infected

Eric Happy Meal · May 24, 2006

in the middle of doing that 7 step process thing. But right now im doing the bitdefender scan right now and none of my problems have been fixed, so i figured id make this post while im in the middle of another 2+ hour scan.

but whats happening is that whenever i run spybotSD it finds the same problems and trys to fix them i guess, but 15 minutes later i can run the scan again and it will find the same problems. alot of the things it picks up are "windows security center" ones that have firewall overide, sp2update disable, autoupdate disable and a few other problems. in IE it doesnt allow me to edit my homepage.

a problem i had when trying to do the normal process in that post was with the windows defender. it says the definitions are 118 days old, and whenever i try to update them i get an error (i also cant do any windows updates through their site)

so im just checking to see if anyone has any ideas as to what has infected my comp, if not i guess well have to wait for this scan to finish and the next one as well, then the hijack this scan.

chaslang · May 24, 2006

Welcome to Majorgeeks!

There can be literally a dozen or more malware reasons for Windows updates not working. There can also be just as many non-malware reasons for it not working. We will have to see the logs to know what is really going on. Is your copy of Windows legit? Did you go thru the Windows Genuine Advantage authentication procedure yet? If not, updates will not work.

Also since you are questioning what Spybot is doing, attach a log from Spybot. Some of the items you are saying Spybot is finding are not problems. They are just informational.

Eric Happy Meal · May 24, 2006

ok, heres the scan log from spybot, gonna be running the last two online tests today so ill post those logs later tonight.

edit: and yes my windows is legit and i tried the authentecation page, but it already was.

chaslang · May 24, 2006

Looks like you did not allow Spybot to fix problems? Is there a reason for that?

The below are not problems, they are just to inform you that you have change the settings of the OS from defaults.

Windows Security Center.SP2Update: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotAllowXPSP2!=dword:0
Windows Security Center.AntiVirusOverride: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride!=dword:0
Windows Security Center.FirewallOverride: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride!=dword:0
Windows Security Center.FirewallDisableNotify: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0
Windows Security Center.AntiVirusDisableNotify: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0
Windows Security Center.UpdateDisableNotify: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify!=dword:0
Click to expand...

Eric Happy Meal · May 25, 2006

i did let it fix the problems, i just saved the log before that because i didnt know if i could afterwards and didnt think right.

but for the windows firewall setting all the options are in grey letters and it doesnt let me change it.

chaslang · May 25, 2006

Eric Happy Meal said:

i did let it fix the problems, i just saved the log before that because i didnt know if i could afterwards and didnt think right.
Click to expand...

Okay so then what exactly are the problems you are complaining about that remain. I repeat, the messages about Windows Security Center stuff are not problems. They are just informing you that you have changed from the Windows default settings. This occurs when you install your own antivirus, firewall, etc software rather than keeping the Windows default settings. It is normal unless you have not installed an antivirus or firewall of your own. Then it would be abnormal.

Also you have disabled the ability of Windows update to install WinXP SP2. This is something you did. It is not malware.

If you are having other true malware issues, please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

Bitdefender

Panda Scan

HijackThis

.

Log in or Sign up

infected

Eric Happy Meal Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Eric Happy Meal Private E-2

Attached Files:

SpybotSD.Results.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Eric Happy Meal Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member