WiredWX Hobby Weather ToolsLog in

 


Can someone here actually help with this Win32/Nuqel.E?

3 posters

descriptionCan someone here actually help with this Win32/Nuqel.E? - Page 3 EmptyRe: Can someone here actually help with this Win32/Nuqel.E?

more_horiz
Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)


  • Press "Fix Checked"
  • Close Hijack This.

Go to Start > Run. In the Run box, copy and paste in the following:

sc stop AvgTdiX

Hit enter, then repeat for this command.

sc delete AvgTdiX

Hit enter.

How is the machine running now?

descriptionCan someone here actually help with this Win32/Nuqel.E? - Page 3 EmptyRe: Can someone here actually help with this Win32/Nuqel.E?

more_horiz
Ok...going to go and do your last instructions....while i'm away...can you go over this report from that Avira scan and let me know if these are things to worry about.....It supposably quarantined that crypted item just minutes before....

descriptionCan someone here actually help with this Win32/Nuqel.E? - Page 3 EmptyRe: Can someone here actually help with this Win32/Nuqel.E?

more_horiz
Avira AntiVir Personal
Report file date: Thursday, November 12, 2009 17:30

Scanning for 1894103 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : JAYHAWK21

Version information:
BUILD.DAT : 9.0.0.407 17961 Bytes 7/29/2009 10:34:00
AVSCAN.EXE : 9.0.3.7 466689 Bytes 7/21/2009 20:36:14
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 17:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 18:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 17:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 19:30:36
ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 6/24/2009 16:21:42
ANTIVIR2.VDF : 7.1.6.222 5998592 Bytes 11/11/2009 22:44:23
ANTIVIR3.VDF : 7.1.6.223 2048 Bytes 11/11/2009 22:44:23
Engineversion : 8.2.1.65
AEVDF.DLL : 8.1.1.2 106867 Bytes 11/12/2009 22:44:31
AESCRIPT.DLL : 8.1.2.44 586107 Bytes 11/12/2009 22:44:31
AESCN.DLL : 8.1.2.5 127346 Bytes 11/12/2009 22:44:30
AERDL.DLL : 8.1.3.2 479604 Bytes 11/12/2009 22:44:30
AEPACK.DLL : 8.2.0.3 422261 Bytes 11/12/2009 22:44:28
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 7/23/2009 16:59:39
AEHEUR.DLL : 8.1.0.180 2093432 Bytes 11/12/2009 22:44:27
AEHELP.DLL : 8.1.7.0 237940 Bytes 11/12/2009 22:44:25
AEGEN.DLL : 8.1.1.74 364917 Bytes 11/12/2009 22:44:25
AEEMU.DLL : 8.1.1.0 393587 Bytes 11/12/2009 22:44:24
AECORE.DLL : 8.1.8.2 184694 Bytes 11/12/2009 22:44:24
AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 21:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 15:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 17:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 21:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 17:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 3/24/2009 22:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 17:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 22:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 15:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 17:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/15/2009 22:39:58
RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/17/2009 17:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: Thursday, November 12, 2009 17:30

Starting search for hȋdden objects.
'39622' objects were checked, '0' hȋdden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'PokerStars.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'SearchProtection.exe' - '1' Module(s) have been scanned
Scan process 'tfswctrl.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'mmtask.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'YahooAUService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
33 processes with 33 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '54' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\System Volume Information\_restore{4C9CD2AC-0854-47F4-ADD1-9B1E100E509B}\RP178\A0028833.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4C9CD2AC-0854-47F4-ADD1-9B1E100E509B}\RP178\A0028834.scr
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4C9CD2AC-0854-47F4-ADD1-9B1E100E509B}\RP183\A0029236.pif
[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

Beginning disinfection:
C:\System Volume Information\_restore{4C9CD2AC-0854-47F4-ADD1-9B1E100E509B}\RP178\A0028833.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '4b2ca27e.qua'!
C:\System Volume Information\_restore{4C9CD2AC-0854-47F4-ADD1-9B1E100E509B}\RP178\A0028834.scr
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '4b2ca27f.qua'!
C:\System Volume Information\_restore{4C9CD2AC-0854-47F4-ADD1-9B1E100E509B}\RP183\A0029236.pif
[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)
[NOTE] The file was moved to '4a5ef5d8.qua'!


End of the scan: Thursday, November 12, 2009 18:03
Used time: 32:41 Minute(s)

The scan has been done completely.

4594 Scanned directories
114897 Files were scanned
3 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
3 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
114893 Files not concerned
728 Archives were scanned
1 Warnings
4 Notes
39622 Objects were scanned with rootkit scan
0 hȋdden objects were found

descriptionCan someone here actually help with this Win32/Nuqel.E? - Page 3 EmptyRe: Can someone here actually help with this Win32/Nuqel.E?

more_horiz
Ok...I've tried putting that command in the *run* window...I am seeing a window trying to pop-up...which looks like the dds scan window..( all black)...but it is just disappearing before I can do anything else

descriptionCan someone here actually help with this Win32/Nuqel.E? - Page 3 EmptyRe: Can someone here actually help with this Win32/Nuqel.E?

more_horiz
Hello.
That is all that is meant to happen, black window popups, then closes again real quick.

Avira report is fine, just restore points.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck. Big Grin

descriptionCan someone here actually help with this Win32/Nuqel.E? - Page 3 EmptyRe: Can someone here actually help with this Win32/Nuqel.E?

more_horiz
Ok...I've installed firefox as you suggested...I already had the windows updates turned on, so there were no updates I needed...and I uninstalled spysweeper, as well as downloaded outpost firewall.

Still getting the static from my speakers..even when I have the volume turned all the way down, so that's a bit annoying, but other than that, everything seems to be running decent.

I'll certainly go fill out the form for you..as well as ask..your suggestion of size of system I should upgrade to. Since this is about 6 years old now, I think I might go ahead and see if I can still get a little out of it and put it towards something newer....

descriptionCan someone here actually help with this Win32/Nuqel.E? - Page 3 EmptyRe: Can someone here actually help with this Win32/Nuqel.E?

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum