Ready, steady… save!
You don’t need a chart to join in. Here are 2 ways to record your savings:
1. Cross it off
Pop a chart into your first post. Saved an amount? Cross it out! Read more »
£0.01 £0.02 £0.03
2. Write it down
Skip the chart and add updates to your first post. Read more »
“Another +£3 saved today. Go me!”
Use +£ before each new saving so it counts towards your total.
📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
Antispyware Soft attack - Please help!!
rizla01
Posts: 7,262
Forumite
in Techie Stuff
Hi all,
using Firefox at the mo as IE has been totally hijacked by a very nasty Virus/Trojan called Antispyware Soft which has now prevented me from running ANY program to erase it.
Every program (I am told) has ben infected and it then asks if I want to run it's (PAID FOR) prog to clear the problem.
If I leave computer connected for any lenghth of time I return to find a screen full of pretty strong !!!!!! pics.
Can anyone please assist?
using Firefox at the mo as IE has been totally hijacked by a very nasty Virus/Trojan called Antispyware Soft which has now prevented me from running ANY program to erase it.
Every program (I am told) has ben infected and it then asks if I want to run it's (PAID FOR) prog to clear the problem.
If I leave computer connected for any lenghth of time I return to find a screen full of pretty strong !!!!!! pics.
Can anyone please assist?
"Unhappiness is not knowing what we want, and killing ourselves to get it."
Post Count: 4,111 Thanked 3,111 Times in 1,111 Posts (Actual figures as they once were))
Women and cats will do as they please, and men and dogs should relax and get used to the idea.
0
Comments
-
Download malaware bytes but do not run it yet...just save it. Might be easier if you change the destination to your desktop.
After download go to the program file ( it should be on your desktop!!!) and locate the mbam.exe file. Right click and rename it. Something like Killthis!!!!a.exe might be appropriate!!!!!!!!!!!!! This is so that the virus can't detect it.
Double click on this .exe file update Malaware Bytes and run it (FULL scan)
Hope this works for you.Justice will not be served until those who are unaffected are as outraged as those affected (Benjamin Franklin) JFT96...YNWA0 -
Hi all,
using Firefox at the mo as IE has been totally hijacked by a very nasty Virus/Trojan called Antispyware Soft which has now prevented me from running ANY program to erase it.
Follow the instructions given here.
If you had used Firefox with NoScript you would likely not got this pox!:doh: Blue text on this forum usually signifies hyperlinks, so click on them!..:wall:0 -
Hi all.
Phew. I think I have recovered OK.
Malwarebytes seems to think so.
Now I have NO anti-virus and I keep getting a 'Missing MSVCR71.DLL message whenever I boot and when I start some progs (Word being one)
A) How do I get rid of that prob? (I have been ignoring it and prog then boots up OK)
and
What is a good freeware Antvirus prog nowadays?
I used to uses AVG but that stopped working. then Avast but I seem to recall that conflicted with something else.
Which is the 'Kid on the block' these days?
Thanks for your assistance to both of you, BTW. I REALLY needed it badly then."Unhappiness is not knowing what we want, and killing ourselves to get it."Post Count: 4,111 Thanked 3,111 Times in 1,111 Posts (Actual figures as they once were))Women and cats will do as they please, and men and dogs should relax and get used to the idea.0 -
I keep getting a 'Missing MSVCR71.DLL message whenever I boot and when I start some progs (Word being one)
A) How do I get rid of that prob? (I have been ignoring it and prog then boots up OK)
http://lmgtfy.com/?q=Missing+MSVCR71.DLL0 -
Thanks for that Tronator.:)
There aere a lot of MSVCR71.DLL files stored on my computer. Are they all the same?
Can't I just copy one that I know is working OK, in place of one that is faulty?"Unhappiness is not knowing what we want, and killing ourselves to get it."Post Count: 4,111 Thanked 3,111 Times in 1,111 Posts (Actual figures as they once were))Women and cats will do as they please, and men and dogs should relax and get used to the idea.0 -
Thanks for that Tronator.:)
There aere a lot of MSVCR71.DLL files stored on my computer. Are they all the same?
Can't I just copy one that I know is working OK, in place of one that is faulty?
I guess you could, but how do you know which one works? It's just a few kB to download....0 -
Please open malwarebytes, goto LOGS and post the WHOLE of the log that was created
reboot
Download HIJACK THIS (Make sure you click 'DOWNLOAD THIS VERSION')
http://www.filehippo.com/download_hijackthis/2894/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log):idea:0 -
Hi aliEnRIK.
Heres the log from Malwarebytes.
I have since installed AVIRA and run it's virus check and also Super anti spyware.
Thanks
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4057
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
01/05/2010 22:59:43
mbam-log-2010-05-01 (22-59-43).txt
Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|N:\|X:\|)
Objects scanned: 317074
Time elapsed: 56 minute(s), 35 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
\Program Files\Computer Inventory\bin\ComputerInventory.exe (Trojan.Hijacker) -> Quarantined and deleted successfully.
Ok. And here is the HJT logfile.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07:54, on 02/05/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
G:\Online Armor\OAcat.exe
G:\Online Armor\oasrv.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
G:\Online Armor\a2\AVGate.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
G:\A-SQUARED FREE\a2service.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
G:\Online Armor\oaui.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe\Roboform\RoboTaskBarIcon.exe\Lower Case Switcher\LowerCaseSW.exe
G:\Advanced SystemCare 3\AWC.exe
F:\Start Menu 7\StartMenu7.exe
G:\SUPERAntiSpyware\SUPERAntiSpyware.exe
G:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
G:\Online Armor\OAhlp.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://by118w.bay118.mail.live.com/default.aspx?&n=1721578409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} -\Roboform\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: MemberPluginBHO - {C3E5E149-27B7-49D1-8420-B02AC52AF663} - C:\Program Files\MemberPlugin\MemberPlugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} -\Roboform\roboform.dll
O4 - HKLM\..\Run: [@OnlineArmor GUI] "G:\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [RoboForm] "D:\Roboform\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [LowerCaseSwitcher]\Lower Case Switcher\LowerCaseSW.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "G:\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [StartMenu7] "F:\Start Menu 7\StartMenu7.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] G:\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - S-1-5-18 Startup: Stardock ObjectDock.lnk = G:\Program Files\Stardock\ObjectDock\ObjectDock.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Stardock ObjectDock.lnk = G:\Program Files\Stardock\ObjectDock\ObjectDock.exe (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = G:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: Customize Menu - [URL]file://D:\Roboform\RoboFormComCustomizeIEMenu.html[/URL]
O8 - Extra context menu item: Fill Forms - [URL]file://D:\Roboform\RoboFormComFillForms.html[/URL]
O8 - Extra context menu item: Password Generator - [URL]file://D:\Roboform\RoboFormComPasswordGenerator.html[/URL]
O8 - Extra context menu item: RoboForm Toolbar - [URL]file://D:\Roboform\RoboFormComShowToolbar.html[/URL]
O8 - Extra context menu item: Save Forms - [URL]file://D:\Roboform\RoboFormComSavePass.html[/URL]
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Zoom &in - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\tuzoomin.htm
O8 - Extra context menu item: Zoom &out - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\tuzoomout.htm
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - [URL]file://D:\Roboform\RoboFormComFillForms.html[/URL]
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - [URL]file://D:\Roboform\RoboFormComFillForms.html[/URL]
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - [URL]file://D:\Roboform\RoboFormComSavePass.html[/URL]
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - [URL]file://D:\Roboform\RoboFormComSavePass.html[/URL]
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - [URL]file://D:\Roboform\RoboFormComShowToolbar.html[/URL]
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - [URL]file://D:\Roboform\RoboFormComShowToolbar.html[/URL]
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\SPYBOT~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0A43D7AC-D6C1-4622-B309-BF975F427C0E} (first direct internet banking plus digital safe) - https://internetbankingplus2.firstdirect.com/ibplus/frontdoorFD.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218797834562
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O20 - Winlogon Notify: !SASWinLogon - G:\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - E:\ASQUARED\A-SQUARED ANTI-MALWARE\a2service.exe
O23 - Service: a2free - Emsi Software GmbH - G:\A-SQUARED FREE\a2service.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Net Burner iSCSI Service (NetBurnerService) - Paragon GmbH - G:\Drive Back-up\Net Burner Service\NetBurnerService.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - G:\Online Armor\OAcat.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - G:\Online Armor\oasrv.exe
--
End of file - 9769 bytes"Unhappiness is not knowing what we want, and killing ourselves to get it."Post Count: 4,111 Thanked 3,111 Times in 1,111 Posts (Actual figures as they once were))Women and cats will do as they please, and men and dogs should relax and get used to the idea.0 -
TICK and FIX this ~
O2 - BHO: MemberPluginBHO - {C3E5E149-27B7-49D1-8420-B02AC52AF663} - C:\Program Files\MemberPlugin\MemberPlugin.dll
Whats "StartMenu7.exe"?:idea:0 -
TICK and FIX this ~
O2 - BHO: MemberPluginBHO - {C3E5E149-27B7-49D1-8420-B02AC52AF663} - C:\Program Files\MemberPlugin\MemberPlugin.dll
Whats "StartMenu7.exe"?
Ok. done that.
StartMenu7 is a Start menu replacement which organises the Start items.Features:
* The list of menu items is alphabetically sorted, so you can easily find any program or command by its name.
* Open any location on your PC with a single click.
You can create, modify, and reorder items in Start Menu 7. So it's easy to create a list of the most used locations, popular directories, and virtual folders to access them with a single click.
* There is a special Run button to access seldom used locations without adding them into menu.
* Start Menu 7 has a customizable Power Buttons panel.
* With Power Timer feature you can delay any of power management operations.
* Launch programs with a single click. Yes, it's true! Any program in a one click distance.
* Tabbed menu helps to place more stuff in the same display size. Any folder or drive can be managed as a separate tab.
Not important if you feel that it is conflicting in any way."Unhappiness is not knowing what we want, and killing ourselves to get it."Post Count: 4,111 Thanked 3,111 Times in 1,111 Posts (Actual figures as they once were))Women and cats will do as they please, and men and dogs should relax and get used to the idea.0
This discussion has been closed.
Confirm your email address to Create Threads and Reply
Categories
- All Categories
- 355.9K Banking & Borrowing
- 255K Reduce Debt & Boost Income
- 456.2K Spending & Discounts
- 248.4K Work, Benefits & Business
- 606.1K Mortgages, Homes & Bills
- 179K Life & Family
- 263.9K Travel & Transport
- 1.5M Hobbies & Leisure
- 16.2K Discuss & Feedback
- 37.7K Read-Only Boards