Completely screwed up pc

[Dee_Collins]

Hi

 

My internet is just completely screwed up, I have super anti spyware installed (free version) Malwarebytes (free) installed Avast Antivirus also. Basically I cant really do anything on the net, cant search google,yahoo or log into my email, have millions of pop ups even though I have all the blockers on. The cursor is constantly flickering tons more than it has ever done before.

 

I have windows xp and IE 7

 

Can anyone help?

 

Thanks

Dee

[Tony D]

Let's start by disabling what you don't need. This is called booting to Safe Mode. You do this by tapping the F8 key immediately after starting the computer until the Start Menu comes up. Use the arrow keys to boot to Safe Mode with Networking.

 

Let us know how that goes.

[Dee_Collins]

Hi

 

Yep running in safe mode at the moment and i can do everything now, like log into my email and use the search engines now also. What should I do next?

[Dalo Harkin]

can you open a command prompt and type msconfig and display whats in the startup tab please. Edited June 30, 2008 by Dalo Harkin

[maynardvdm]

Hi

 

Please download the latest version of HijackThis from Trend Micro and click on Download Hijack This Installer and save it to your desktop.

• Doubleclick HJTInstall.exe to install HijackThis.
  
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
  
• Click on Install.
  
• It will create a HijackThis icon on the desktop.
  
• Once installed, it will launch Hijackthis.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in Notepad. Include this log by copying and pasting in your next reply.
  

Notes:

Do not use the AnalyseThis button, its findings are dangerous if misinterpreted.

Do not have Hijackthis fix anything yet. Most of what it finds will be harmless, or required for your computer to run like it should.

 

You can download this in Safe mode but "Run" it in normal mode.

[Dee_Collins]

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:52:14, on 30/06/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

D:\Program Files\Alwil Software\Avast4\ashServ.exe

D:\WINDOWS\system32\brsvc01a.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\system32\brss01a.exe

D:\WINDOWS\system32\imapi.exe

D:\WINDOWS\system32\svchost.exe

D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

D:\Program Files\Alwil Software\Avast4\ashWebSv.exe

D:\WINDOWS\system32\wscntfy.exe

D:\WINDOWS\system32\WgaTray.exe

D:\WINDOWS\Explorer.EXE

D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

D:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe

D:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe

D:\Program Files\Common Files\Real\Update_OB\realsched.exe

D:\WINDOWS\system32\rundll32.exe

D:\WINDOWS\system32\Rundll32.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

D:\Program Files\Windows Live\Messenger\msnmsgr.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! UK & Ireland

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://uk.red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/uk/*http://uk.docs.yahoo.

com/info/bt_side.html

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

Yahoo! Search - Web Search

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = M.O.T. Your PC ! <<>>

Intelenet | Intelligent Networking Solutions or email: mot@pdsystems.info

R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

D:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll

O3 - Toolbar: SYSTRAN Web Translator 5.0 - {A5899B52-3AF9-4F56-85FE-AD7B3BE8490F} -

D:\Program Files\SYSTRAN\5.0\Personal\IEPlugIn.dll

O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

D:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program

Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program

files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [bM8b4abea7] Rundll32.exe "D:\WINDOWS\system32\oyumqlmq.dll",s

O4 - HKLM\..\Run: [MSConfig] D:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] D:\Program

Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [setDefaultMidi] MIDIDEF.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] D:\Program

Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [setDefaultMidi] MIDIDEF.EXE (User 'Default user')

O8 - Extra context menu item: &AOL Toolbar search - res://D:\Program Files\AOL

Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: &ieSpell Options - res://D:\Program

Files\ieSpell\iespell.dll/SPELLOPTION.HTM

O8 - Extra context menu item: &Windows Live Search - res://D:\Program Files\Windows Live

Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: &Yahoo! Search - file:///D:\Program

Files\Yahoo!\Common/ycsrch.htm

O8 - Extra context menu item: Add to Windows &Live Favorites -

Add to Windows Live Favorites

O8 - Extra context menu item: Check &Spelling - res://D:\Program

Files\ieSpell\iespell.dll/SPELLCHECK.HTM

O8 - Extra context menu item: E&xport to Microsoft Excel -

res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Lookup on Merriam Webster - file://D:\Program

Files\ieSpell\Merriam Webster.HTM

O8 - Extra context menu item: Lookup on Wikipedia - file://D:\Program

Files\ieSpell\wikipedia.HTM

O8 - Extra context menu item: Open in new background tab - res://D:\Program Files\Windows

Live Toolbar\Components\en-gb\msntabres.dll.mui/229?96385411e23941a59bda1d2f2bc5bbc

O8 - Extra context menu item: Open in new foreground tab - res://D:\Program Files\Windows

Live Toolbar\Components\en-gb\msntabres.dll.mui/230?96385411e23941a59bda1d2f2bc5bbc

O8 - Extra context menu item: Yahoo! &Dictionary - file:///D:\Program

Files\Yahoo!\Common/ycdict.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - D:\Program

Files\ieSpell\iespell.dll

O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - D:\Program

Files\ieSpell\iespell.dll

O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - D:\Program

Files\ieSpell\iespell.dll

O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} -

D:\Program Files\ieSpell\iespell.dll

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program

Files\Yahoo!\Messenger\yhexbmes0527.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} -

D:\Program Files\Yahoo!\Messenger\yhexbmes0527.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network

Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program

Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

D:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) -

http://upload.facebook.com/controls/FacebookPhotoUploader5.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation

Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) -

http://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3

_instmodule.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - D:\Program

Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) -

http://www.eset.eu/buxus/docs/OnlineScanner.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program

Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe

Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner -

D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program

Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil

Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil

Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil

Software\Avast4\ashWebSv.exe

O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd -

D:\WINDOWS\system32\brsvc01a.exe

O23 - Service: Google Updater Service (gusvc) - Google - D:\Program

Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - D:\Program

Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 8684 bytes

[Dee_Collins]

can you open a command prompt and type msconfig and display whats in the startup tab please.

 

Hi

I did that and only have java and avast running on startup.

[Dalo Harkin]

Sorry I should have clarified - can you do this in normal mode - not safe mode

[Dee_Collins]

Hi

No that was ok as I did do it in normal mode not safe mode

[Dalo Harkin]

You should have much more running than that -

is there no microsoft stuff in there?

[Dee_Collins]

well the only things which are tcked are the following:

 

oyumqlmp (whatever that is)

ashDisp

jusched

 

The only reason I dont have loads is because I have had problems with my other pc and was told from this forum to only have Avast and Java running on startup, hence why only the above running. Have to amit I dont know what the first one is

[Tony D]

If it's running well in Safe Mode, then there's something in the startup routine that's causing the problem. I'm no expert in analyzing HiJackThis logs.

 

I can suggest going back to msconfig. Turn everything in the STARTUP tab off. In the SERVCES tab, click on HIDE MS SERVICES and disable all the non-MS services. Restart in normal mode and see how it works.

[AdvancedSetup]

Please start Hijackthis and do a

Scan Only

and place a check mark on the following items.

• 
  
• R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
  http://uk.red.clientapps.yahoo.com/c.../uk.docs.yahoo.com/info/bt_side.html
  
  
• R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! Search - Web Search
  
  
• R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = M.O.T. Your PC ! <<>> Intelenet | Intelligent Networking Solutions or email: mot@pdsystems.info
  
  
• R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
  
  
• O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
  
  
• O4 - HKLM\..\Run: [bM8b4abea7] Rundll32.exe "D:\WINDOWS\system32\oyumqlmq.dll",s
  
  
• O4 - HKLM\..\Run: [sunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  
  
• O4 - HKLM\..\Run: [bM8b4abea7] Rundll32.exe "D:\WINDOWS\system32\oyumqlmq.dll",s
  
  
• O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  
  
• O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  
  
  Then click on
  Fix selected

 

Then download and run this

CureIt 4.44

then restart your computer and let me know how its running.

 

 

.

[AdvancedSetup]

After the reboot you need to go into your Control Panel, Add/Remove and uninstall ALL versions of Java found. Then reboot your computer and obtain a new version from here

Java Runtime Environment (JRE) 6 Update 6

 

 

The older versions of Java have code that has been compromised and allows your system to get infected very easy.

 

 

.

[AdvancedSetup]

Are you still here with us DEE?

[Dee_Collins]

Yes sorry I am still here just trying to do all that you have suggested, hving a few problems doing the java download atm, but getting there slowly, as soon as I have it figured I shall let you know how its running.

[Dee_Collins]

Hi

 

I have finished doing what you said and the pc seems to be running loads better now, I can log into emails and searcg google etc, one thing though I did have a window appear after java had finished installing saying there was a fatl error and something couldnt be opened but I didnt see what it was as it then disappeared....

 

Another thing that has happened is I am constantly getting pop ups even though my blockers are enabled, I never used to get any pop ups at all

Edited July 2, 2008 by Dee_Collins

[AdvancedSetup]

Good glad to hear it's better. Did you download and run the CureIt 4.44 program I linked to above?

 

Please download and run that program. Let me know what it finds.

 

Then we will run a FULL scan and clean routine that you need to follow the steps exactly as outlined. I won't post those instructions though until I hear back from you about the CureIt 4.44 program results.

 

.

[Dee_Collins]

The scanner found the following:

 

A0148422.exe Probably BACKDOOR Trojan

A0148423.exe Probably BACKDOOR Trojan

A0148424.exe program.mIRC.616

 

Whilst the scan was running my Avast kept finding Adware, should I press cure on the above items?

[Dee_Collins]

I did do a scan yesterday with that program and it did pull up more and so i clicked cure and it managed to delete a few and the ones it couldnt cure it moved. I had to click yes or no else the scan wouldnt continue. Most of what it found yeaterday were backdoor trojans

[Guest Wolfeymole]

If you run mIRC on a continual basis then do not allow people to send you files via CCP.

 

Configure it to; Only accept on request.

 

If you are unsure of how to set it let me know.

[Dee_Collins]

What is mIRC and what is CCP? if you dont mind me asking, I dont really know too much about pc's

[Guest Wolfeymole]

You have an entry in your previous post listing this;

 

A0148424.exe program.mIRC.616

 

mIRC is an acronym for Internet Relay Chat and part of that software allows CCP (Client to Client Protocol) file sharing in other words.

 

You must have installed mIRC software at some period Dee.

[Dee_Collins]

So what do I need to do now and how do I do it?

[Guest Wolfeymole]

Can I just hark back and ask why all system files etc are on D: rather than C:

 

What happened to make you change the drive letter?