Yikes! says I'm infected

[easyas]

So sorry 1972vet. Yes, there is no (CD) E:drive in "My Computer". I went to device manager and it shows the drives as either not installed or not responding. They are;
UY3637D ISA264D SCSI CdROM DEVICE
TSST corp CD/DVDW TS-L632C
Device manager shows them as (!) in a yellow circle.

Running a scheduled defragmentation sounds like a great idea. I did not receive any recommendations to not disk defrag and no reference to a % was made. hmm.

NO! nup, nada. have not used any registry cleaners. Is there evidence of their use? That will be an interesting conversation in the office- I did notice new xerox software which I know nothing about.
I should point out that I'm not afraid to reformat the hard drive and start afresh. This machine was reformatted about 3 months ago-saving some files to disk would be nice though. Lets get adventurous!!
Look forward to your thoughts vet,
easyas

[easyas]

On further thought, about 9 months ago the computer did run systemchecks often on startup.It was checking the registry and fat32 files. whatchathink?

[1972vet]

In device manager, where you see the (!) in a yellow circle, right-click on the device and select "Update Driver".

about 9 months ago the computer did run systemchecks often on startup

...then windows found the volume to be "dirty".

When Windows XP encounters a problem and has to shut down improperly, perhaps there is a power outage, a motherboard problem etc...The operating system will "flag" the volume as "dirty" and attempt to check it on reboot.
You can manually check the state of the dirty flag for your C: drive. To do this at the Command Prompt type : fsutil dirty query c:

The response should be Volume - c: is NOT Dirty

I believe, on reformatting and reinstalling the operating system, windows naturally wants to check the disk for errors on the first reboot. If your system was just reinstalled three months ago, perhaps you need to run the chkdsk /r again.

Please advise your results.

[easyas]

I have posted 2 replies. are they getting through? MY BROWSER SAYS NO.....

[easyas]

Did update drivers- no new/better drivers found.
did c:prompt xxx and got NOTdirty response.
Last week the cd drive was used I,'m told, but I don't know what for or why....
Updated the drivers but they continue to show (!) in yellow on inspection. wrestling crocodiles is easier than this.....

[1972vet]

wrestling crocodiles is easier than this.....

That may be for you "Down Under" folks...but I hope never to have such an experience with which to compare

Please return to the device manager. First, click the + sign next to the "DVD/CD-Rom drives" and tell us how many items are listed there? Next, select the device with the (!) in yellow and right-click on it once again. This time select "Uninstall". When completed, click on the Action option from the menu at the top of the Computer Management window and select "Scan for hardware changes". Allow Windows to find the device again and ask to install the driver. Give permission to go online to find it. Your driver should be found on the Windows Update site and reinstalled without a hitch. Post back and let us know your results. Thanks!

By the way, what on earth is a vegemite sandwich?

[easyas]

Hi 1972vet. Ther are 2 drivers listed under the CD/DVD rom drives. They are;
UY3637D ISA264D SCSI CdROM DEVICE
TSST corp CD/DVDW TS-L632C
They have the yellow chk nect to them.
Running the uninstall and search and download yielded interesting results;
"A problem occured during hardware installation. Your new hardware may not work properly" .
However, there was no prompting from windows to install the drivers, no permission to go online to find the drivers and their reappearance in the device manager took mere nanoseconds. I really suspect they are not uninstalling at all. I repeated the steps 4 times with the same results, I'll try a manual search of the windows update site in the meanwhile.

I don't know how to describe vegemite. It's one of those things you've either done or you haven't. Its a black sludge the is truly revolting in excess but slightly sweet, bitter and salty in moderation. Enjoyed on toast in the morning and between two slices of bread in a lunchbox, Its the vegetable protein boost that has powered generations of malvern-stars between school and home. This help?

Look forward to your thoughts
easyas

[1972vet]

I don't know how to describe vegemite. It's one of those things you've either done or you haven't. Its a black sludge ...

...uhmmm, thanks. I thought it was a made up word from that song (which is where I first heard the term). Just based on your first few words in the description I think I'll pass.

OK, here's the deal...your device listing actually should only show one device as your CD (or DVD)-ROM unless you actually have more than one installed. Do you? Or have you perhaps installed some external CD or DVD ROM drive?

Are both of those devices showing under the "DVD/CD-ROM drives" section in the device manager or is at least one of them showing under "Other"?

Let's try to repair a registry setting that may be causing this issue but first be certain to back up your registry:

Copy the text in the code box below into a blank Notepad and save it to your Desktop. Save it as Regbackup.bat and change the "Save as type:" to All Files

@echo off
:: variables
set drive=C:\Backup
set backupcmd=xcopy /s /c /d /e /h /i /r /y

echo ### Backing up the Registry...
if not exist "%drive%\Registry" mkdir "%drive%\Registry"
if exist "%drive%\Registry\regbackup.txt" del "%drive%\Registry\regbackup.txt"
regedit /e "%drive%\Registry\regbackup.txt"
echo Backup Complete!
@pause

Double-Click that .bat file and allow it to run. Press any key when finished.

This script copies the registry to the directory defined in the %drive% variable, or "C:\Backup" and creates a text copy of the registry. If the script is run multiple times, it will only rewrite if the source files are newer. It will create subdirectories as necessary, and it will retain file attributes. It can copy system and hidden files.

You can keep and use this .bat file later on if you like, to backup your registry from time to time as you may deem necessary. Each time you run the file it will create (in effect) a differential backup which means, it will write only what is current...so be careful how you use this.

Malware can write to your registry so you wouldn't want to run the file if you suspect you are infected with something (as of now, your system is clean)...likewise, if you uninstall some software then run this file, it will over write the .txt file creating a newer .txt backup file which does not contain the registry entries from the application you uninstalled. The file it generates is only a text copy of the registry and does not make any changes to your registry. You can use it to restore the registry but would need to make a change to the file format by changing the .txt to .reg

Next, please copy the data in the code box below into a blank notepad and save it as fixcdrom.reg
Set File type to "all files" and save this to your Desktop:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}]
"UpperFilters"=-
"LowerFilters"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr4_2K]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdralw2k]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdudf]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UdfReadr]

DO NOTHING ELSE WITH THIS FILE YET

Next, please reboot the computer into Safe mode. Once in safe mode and logged on with your usual user account, continue with the instructions below:

Return to the device manager and uninstall both devices mentioned earlier. DO NOT RESCAN FOR HARDWARE CHANGES this time...

Double click on the .reg file we created earlier and placed on the Desktop. Allow it to merge into the Registry.

Reboot the computer. Upon reboot, windows should find and install the CD-ROM drive. Upon successful installation, reboot the computer again to properly record the changes made to the hard disk.

Post back your results. Thanks!

[easyas]

Ah, great success master. Got 2 drives now 1972 vet, DVD-RAM Drive (E:) and
DVD Drive (F:). Went to device manager and it only shows;
"UY3637D ISA264D SCSI CdROM DEVICE" under Cd drives now. We've lost the "TSST corp CD/DVDW TS-L632C" driver, which was obviously clashing. Does this mean we have the Cd drive back but have lost the DVD burn (DVDW) function?

The fixcdrom.reg file did not appear on the desktop in safemode so I installed under normal conditions. Ran a Cd-rom with a few photo''s on it without incident.
Do you want me to post any logs for your inspection?
Thanks 1972 vet
easyas

[1972vet]

Go to windows update and scan. Use the "Custom" scan button. When the scan completes, look under the "Hardware" and "Software" options for any recommended downloads. See if it finds a driver for your other drive. Post back your results. Thanks!

[easyas]

There was quite a lot to upgrade 1972vet. Windows upgraded a lot of security patches and well as the office suite, outlook and a few others. There were 19 software upgrades available and 3 hardware upgrades as options. I installed them all. There was no update for the "other drive" but I played a DVD on the machine without incident. I've never actually burned a DVD- if the option is missing I'll never know anyway:)
Here's a HJT log for you;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:31:52 PM, on 8/31/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ASWLSVC.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Blue Coat K9\k9filter.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ASUS\NB Probe\NBProbe.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Secunia\PSI (RC3)\psi.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

https://evgausperfm1.envirogold.com/...e%2flogin.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://us.rd.yahoo.com/customize/yco.../www.yahoo.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [NB Probe] C:\Program Files\ASUS\NB Probe\NBProbe.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide

/waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Secunia PSI (RC3).lnk = C:\Program Files\Secunia\PSI (RC3)\psi.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat

7.0\Reader\reader_sl.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop

Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) -

http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://www.update.microsoft.com/micr...site.cab?12202

07947375
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ASWLSVC - Unknown owner - C:\WINDOWS\system32\ASWLSVC.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. -

C:\WINDOWS\ATKKBService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32

Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc.

- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue

Coat K9\k9filter.exe

--
End of file - 6368 bytes

Some good-lookin' files huh?
Cheers'
easyas

[1972vet]

Excellent...you did good work! Your log looks clean.
Click start-->run...then copy and paste the Bold text below into the run box and click "OK":

ComboFix /u

Performing this function will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again for you automatically.

You can set the system Clean Disk manager and system defragmenter to run on schedule by creating a simple batch file then using it to run as a scheduled task. Think of it as a "One Button" cleanup and defrag operation.

To do this, click start-->Run...and type or copy and paste the following in the Run box and press ENTER:
cleanmgr /sageset:1

What you're doing here is setting up a cleaning profile for Disk Cleanup to use later on. When you type the above, a dialog box will appear with a list of junk file types that you can select for removal. You'll notice, you have more options to choose from here than you would if you were to just open up your cleanmgr from the "All Programs-->Accessories-->Tools" menu.

Select which options you want to clean up by putting a check mark in each one but Do not put a check in the box for "Compress old files". Click OK after making your choices.

Now, copy the text below in the code box to Notepad and save it to your Desktop as CleanUpandDefrag.bat:

echo off
cleanmgr /sageset:1
cleanmgr /sagerun:1
defrag c: 
@exit

Now that you have the batch file on the Desktop, we can create a scheduled task using that batch file. This will allow the disk cleanup and defrag to run automatically on a date and time of your chosing.

To do this, click start-->Control Panel-->Scheduled Tasks...then double-click on the "Add Scheduled Task". Click Next and you'll be presented with a listing of applications you can run on schedule. Unfortunately you won't find either Clean Disk Manager or Defragmenter there so we need to click the Browse button.

Navigate to your Desktop and find the .bat file you just created, then click Open. Next, I suggest you select at least "Weekly" here...you can always go back and change it by finding your schedlued task, right-clicking on it and selecting "edit". Click Next and select the time of day you will least likely be using the computer.

Click Next and assign the appropriate user account name and password. Each "Cleanup and Defrag" schedule will be treated as a logon so just use your own user account (the name should already be entered and highlighted) and password data. Click Next and Finish. That's it!

To assist in the prevention of spyware infections:

Immunize your browser by installing Spywareblaster. What does it do?

• Prevents the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
• Blocks spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
• Restricts the actions of potentially unwanted sites in Internet Explorer.

Keep your anti-virus and spyware definitions up to date. Be sure to scan often.

Below you can choose from several of the freeware Firewalls available on the public domain. Even though you may have a Firewall already installed, keep this list handy should you choose not to renew your subscription for whatever reason.

You should always have at least (but not more than ) one of these types of third party firewalls running on board:
Kerio Personal Firewall
Zone Alarm
Outpost Free
Comodo

Install the free security tool "Secunia PSI" to help protect your system against software vulnerabilities. The free utility scans your system's software applications and offers a one button "Download "Solution" feature that updates the exploited software AND provides other related information/patching if warranted.

Stay updated with the most recent Windows patches as well...using Microsoft's Windows Update. Make it easy on yourself, and set this feature to Automatic.

Using an alternate browser can reduce your chance of certain infections installing themselves. We recommend installing Mozilla Firefox. If you don't already have "Firefox", please consider installing and using this browser for surfing.

If you still wish to use Internet Explorer, please make sure you install SpywareBlaster (from above) to protect you from most ActiveX infections.

So how did I get infected in the first place?
Regards, and Happy Surfing!

[easyas]

Hey vet, we are soooo close!! All was going well until it came to installing a third-party firewall- ESET did not like that at all- blue screen of death. Started in safemode and uninstalled 'outpost free' and we are back. I couldn't find any literature on conflicts between the two- but doesn't ESET have a firewall anyway?
Should I try the other firewalls and see if the software conflicts continue?

Beyond that, all else went swimmingly. Scheduled updates and clean-outs are complete. Secunia is working like a charm. I had to disable cookie protection in spywareblaster to get to hotmail in explorer. Normal? I'll check the settings again.
The great news is I've copied a lot of notes, tips and hints to make maintenance much simpler in the future. The nifty little cleanupanddefrag was a nice touch. Thankyou again for your patience and guidance 1972vet. Clear and concise orders with additional explanations made the job a pleasure. I owe you a jar of vegemite mate.
regards,
easyas

[1972vet]

I couldn't find any literature on conflicts between the two- but doesn't ESET have a firewall anyway?

ESET Smart Security Suite does...but not just the Nod32 antivirus software by itself. You can use comodo. I haven't seen any problems with compatibilty issues using it with Nod32.

I had to disable cookie protection in spywareblaster to get to hotmail in explorer. Normal?

That doesn't seem right to me. The cookie protection in SpywareBlaster only prevents ad/tracking cookies from being placed on the browser. You should be able to keep that checked and still reach your hotmail account. Open Internet Properties and click the "Privacy" tab. Make sure the slider there is set to Medium.

Clear and concise orders with additional explanations made the job a pleasure. I owe you a jar of vegemite mate.

Hey, now...I got an idea. Can you send that to my Mother-in-law?

You've been a pleasure to work with too kiddo...Let us know if you are having any other issues. Thanks!

[easyas]

Sorry vet, typing quicker than I can think (and that's 20 wpm!!). The new explorer browser did need a little tweaking in security settings- been using firefox for too long. Looking through the options in spywareblaster answered my own question, I've restored security to tick all boxes. All good.
Gotta be careful with that vegemite- in the wrong hands it can actually sharpen a tongue,
That's why less is more!
Take care 1972vet,
easyas

p.s. Now I'll have to check that thread to see if there's a picture to match the thoughts.