Win.32.AutoRun.tmp/browser redirect/windows updates disabled

Discussion in 'Malware Help (A Specialist Will Reply)' started by sjbruce, Dec 10, 2010.

  1. sjbruce

    sjbruce Private E-2

    Hi Hope I am posting in the right place as never done this before. (was in the software thread but was suggested it goes here.)

    I had a virus Win.32.AutoRun.tmp picked up by spotbot which I think has now gone as Spybot showing no infection, Malware and Superanti Spyware are all were coming up clean. Was also having browser redirect issues which seem to be ok.

    However, windows automatic updates is off - if I try and turn on in the security center it says We are sorry the security centre could not change your settings - go to control panel and the automatic updates tab. But there is no icon in the control panel and no tab for automatic updates in system properties. Tried going onthe microsoft site to download and receive error and cannot install active x to check.

    Also cant do a system restore in safe mode as when I select a date and click next nothing happens.


    Machine is running Windows XP MediaCenter Service Pack 3 and have AVG Free 2011.

    Any help would be greatly appreciated as I seem to be going round in circles
     
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  3. sjbruce

    sjbruce Private E-2

    Hi thanks for info.

    I have got as far step 3 and encountered an error with the Java. I have uninstalled the old versions - rebooted and started to install the latest version.

    Starts installing and then get a pop up box with Java Setup Internal Error 2352. Have to click Ok and then stops installing.

    Not sure what to do now.

    Thanks.
     
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Continue on, if one step fails, move onto the next. Attach what logs you then have for Tim.
     
  5. sjbruce

    sjbruce Private E-2

    Hi here are the logs - I have worked down the list.

    As previously mentioned encountered an error with the Java. I uninstalled the old versions - rebooted and started to install the latest version. Starts installing and then get a pop up box with Java Setup Internal Error 2352. Have to click Ok and then stops installing. So I skipped this step.

    Was unable to run combofix as it said I had to uninstall AVG - tried to uninstall AVG but recd error saying AVG Watchdog could not be stopped so had to skip that.

    Any advice greatly appreciated.

    If I need to do anything more please let me know.
     

    Attached Files:

  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Download The Avenger by Swandog469, and save it to your Desktop.

    * Extract+ avenger.exe from the Zip file and save it to your desktop

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    * Run avenger.exe by double-clicking on it.
    * -Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now run Ccleaner to clean out only temp files and nothing else!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\Avenger.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  7. sjbruce

    sjbruce Private E-2

    Hi all run successfully - I did receive a success message adding the text to the registry.

    Log files attached as requsted.

    Computer rebooted very quick.

    Automatic updates still off in the security center and wont allow me to turn it on.

    No automatic updates icon in the control panel or system When I right click on My computer & select properties I get an error message

    rundll32.exe - unable to locate component
    This application has failed to start because Cabinet.dll was not found. Reinstalling the application may fix this problem


    Thanks Steph
     

    Attached Files:

  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean. You should disable TeaTimer and then see if you can enable updates. You may also need to go to run / and type :

    sfc /scannow and have your Windows cd handy. But these are issues that need to be addressed in the software forum.

    Since you are not having any malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:




    Help Support MajorGeeks
    Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

    Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

    MajorGeeks on FaceBook
     
  9. sjbruce

    sjbruce Private E-2

    Hi many thanks for your help - at least it is all clean. I have now posted in the software forum to see if they can help.

    Thanks again.
     
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds