GeekPolice
Would you like to react to this message? Create an account in a few clicks or log in to continue.

GeekPoliceLog in

 


descriptionwindows update and security software problem Emptywindows update and security software problem

more_horiz
since a few days back that i been trying to update windows but cant access the site nor can i access any security related site.
biggest problem is i cant update any of my anty spy software nor anti virus
the only one that runs proper is SUPER anti spyware but still cant update it.
help please !!! Let me think

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
Sounds like the tdss rootkit.
Please read here and post a Hijack This log.

http://www.geekpolice.net/malware-removal-hijackthis-logs-f11/read-this-before-posting-t3821.htm

descriptionwindows update and security software problem Emptyhijackthis log and uninstall

more_horiz
hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:57 Viper, on 10-01-2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\Programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\Programas\Spybot - Search & Destroy\TeaTimer.exe
C:\Programas\IObit\Advanced SystemCare 3\AWC.exe
C:\Programas\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Programas\SUPERAntiSpyware\39ec86d9-a79f-4a96-ba3f-7ca4f67b6ae6.exe
C:\Programas\Styler\Styler.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\EnterMadeira\Ambiente de trabalho\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programas\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [BootWarn] C:\Programas\Norton AntiVirus\BootWarn.exe /a
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programas\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [SmartRAM] "C:\Programas\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programas\SUPERAntiSpyware\39ec86d9-a79f-4a96-ba3f-7ca4f67b6ae6.exe
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Programas\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programas\WinPcap\rpcapd.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Programas\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programas\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe

--
End of file - 4468 bytes


and uninstall list

2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
32 Bit HP CIO Components Installer
Actualização de segurança para Windows Internet Explorer 7 (KB928090)
Actualização de segurança para Windows Internet Explorer 7 (KB938127)
Actualização de segurança para Windows Internet Explorer 7 (KB944533)
Actualização de segurança para Windows Internet Explorer 7 (KB950759)
Actualização de segurança para Windows Internet Explorer 7 (KB953838)
Actualização de segurança para Windows Internet Explorer 7 (KB956390)
Actualização de segurança para Windows Internet Explorer 7 (KB958215)
Actualização de segurança para Windows Internet Explorer 7 (KB960714)
Adobe Acrobat 6.0 Professional
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 8.1.2
Adobe Stock Photos 1.0
Adobe SVG Viewer 3.0
Advanced SystemCare 3
AnswerWorks Runtime
Askey Cable Modem
ATUpdater
Autodesk Architectural Desktop 3.3
BitComet 0.99
Calculator Powertoy for Windows XP
CCleaner (remove only)
CDDataExtract 2.0
Compressor WinRAR
Convert
ConvertXtoDVD 3.2.1.55b
Dicionário WebDic
DivX Player
DivX Pro Trial
DVD Decrypter (Remove Only)
DVD Region Killer
DVD Shrink 3.2
DVDFab HD Decrypter 3.1.3.6 Beta
East-Tec Eraser Lite Version 8.5
EasyBox
Google SketchUp 6
Google SketchUp 6
HijackThis 2.0.2
Hotfix para Windows Internet Explorer 7 (KB947864)
HP Deskjet All-In-One Software 8.0
HP Imaging Device Functions 8.0
HP Photosmart Essential
Internet Explorer Developer Toolbar
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 7
Keyboard Music 2.4
K-Lite Codec Pack 3.8.5 Full
LiveReg (Symantec Corporation)
LiveUpdate 2.6 (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (Portuguese (Brazil)) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (Portuguese (Brazil)) 2007
Microsoft Office Groove MUI (Portuguese (Brazil)) 2007
Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2007
Microsoft Office OneNote MUI (Portuguese (Brazil)) 2007
Microsoft Office Outlook MUI (Portuguese (Brazil)) 2007
Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (Portuguese (Brazil)) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (Portuguese (Brazil)) 2007
Microsoft Office Publisher MUI (Portuguese (Brazil)) 2007
Microsoft Office Shared MUI (Portuguese (Brazil)) 2007
Microsoft Office Word MUI (Portuguese (Brazil)) 2007
Microsoft User-Mode Driver Framework Feature Pack 1.5
Mozilla Firefox (3.0)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6 Service Pack 2 (KB954459)
MV2Player (remove only)
Nero Suite
Nokia Connectivity Cable Driver
Nokia PC Suite
Nokia PC Suite
Nokia Software Updater
NVIDIA Windows 2000/XP Display Drivers
Pacote de controladores do Windows - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)
Pacote de controladores do Windows - Nokia Modem (02/15/2007 3.1)
Pacote de controladores do Windows - Nokia Modem (02/15/2007 3.1)
Pacote de controladores do Windows - Nokia Modem (05/24/2007 6.84.0.1)
PC Connectivity Solution
PowerDVD
RCA Digital Cable Modem
Samsung Network Manager
Samsung Smart Screen
Samsung Theme
Samsung Update Plus
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
SENS Keyboard V4 Launcher
SENS LT56ADW Modem
Spybot - Search & Destroy
SUPERAntiSpyware Professional
Synaptics Pointing Device Driver
Timershot Powertoy for Windows XP
tmn
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb958619)
USB PC Camera Plus
User's Guide
Vista Transformation Pack 6.0
Warrior Kings Battles
Windows Genuine Advantage v1.3.0254.0
Windows Imaging Component
Windows Internet Explorer 7
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
WinPcap 4.0.1
WinZip 11.1

cant access updates
and a few sites all security related
thx

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
Hello.
I see Hijack This running from here, but I also see a sign in HJT of an old infection.
C:\Documents and Settings\EnterMadeira\Ambiente de trabalho\HijackThis.exe

Please right click HijackThis.exe and rename it to fixme.exe
Submit a new Hijack This log.

descriptionwindows update and security software problem Emptyno net available

more_horiz
lost net on that pc and now all usb doors not working anymore done the rename for hijackthis.exe as you told me

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
Not sure why net connection was broken, we haven't done anything yet. LMBO or ROFL

Now it's renamed, does it have any 02/020 items?

descriptionwindows update and security software problem Emptylol not yet

more_horiz
no 02/020 items there
Let me think

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
Okay.
If USB doesn't work, and we don't have a net connection, we can't really download tools to fix stuff.
We can only try repairing net connection with Windows tools.

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
virus or whatever the problem keeps on cutting me off.
cant run a scan on spy bot nor malware bytes the only one working is superantispyware.
and i cant update any of those too
usb problem fixed now so here goes the updated hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:29 Viper, on 10-01-2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\Programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\Programas\Spybot - Search & Destroy\TeaTimer.exe
C:\Programas\IObit\Advanced SystemCare 3\AWC.exe
C:\Programas\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Programas\SUPERAntiSpyware\39ec86d9-a79f-4a96-ba3f-7ca4f67b6ae6.exe
C:\Programas\Styler\Styler.exe
C:\Programas\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\EnterMadeira\Ambiente de trabalho\fixme.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programas\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [BootWarn] C:\Programas\Norton AntiVirus\BootWarn.exe /a
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programas\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [SmartRAM] "C:\Programas\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programas\SUPERAntiSpyware\39ec86d9-a79f-4a96-ba3f-7ca4f67b6ae6.exe
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Programas\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programas\WinPcap\rpcapd.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Programas\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programas\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe

--
End of file - 4419 bytes

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Leave the script box empty.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
viperex - sorry for any confusion, mistakes happen.

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
hey all problems fixed
manually update superantyspyware which detected unknow origin trojan 7 entries then allowed spybot S&D to run proper after update it did detected tdss rootkit aswell as Virtumonde 22 entries all together.
Updates working and all software back and running.
Many thanks for your time.
will be back as soons as i wreck it all up again lol
thx

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.

descriptionwindows update and security software problem EmptyRe: windows update and security software problem

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum