Bugbatter
6 Gallium

Re: Virus in [Filename]

No, you do not need to type the .exe. Were you logged in as Administrator? If not, do so and try that again.


Windows Insider MVP 2016 -

Microsoft MVP - Consumer Security 2006-2016

Social Media and Community Professional

0 Kudos
rwilkins1
1 Nickel

Re: Virus in [Filename]

Yes, each time I visit my computer I log in as Administrator. I have the ability to do what ever I want e.g. install, uninstall programs etc.

0 Kudos
rwilkins1
1 Nickel

Re: Virus in [Filename]

Sorry to repost, but I thought it would be important to ask you now while we are on the topic of typing commands in cmd --to reduce any confusion.

 

[Two Different Questions, but just NEED one ANSWER]:

After I open cmd and type the commands you instructed, do I close out of the cmd window and then reboot?

OR

Do I reboot system while leaving the Cmd window open?

 

The reason I ask because it seems to me closing out of cmd will erase changes I've made. Not unless the changes were made immediately after pressing the ENTER key.

Hope I haven't confused you, and if did sorry.

 

0 Kudos
Bugbatter
6 Gallium

Re: Virus in [Filename]

You type one line. Hit Enter.

Type the next line. Hit Enter.

Type the next. Hit Enter.

Do this  with each line. Do not close CMD until you have finished with the whole list.

Let me know how that goes.


Windows Insider MVP 2016 -

Microsoft MVP - Consumer Security 2006-2016

Social Media and Community Professional

0 Kudos
rwilkins1
1 Nickel

Re: Virus in [Filename]

Yea, that exactly the way I did it....I'll show you, for example...

Below is the cmd window...

C:\users\Randy>sc delete AERTFilters

[sc] Openservice Failed 5:

Access is denied

C:\users\Randy>sc delete ALG

[sc] Openservice Failed 5:

Access denied

 

As I continued to type each command line as described above. I would get the same response for each (Failed, Access denied).

 

I will be more than happy to try again, but I thought I should show you how I was typing the commands in the cmd window first.

0 Kudos
Bugbatter
6 Gallium

Re: Virus in [Filename]

See if the screenshots here help at the link below (You can check to see if they are listed in Services, but you will probably not have to Stop any services because according to your log, there are no files running. We are just trying to get these listings out of the registry.)

http://www.vistax64.com/tutorials/183507-services-delete.html

Names of   the services:

AERTFilters
ALG
DFSR
ATIPOLAB
KeyIso
MSDTC
Netlogon
ProtectedStorage
RpcLocator
slsvc
SNMPTRAP
Spooler


Windows Insider MVP 2016 -

Microsoft MVP - Consumer Security 2006-2016

Social Media and Community Professional

0 Kudos
rwilkins1
1 Nickel

Re: Virus in [Filename]

Okay, do you want me to delete these items in the "Services " window, and if I do, it want cause any present or future issues will it, not that you don't know what you are doing because I know that you do?

In "Task Manager" under "Services" I have the following...

Names of   the services:

AERTFilters--- Run
ALG---Stop

DFSR---Stop
ATIPOLAB---Not Listed (can't find)
KeyIso---Stop
MSDTC---Stop
Netlogon---Stop
ProtectedStorage---Run
RpcLocator---STOP
slsvc---run
SNMPTRAP---STOP
Spooler---run

-----------------------------------------------------------------------------

Going to "Services" as discribes in the link you sent me (Services" window, I have the following...

 

Name                                       Status                                      Staertup Type

AERTFilters                           Started                                     Automatic

ALG                       (Not listed in services window)

ATIPOLAB           (Not listed in services window)

KeyIso                  (Not Listed in services window)

MSDTC                 (Not listed in services window)

Netlogon                              (No info in status row)            Manual

ProtectedStorage               Started                                      Manual

RpcLocator         (Not listed in services window)

slsvc                     (Not listed in services window)

SNMPTRAP         (No info in the status row)                      Manual

Spooler                (Not listed in services window)


_______________________________________________________

I hope this makes sense. The top information is directed towards what was listed in "Task Manager" window' and the bottom information was directed towards what was listed in the "Services" page.

Thanks

0 Kudos
Bugbatter
6 Gallium

Re: Virus in [Filename]

Just leave them the way that you have them and don't delete them. Comparing what you are seeing to what we see in HijackThis, it appears that HijackThis is not giving us an accurate picture of those services based on the operating system.

Otherwise, how is everything running?


Windows Insider MVP 2016 -

Microsoft MVP - Consumer Security 2006-2016

Social Media and Community Professional

0 Kudos
Highlighted
rwilkins1
1 Nickel

Re: Virus in [Filename]

Everything seems well. No, pop-ups, and I am not being directed to different pages. This issue of worring that I have some sort of virus started last week when I performed a scan. At least three times in a row my anti-virus program (McAfee) stopped at 75% from being a complete scan. So, I opened "System Health Report" and that's when the results said "System does not recognized anti-virus". After I seen that I became a little concerned, so I got in touch with McAfee for technical support. The tech suppot rep remotely viewed my computer for a brief minute. When the rep returned to let me know whether or not I had a problem, that's when I was told I had a "Trojan".

Shortly after that I began to research a little so I could find out what would be causing my system to not recognize my PC and cause my McAfee program to stop 25 % from being complete. I found a Microsoft site that pertained to the "Warning" I had in my 'System Health Report". It said that some of the "Service Pack 2" downloads would cause the computer to not recognize the anti-virus. So then, I uninstalled my "Service Pack 2" and rebooted. After I was logged back on I ran another "System Health Report", but I just continued to get the same warning message regarding my anti-virus not being recognized.

The next thing I did was uninstall then reinstall my McAfee program and reboot. Once I was back up I performed another scan; however, I still got the same message about anti-virus not being recognized. One thing that was different due to the uninstall then reinstall of McAfee...I was able to perform a scan at a hundred percent. The McAfee results once complete was zero viruses, nothing at all--not even a cookie.

Later that evening I bought the AVG program. Hoping that if I did have a virus the AVG would find it. After I got the results of the scan I posted them into this thread. They all were cookies, about 300 or more (all posted in above sections thoughout our discussions.

I really can't tell if there is a virus in my PC. The performance seems good, and as I said earlier, I am not being redirected to other pages or lured to other websites.

The only thing I can't understand is the McAfee rep saying I had a Trojan. The rep also said they would charge me $90 dollars to remove it. I'm thinking it could have been a sales pitch.

Have you ever had this experience with other computers?

As the McAfee rep said I have a Trojan. Do you see that I have a Trojan looking at the logs?

To answer your question...Yes, everything seems the way it was the day I purchased my PC. It was fast then and it is still fast.

So, what do you suggest?

 

Thank you for your help!! emoticon.Smile.title

 

0 Kudos
Bugbatter
6 Gallium

Re: Virus in [Filename]

 

The only thing I can't understand is the McAfee rep saying I had a Trojan. The rep also said they would charge me $90 dollars to remove it.
Malware very often disables the resident anti-virus when it gets on a system, so I'm thinking that may be the first reply the phone techs give. Better to tell users that they have a virus and find out otherwise than to tell them they do not and leave infection on there. They would have charged you $90.00 to do what we just did.  We have heard from others who had the same problem as far as incomplete scans. The solution has been to uninstall McAfee, run McAfee's Removal Tool, and re-install McAfee - not from the CD, but running the installation of McAfee online. However, you went ahead and installed AVG before we could reply with that information.

Have you ever had this experience with other computers?
  Yes, this forum is for owners of other brands as well as Dell.

Let's run  DiskCleanup in each user's profile, and then you will be good to go.

1. Open Disk Cleanup by clicking the Start button Picture of the Start button, clicking All Programs, clicking Accessories, clicking System Tools, and then clicking Disk Cleanup.

2. In the Disk Cleanup Options dialog box, choose whether you want to clean up your own files only or all of the files on the computer. Administrator permission required If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

3. If the Disk Cleanup: Drive Selection dialog box appears, select the hard disk drive that you want to clean up, and then click OK.

4. Click the Disk Cleanup tab.

* Please make sure only the following are checked:

-- Downloaded Program Files

-- Temporary Internet Files

-- Recycle Bin

-- Temporary Files

5. When you finish selecting the files you want to delete, click OK, and then click Delete files to confirm the operation. Disk Cleanup proceeds to remove all unnecessary files from your computer.

http://windowshelp.microsoft.com/Windows/en-US/Help/1264bc24-72a8-48aa-84e3-a355327139d91033.mspx

If everything is running well, it would be good to flush System Restore so you can start fresh. We'll purge the old, infected Restore Points by turning System Restore off and on again., thus creating a new, clean Restore Point.

To turn off Windows Vista System Restore:

1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK
9. When you have finished, restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows Vista System Restore:

1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Place a checkmark in the box for any drive you wish to enable System Restore on
7. Click OK

Here is my standard list of simple steps that you can take to reduce the chance of infection in the future.

If you have used Malwarebytes' Anti-Malware as part of your cleaning procedures, keep it updated and use it to scan every so often for malware, or upgrade to the paid version for realtime scanning and auto updating.

The following suggestions are general prevention and are not customized for your computer. You may have already taken some of these steps, and depending on your current security, you may not need to implement all of these:

1. Visit Microsoft Update: Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS. Microsoft's widows Update: http://v4.windowsupdate.microsoft.com/en/default.asp  If I were you, I'd try installing SP2 again.

2. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date.

3.You might consider installing Mozilla / Firefox.
http://www.mozilla.com/en-US/

4. Do not use file sharing. Even the safest P2P file sharing programs that do not contain bundled spyware, still expose you to risks because of the very nature of the P2P file sharing process. By default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple. File sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. Even if you change those risky default settings to a safer configuration, the act of downloading files from an anonymous source greatly increases your exposure to infection. That is because the files you are downloading may actually contain a disguised threat. Many very malicious worms and trojans, such as the Storm Worm, target and spread across P2P files sharing networks because of their known vulnerabilities.

5. Before using or purchasing any Spyware/Malware protection/removal program, always check the following Rogue/Suspect Spyware Lists. http://www.spywarewarrior.com/rogue_anti-spyware.htm http://www.malwarebytes.org/database.php

6. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/ ** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.

7.Web Of Trust , uses colored alerts to warn about risky websites warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

  • Red for Warning = STOP
  • Yellow for Use Caution
  • Green for Safe
  • Grey for Unknown

There is a Web Of Trust version for Firefox as well.

 

8. You might consider installing SpywareBlaster: http://www.javacoolsoftware.com/spywareblaster.html
It will:
Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
Block spyware/tracking cookies in Internet Explorer and Mozilla Firefox.
Restrict the actions of potentially unwanted sites in Internet Explorer.
Tutorial here:http://www.bleepingcomputer.com/forums/tutorial49.html
Periodically check for updates

9. Here are some helpful articles:
"How did I get infected?"
http://www.bleepingcomputer.com/forums/topic2520.html


"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

 


Windows Insider MVP 2016 -

Microsoft MVP - Consumer Security 2006-2016

Social Media and Community Professional

0 Kudos