Help with Errorsafe & maybe more, pls

Discussion in 'Malware Help (A Specialist Will Reply)' started by colossal, May 29, 2006.

  1. colossal

    colossal Private E-2

    Hi I am getting a lot of pop ups relating to Errorsafe and a few other random popups.

    Also when I use panda scan AVG reports files being acsessed in document & settings\user\?system 32 or other paths with question marks in that do not show up in explorer.

    I ran panda once & managed to delete some of the files it found. I then ran it again & it found more files.

    I have followed http://forums.majorgeeks.com/showthread.php?t=35407 read & run me 1st to the letter.

    I have attached bdscan, the second active scan & hijack this logs.

    I could really do with some help here,

    Thanks
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    Your log show both McAfee and AVG antivirus applications. I'm going to assume you know longer use McAfee since it looks semi broken and thus I'm going to have you fix lines related to it.

    Make sure viewing of hidden files is enabled (per the tutorial).

    Please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.
    C:\Documents and Settings\simonem\Application Data\s?stem32\?poolsv.exe

    After killing all the above processes, click Back.
    Then please click Scan and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O2 - BHO: (no name) - {283E595C-C495-BA37-E82A-EAABB84BB6CC} - C:\WINDOWS\System32\fdlvv.dll
    O4 - HKLM\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKCU\..\Run: [Aida] "C:\Program Files\rdso\eetu.exe" -vt mt
    O4 - HKCU\..\Run: [Cuzi] C:\Documents and Settings\simonem\Application Data\s?stem32\?poolsv.exe
    O4 - HKCU\..\Run: [Nezfvnpg] C:\WINDOWS\System32\??plorer.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete
    :
    C:\Documents and Settings\simonem\Application Data\s?stem32 <--- delete the whole folder
    C:\Program Files\rdso <--- delete the whole folder
    c:\Program Files\mcafee.com <--- delete the whole folder
    C:\WINDOWS\System32\fdlvv.dll
    C:\WINDOWS\System32\??plorer.exe <--- this may look look like explorer.exe when you look for it. The ?? are actually unprintable characters embedded in the file name.

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST)
    .

    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  3. colossal

    colossal Private E-2

    Hi Chaslang

    Thanks very much for your help with this. I followed your instructions with the exception of

    delete
    C:\WINDOWS\System32\fdlvv.dll
    This dll does not exist on my PC.

    C:\Documents and Settings\simonem\Application Data\s?stem32
    The folder showed as system32 in the same path so I deleted it.

    C:\WINDOWS\System32\??plorer.exe
    this does not exist in system 32, only in c:\windows so I left it alone

    I have run ewido online which may account for this.

    I have also installed zone this stopped a lot of stuff & blocked 114 inbound & 14 outbound attempts before the fix.

    I have not had a popup after the fix with zone alarm disabled, I ran through my favourites a few times which guaranteed pop ups before.

    Thanks again, could I even be clean ?
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your log is clean of malware but you can just fix the below remnant of Spy Sweeper.

    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
  5. colossal

    colossal Private E-2

    Hi Chaslang

    Thanks for your help with this, I will delete the entry.

    This all started with a new broadband connection (was dial up) on an old PC with no SP2 firewall or antivirus. Suppose I was asking for it really. All in place now so fingers crossed should be ok.

    Thanks again.
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds