Random weirdness

Discussion in 'Malware Help (A Specialist Will Reply)' started by Poppi22, Nov 21, 2010.

  1. Poppi22

    Poppi22 Private E-2

    Recently I've been having some random weirdness...one BSOD, several problems crop up where I have message that some memory write can not be written. The kicker was a random popup (which I never ever get) that said an XBox 360 was detected and I should buy some new xbox 360 hardware...so I've ran through your recommened cleaning procedure. Rootrepeal would not run. Said "Decompression Error (5)!". Atached are the other logs. I typically keep a pretty tight ship. Hope you are able to assist in figuring out what is up.

    Looking forward to your assistance.
     

    Attached Files:

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there and welcome. I am currently reviewing your logs and will get back to you with a set of instructions in the next post I make to you.
     
  3. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Not seeing any malware.

    If you do not use Windows Messenger Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    You need to uninstall one of the two anti virus. Perhaps keep Comodo as it has a firewall as well.

    • COMODO Internet Security
    • Avira AntiVir Personal - Free Antivirus

    Also delete all files in the below bold folder except ones from the current date (Windows will not let you delete the files from the current day).
    You can post in the software forum regarding BSOD's and other non malware related problems.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  4. Poppi22

    Poppi22 Private E-2

    Thanks for your thorough review...I thought Comodo was a firewall. Is it possible to run it only as a firewall?

    Thanks again.
     
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Attached Files:

  6. Poppi22

    Poppi22 Private E-2

    Just a follow up on this...I still have some strange things going on. Every couple of days after I am off my machine for x minutes it goes to the page where any user can log in. When I select my user (I have a user w/ no admin privileges that I use normally) it asks for a password to get in...but I have no password on this user. My only option is to punch it out w/ the power button for 5 seconds. Additionally, today for instance, the Microsoft phishing filter popup came up. I did not touch it, tried to open Task manager but couldn't. Punched it out again as I refused to touch the phishing filter screen I did not select.

    If I can get the Rootrepeal to run do I need to go through the entire cleaning procedure again before sending that log to you? I feel like something is going on, even though generally most things are OK.

    Any additional advice would be appreciated.
     
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You can go through the whole procedures again if you wish, keep to this thread as it rather short anyway. Attach logs when ready.
     
  8. Poppi22

    Poppi22 Private E-2

    I just ran a complete system scan with Avira and found something called BDS/IRCNite.agw I sent it along to them as it was not in their definition lists. I'll keep an eye on this for a bit and see what occurs. But stick to this post, correct?
     
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes. Stick to this thread. What was the file path of the threat your antivirus found?
     
  10. Poppi22

    Poppi22 Private E-2

    C:\Program Files\EnglishOtto\ActiveOttofull.dll

    Don't even know what this is...
     
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

  12. Poppi22

    Poppi22 Private E-2

    Read through it all...lots of random streams of conciousness it seems. If I understand correctly the best thing to do is delete Otto...do you concur?

    Thanks again.
     
  13. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes, if you don't want it or don't use it.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds