two computers looking for connections from others

GlennJr · Mar 10, 2006

I have a small business with several computers. Two have spyware problems.

Norton detects this but can not remove it. I get numerous warnings about the computers looking for connections. I have read your instructions and followed them to the best of my ability.

I may have messed up on bitdefender. It tried to do an active x installation, I feared this was spyware, but then could not get the report from that program.

I am trying to attach the necessary files. Each time I click on upload it looks like it is not working. Hopefully it is and I'm just too stupid to find where it indicates that there are attachments.

chaslang · Mar 10, 2006

Welcome to Majorgeeks!

Maybe this will help you: HOW TO: Attach Items To Your Post

Make sure you run ALL steps in the READ ME and attach the three requested logs:
Bitdefender
PandaActiveScan
HijackThis (make sure you follow instructions in step 7 properly).

GlennJr · Mar 11, 2006

Thanks.

Running the scans really helped. But I'm still getting the message:

Windows Kernel Core component is attempting to listen to connections from other computers.

I did get the attachments uploaded this time. Any help would be greatly appreciated. Thanks.

chaslang · Mar 12, 2006

Do you have any idea what the below is for?
O4 - Startup: map.pif = C:\MAP.BAT

This runs each time you start your PC.

Your HJT logs is pretty clean. There are just a few things to cleanup from your Panda and CounterSpy logs.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

REGEDIT4
[-HKEY_CURRENT_USER\Software\msbb]
[-HKEY_CLASSES_ROOT\clsid\{954814c0-40f3-4249-8528-b4922cd2964e}]
[-HKEY_CLASSES_ROOT\clsid\{a54814c0-40f3-4249-8528-b4922cd2964e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
"C:\WINDOWS\Downloaded Program Files\QDow_AS2.dll"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/QDow_AS2.dll]
[-HKEY_CLASSES_ROOT\protocols\name-space handler\res]
[-HKEY_LOCAL_MACHINE\software\classes\protocols\name-space handler\res]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8DA5457F-A8AA-4CCF-A842-70E6FD274094}]
Click to expand...

Then locate the below file using Windows Explorer and delete them:
c:\windows\inf\conscorr.inf
c:\windows\conscorr.ini
C:\WINDOWS\INF\POLALL1R.INF
C:\TEMP\FLEOK <--- the whole folder
c:\temp\msbb.log

GlennJr · Mar 15, 2006

Thanks for taking the time to help, I really appreciate it.

chaslang · Mar 15, 2006

GlennJr said:

Thanks for taking the time to help, I really appreciate it.
Click to expand...

You're welcome but you did not give any feedback on my last message.

Also are you still having any malware problems?

GlennJr · Mar 16, 2006

chaslang said:

You're welcome but you did not give any feedback on my last message.

Also are you still having any malware problems?
Click to expand...

It looks like it is fixed. Thanks. If other problems pop up I'll be sure to come back, but it looks like it is fixed.

chaslang · Mar 16, 2006

You're welcome. It is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

GlennJr · Mar 17, 2006

Got it. THANKS again.

chaslang · Mar 17, 2006

You're welcome. Surf safely!

Log in or Sign up

two computers looking for connections from others

GlennJr Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

GlennJr Private E-2

Attached Files:

Activescan.txt

BitDefender Online Scanner - Real Time Virus Report.txt

hijackthis.log.txt

counterspy.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

GlennJr Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

GlennJr Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

GlennJr Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member