I think I have a virus or trojan or something

Discussion in 'Malware Help (A Specialist Will Reply)' started by benjyb, Mar 18, 2013.

  1. benjyb

    benjyb Private E-2

    I completed the Malware Cleaning Procedure and am attaching the all of the log files. I am running windows 7 64bit
    A couple of days ago I installed a printing program to allow network printing from my tablet. It installed really quickly and then I couldn't find it. I went to the control panel to remove the program and it wasn't there. Immediately, the computer started running really slowly most of the time, there being a delay performing basic windows tasks and taking a long time to build web pages etc.
    Anyway, I think I downloaded something bad.
    I use avast, zonealarm, spybot s&d

    Thanks in advance for the help.

    Ben
     

    Attached Files:

  2. benjyb

    benjyb Private E-2

    I was looking at processes from all users in task manager, I found that when I closed sprtsvc.exe and tgsrvc.exe that my computer speeded way up.
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's just stuff from Dell Support. If you don't want it/don't use it then uninstall it.

    However your large issue is misuse of protection software that the READ & RUN ME warned you about riight at the beginning. You have three antivirus progams and possibly two to three firewalls running. The below were seen in your logs.

    avast! Free Antivirus
    Verizon Servicepoint 3.5.10
    Vz In Home Agent
    ZoneAlarm Firewall
    ZoneAlarm Pro
    ZoneAlarm Security
     
  4. benjyb

    benjyb Private E-2

    Thanks,
    Zonealarm pro is the only firewall i am running.
    Zonealarm firewall and zonealarm security were part of a free trial, I uninstalled them a long time ago, but maybe there are remnants left in the system I didn't know about.
    I had no idea the what the verizon programs were, I just thought it was something from the internet service provider (verizon). I don't think they have been functioning as an antivirus program or firewall, at least I have never seen any alerts, messages, or updates from either one of them. In any event, I have unstalled them both from the control panel- programs list.
    I am still concerned that a program I tried to download last week may have installed some malicious code in the registry, It's still taking a long time to build web pages and sometimes when I type there is a big delay between the keystrokes and the action on the monitor. None of this was happening before last week.
    Should I run the cleaning process again?
    Thanks again for your help.
    BenjyB
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    No! Let's just get a new log from MGtools so that I can see what your status is after what you have uninstalled. If there are any left overs from the security applications, we will clean them up. It may become necessary to uninstall ALL of them. We shall see. Please do not do anything unless I request it.
     
  6. benjyb

    benjyb Private E-2

    Here is the new mg log. Thanks again!
    benjyb
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay I see that you uninstalled these:
    Verizon Servicepoint 3.5.10
    Vz In Home Agent

    But I think we need to uninstall all the others too to possibly correct the damaged caused from having too many security programs installed. Please follow the instructions below and do not reinstall anything until requested. We must make sure all traces are removed before anything is reinstalled.

    Now uninstall each of the below:
    avast! Free Antivirus
    ZoneAlarm Firewall
    ZoneAlarm Pro
    ZoneAlarm Security


    Now please download OTM by Old Timer and save it to your Desktop.
    • Run it by double clicking on it (Note: if using Vista, Win7, or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
    explorer.exe
     
    :Services
    gupdate
    gupdatem
    IswSvc
    vsmon
    WMPNetworkSvc
     
    :Files
    C:\Program Files\Alwil Software
    C:\Program Files\CheckPoint
    C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    C:\Program Files (x86)\Verizon
    C:\Windows\TEMP\*.*
    C:\Users\Ben\AppData\Local\Temp\*.*
    C:\$Recycle.Bin\S-1-5-21-3221300658-2471855494-4147940375-1000\*.*
     
    :Reg
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "avast"=-
    "ZoneAlarm"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "TrueImageMonitor.exe"=-
    "VerizonServicepoint.exe"=-
    "tvncontrol"=-
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\windows\currentVersion\Run]
    "avast"=-
    "ZoneAlarm"=-
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}"=-
    :Commands
    [purity]
    [EmptyTemp]
    [start explorer]
    
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.


    Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.txt log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    Last edited: Apr 4, 2013
  8. benjyb

    benjyb Private E-2

    Thank you again. I have done as you instructed. The Avast program locked with an error message when I tried to remove it, but it is gone from the list in control panel, and I removed zonealarm pro, everything else wasn't listed, I assume it's all gone.
    Things are running much faster, although I have not reinstalled an antivirus program or zonealarm.
    I have included the logs.
    Thanks again, you are great.

    benjyb
     

    Attached Files:

  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. That looks better.

    Now download and install Avast! Free Edition Only install it and nothing else. Then reboot and see how things are working with only Avast being added.

    Note that thus far we have not been working on any malware problems. You do not have any.

    Earlier I had mentioned that those programs you stopped were support software from Dell. I see you do not have Dell but are using software from Spinco ( you installed it ) that is similar support software. You have "Spinco Download Manager downloads and installs the Spinco Broadband software and any Broadband Essentials and Extras that you purchased." My comment still applies. Uninstall things you don't use or don't need. This is probably fits that description of not being needed.
     
    Last edited: Apr 6, 2013
  10. benjyb

    benjyb Private E-2

    I am running avast. So far everything is working fine. Thanks a lot. What about the firewall, should I put zonealarm pro back on it or use the windows one?
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Personally I think the more recent versions are too much of a pig and I prefer others which are more secure ( final instruction has a link to How to protect yourself from malware ). Also if you decide to put it back, you must make sure that you DO NOT install the whole security suite again or you will be right back to the same problems again.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds