb 12, 2007

Attaching ShowNew
Attaching Hijack This

With regard to your other question:

When I log off, I get an End Program box for a program called Sample. I don't know what that is, and don't see it on add/remove programs. The message says that it is not responding. This happened on Admin account when I closed it (in safe mode)

There are three other items I saw in startup processes in Spybot that I question as well

ZCfgSvc.exe
VersatoMs - MulMouse.exe
Pronomgr.exe

The PC has been sluggish, not sure what is causing it, but I think it might be this Sample program, whatever it is.

Hope this is a bit clearer - wasn't trying to shortcut, just missed the thing about CCleaner and the Admin account. Mea culpa!

Thanks in advance,
Alisen

chaslang · Feb 14, 2007

You don't really have any malware problems!

AlisenV said: ↑

When I log off, I get an End Program box for a program called Sample. I don't know what that is, and don't see it on add/remove programs. The message says that it is not responding. This happened on Admin account when I closed it (in safe mode)

AlisenV said: ↑

There are three other items I saw in startup processes in Spybot that I question as well

ZCfgSvc.exe
VersatoMs - MulMouse.exe
Pronomgr.exe
Click to expand...

Not malware!

ZCfgSvc.exe - part of Intel’s ProSET utilities and installed by the drivers for many of Intel wireless network cards - essential to the proper functioning of many of the Intel ProSET utilities (but not all) and these System Tray ProSET utilities are a must if you are using your wireless connection. They inform you when the signal is fading or dropping.

MulMouse.exe - Labtec Wireless Mouse Driver

PRONoMgr.exe - System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features

AlisenV said: ↑

When I log off, I get an End Program box for a program called Sample. I don't know what that is, and don't see it on add/remove programs. The message says that it is not responding. This happened on Admin account when I closed it (in safe mode)
Click to expand...

This problem may be caused by ZCfgSvc.exe which as mentioned above is part of the Intel ProSet software which is installed on many computers with wireless cards.

You have try two things (but this is not a topic I can continue any further with than the below. This is not a malware forum topic):

One, use Task Manager to end the ZCfgSvc.exe process, and then rename the C:\WINDOWS\system32\ZCfgSvc.exe file to ZCfgSvc.old. Now restart your PC and let's see what happens. This may or may not affect your wireless card functionality. If you do notice that it does have a negative effect, rename the file back to the original name. And then try step 2!

Uninstall and reinstall the driverss for your wireless hardware.

Let's fix a few mostly non-malware related things!

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Mozilla Firefox (1.5.0.9)
Viewpoint Media Player <-- should have been uninstalled in step 0 of the READ ME

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Then install the current version of FireFox from: Mozilla Firefox

You did not do step 2 of the READ ME properly, the below will correct this!

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
"SuperHidden"=dword:00000001
"ShowSuperHidden"=dword:00000001
"HideFileExt"=dword:00000000
Click to expand...

Now uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders which may be left behind by the uninstall:
C:\Documents and Settings\All Users\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software

The below are all non-malware things you can have HJT fix to help speed your PC up a little. None of these are required startup processes.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

After clicking Fix, exit HJT.

Now reboot in normal mode

Now attach the below new logs and tell me how the above steps went.

GetRunKey

ShowNew

HJT

Make sure you tell me how things are working now!
Click to expand...

AlisenV · Feb 14, 2007

chaslang said: ↑

One, use Task Manager to end the ZCfgSvc.exe process, and then rename the C:\WINDOWS\system32\ZCfgSvc.exe file to ZCfgSvc.old. Now restart your PC and let's see what happens. This may or may not affect your wireless card functionality. If you do notice that it does have a negative effect, rename the file back to the original name. And then try step 2!

Uninstall and reinstall the driverss for your wireless hardware.

Click to expand...

OK - I'll deal with this later. I do use the wireless connection for this PC. It seems odd that suddenly this "sample" issue would happen, I don't think I changed anything with ProSet. However, the last several times I rebooted following your instructions, I didn't see the error at all. Perhaps it was something else.

chaslang said: ↑

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Mozilla Firefox (1.5.0.9)
Viewpoint Media Player <-- should have been uninstalled in step 0 of the READ ME
Click to expand...

I didn't know that Viewpoint wasn't part of something else, which is why I didn't remove it. I see you added a listing with a hotlink - sorry, that wasn't there the last time I followed your instructions.

chaslang said: ↑

Now attach the below new logs and tell me how the above steps went.

GetRunKey

ShowNew

HJT

Make sure you tell me how things are working now!
Click to expand...

Things look ok. Thank you for your help. You ought to get an assistant - or a raise - as you appear quite busy these days.

Take care,
Alisen

chaslang · Feb 15, 2007

AlisenV said: ↑

I didn't know that Viewpoint wasn't part of something else, which is why I didn't remove it. I see you added a listing with a hotlink - sorry, that wasn't there the last time I followed your instructions.
Click to expand...

On the contrary! It has been there for almost two years.

If you are not having any other malware problems, it is time to do our final steps:

If we used Pocket Killbox during your cleanup, do the below

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.

If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.

If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.

If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created

If you are running Windows XP or Windows ME, do the below:

go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Trying to be sure my system is clean 1/2

AlisenV Private E-2

Attached Files:

Activescan.txt

bdscan.txt

hijackthis.log

AlisenV Private E-2

Attached Files:

runkeys.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

AlisenV Private E-2

Attached Files:

bdscan.txt

Activescan.txt

runkeys.txt

AlisenV Private E-2

Attached Files:

newfiles.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

AlisenV Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member