Another Virus issue

14 years ago

Today, I started various pop-up messages about a Virus Alert. And, they wanted to sell me a new anti-virus software.

This is on my laptop with WinXP Home edition and Avast antivirus software. Some of these pop-ups said it was Win32/Nugel.E virus. I ran an Avast scan and it found i Malware item. I had it quarantine it, but failed to write down the name. I ran another scan and found nothing. However, I keep getting these annoying pop-ups and cannot do anything with the machine because of this invasion. I'm currently using my wife's machine as my desk-top HD finally bit the dust.

I checked on-line for the name of the file and found http://www.411-spyware.com/remove-win32-nuqel-e

I went into safe mode to look for the culprit but could not locate this nor WMSGSFTAV.exe.

So, I re-booted normally and the pop-ups started again.

Is that a reasonable solution short of re-formatting the HD and re-installing everything?

Many thanks,

Tom

Sort by:Oldest

Comments (9)

zep516
14 years ago
last modified: 9 years ago
Hi,

Tom you will need special instructions for removing that threat a bit beyond the scope here. Please visit the forum in the link. You will need to register to post.

zep516

Here is a link that might be useful: .landzdown
samtom_gw
Original Author
14 years ago
last modified: 9 years ago
zep,

Many thanks for the comments.
As an up-date, I've been thinking about what I wanted to do about this mess. Finally, I decided to reformat and start over.

I frequently proceed without reading the instructions. This time it appears to have worked in my favor. With my Restore disk in place, I hit F8 as I started the laptop and went to safe mode. My best choice seemed to be "System Restore."

I went through the Restore process and that appears to have fixed the problem. No more of their constant pop-ups.

Previously, I had had FireFox No Scripts and that does not appear now, so I'm getting ad pop-ups. That's easy to fix.

I'm going to run another Avast scan to see if that turns up anything. However, once I had gotten rid of the one item before, Avast said there no problems even when I was getting these frequent messages about being infected.

This is my first experience with any type of problem using XP. I have been a long standing Win2K type. This "system restore" appears to be very forgiving.

Just thought I'd let you all know what's happened, thus far.

Again, thanks for the input.

Tom
Related Discussions
Virus, virus everywhere.
Q
Comments (19)
Hello, I am new to this forum and have been a hobbyist for about 5 years. Window growing with lights and humidifiers (big window ^.^) and now in the process of building a green house. Obviously no expert. Began with traditional phals...now I mostly have catts and have very good success with them. With the green house coming, I decided to virus test my collection of about 80 plants and 15 were virused; ironically, ten were the "failure to thrive" group I've been hanging onto and had little reason to continue after that. But I LOVED those plants just the same. The other five have CymMV and are doing fine quarantined. Nick, if your collection is fairly valuable and/or sentimental...WHY RISK bringing in these plants? My recommendation would be to take them ONLY IF you have a separate place to nurture them before you give them away to your family and friends. Denise
...See More
Mosaic Virus or Ph issue
Q
Comments (3)
If you haven't asked in the hydroponic growing forums, I'd suggest you try there... the trouble with hydroponics is that it's quite easy to get a nutrient imbalance that you wouldn't get in soil. Another possibility, as you said, is a virus. Single-streak is a combination of two viruses, Potato virus X and Tobacco mosaic virus. It fits your description of mottled leaves, stem lesions, and dark diseased fruit. Both viruses are mechanically transmissible (TMV just by brushing against the leaves)... a good test for virus infection would be to take a healthy soil-grown tomato plant, such as one bought at a nursery, grind up a little of one of the leaves from an infected plant in a couple of tablespoons of water with a pinch of baking soda and fine sand, and rub that solution onto a couple of leaves of the healthy plant. It's not as good as doing it in the proper buffers and such, but both PVX and TMV are so sturdy you have a good chance of getting transmission. If it's viral, you'll get some symptoms within seven to ten days. Pictures would still be helpful, especially if the single-streak pictures don't match what you're seeing. Good luck! --Alison
...See More
Another weekend....another excuse/issue
Q
Comments (7)
You are not a bad person. She is getting waht any person gets when they behave in such a manner. Its just sad for the kids. My husband went to pick up his kids last night and bioomom wasnt' home with them. Don't know where they went but he drove for almost 2 hours and when he got there, it was a no show. So he turned about and drove home. So now he's going to look like the bad person for not picking up his son. His daughter has all these activities from school to friends planned and is a no show for the next 2 1/2 months. Biomom calls at our house, leaves a message andyou can just hear it in her voice!!! 'oh ____ are you comign to pick up son...?" I was so disgusted. The games she plays and then she cries victim. And the kids do not know who is tellign the truth. But mommy is right, we live with her most of the time....daddy must be lying...oh he's the bad one...SIGH....i'm just tired of the bs And my heart goes out to you because you deal with more. I do not get the deal withthis 24/7 and your kids must be so tired by now with bs games like this now that they are old enough to realize. I agree with others onthis post, i wouldn't count on her unless she shows up at the door.
...See More
Another day, another issue!
Q
Comments (6)
My SD's mom has been saying she's gonna take DH to court for two years. The best way to nip it in the bud... say "go ahead!" and then say NOTHING. IF he had custody, then it is VERY difficult to change custody without proving the custodial parent is not acting in the child's best interest. You don't need a lawyer until you have been served with court papers. Then, you can ask for attorney's fees from her if she has no basis for making you seek legal counsel. If her mom forked over money for a "good lawyer" in the past and she still does not have custody, then unless you are doing something WRONG, chances are she won't have a leg to stand on... right now, all she is doing is making threats and the best thing to do is ignore her. We have gotten threats to go to court. BM actually responded to child support papers by alleging abuse of her child and asking for custody. Her abuse accusations were: 1. We make SD take at least 15 minute showers. 2. If she doesn't take a 15 minute shower, we MAKE her eat Oatmeal or chicken noodle soup while we eat the 'regular' family meal and we make her go to bed early. 3. SD doesn't have as much FUN at our house as she and her mother thinks she should. THE TRUTH: She needs to take a good enough shower and 2-3 minutes of just getting her hair wet & getting out does not cut it... we make her go back and use soap. She has been given chicken noodle soup and goes to bed when she is getting sick, even if we are having her favorite enchiladas. If we took BM's accusations seriously and got defensive or tried to justify why we do what we do, then it would only encourage BM to keep making these RIDICULOUS claims. DH asked her, 'do you really think the court is going to change custody because the custodial parent is making sure the child has good hygiene, eats healthy, gets lots of rest?' So, SD started failing in school on purpose because her mom told her if she fails in school, the court will let her live with her mom so her mom can help her in school. She was finally told that she will repeat the grade again if she doesn't start doing her work... that if he mom isn't involved in school here, the court will not 'assume' she will do better over there and that we can prove we are trying to get her help she needs to do well in school but her mom hasn't come to one conference... just sits there telling us how we are doing everything wrong while she does NOTHING. Besides, she does not know everything that happens in our house and she relies on a 10 year old's slanted information because SD is upset she has to have a bedtime, do her homework, take a decent shower, do her own laundry, and keep her room clean. It only makes BM look foolish to guess at the truth and put it in writing in court papers. The last time she threatened to take him to court was a few weeks ago and he said go ahead... we will also talk about the back child support and just how involved she is in SD's schooling. BM has not yet filed anything and the truth is, she probably won't because she does not want to discuss EVERYTHING.. just the BS that she wants to b*tch about. When you open the door, you can't pick and choose what may get brought up. The point is, you can let yourself get all worked up over what BM is doing and let your life and mind get cluttered with it when she is probably blowing smoke and laughing at the reaction she gets. From your past threads, it appears that you really don't like her and apparently have told her so. If she is as manipulative and dramatic as you say, then the best way to deal with her is to take the wind out of her sail... by NOT reacting and not giving her any attention for her antics. Let your DH deal with her. Remove yourself from it altogether as much as you can. If he gives her information regarding the children, do it in writing. When she starts a scene, calmly stay seated & ignore her.... watch the show, smile and act as if she isn't there. An 'argument' takes two. If she makes a scene, she will be the one looking foolish. Any reaction from your side of it only hurts the kids when they are there to have a nice holiday performance and end up worrying that mom and dad are going to fight... what a way to ruin the holidays for the kids. NICE!!! (and I thought it was sad yesterday when I went to my Stepdaughter's play... there was a little boy asking his teacher if he can call his stepdad really fast to see if he can come. He had nobody there from his family and all kids want is for someone to care and be there) It may not be the situation with the kid yesterday, but it is so disgusting when a parent gets angry that a stepparent has the nerve to be involved in their child's life.... and it happens all the time.
...See More
ravencajun Zone 8b TX
14 years ago
last modified: 9 years ago
if you have not run malwarebytes you need to do that asap to make sure remnants are not still in your system.
How to download and install Malwarebytes' Anti-Malware application for Windows computers
run the full scan and let it clean anything it finds
zep516
14 years ago
last modified: 9 years ago
Well reformatting would have worked. There may be a slight misunderstanding of terms here. A reformat wipes out the hard drive and prepares it for installing an operating system using an xp Disk, All data is erased at that point.

In System recovery you would put your restore disk in that came with the computer that would restore the computer to a condition just like it was when you purchased it, that would have also worked.

You state that you Simply did a System Restore. System restore only restores the windows registry and is not effective when removing virus. Your first post describes whet we call an Anti Rouge virus program, once installed that program will tell you that you are infected and ask you to purchase the program to remove it. Malwarebytes will remove that. I suggest you run it and post the log file it creates. Problem with Anti Rouges is that they install additional Malware that could go unseen by scanners, that's why it's important to see the malwarebytes log.
samtom_gw
Original Author
14 years ago
last modified: 9 years ago
In looking at my Malwarebytes logs see I did one on 3/4 and
another one on 3/15. Both came up clean. I thought I'd sent one to you all, but it did not show up here.

If you want it, I can send, but decided to write first.
Anything else I should do? The machine acts about normal now.

Many thanks for the input.

Tom
zep516
14 years ago
last modified: 9 years ago
Lets look do this when you get a chance.

Click Here to download HJTInstall.exe Download the 2.02 click on installer right side of page
Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.
DO NOT use the AnalyzeThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System.
samtom_gw
Original Author
14 years ago
last modified: 9 years ago
I'm slow but steady. ;-)

Here's the "Hijack This" log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:44 AM, on 3/28/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\EzButton\EzButton.EXE
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\System32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\system32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
O2 - BHO: AcroIEHelperStub - (18DF081C-E8AD-4283-A596-FA578C2EBDC3) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [ZoomingHook] c:\WINDOWS\System32\ZoomingHook.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - (CD67F990-D8E9-11d2-98FE-00C0F0318AFE) - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7111 bytes

I'll check back in a few days. This is supposed to be our day of rest. Enjoy it.
zep516
14 years ago
last modified: 9 years ago
Got it.
zep516
14 years ago
last modified: 9 years ago
Hi,

There's nothing malicious in the log, just some clean up. You have some very old Java files that should be removed. Please go into you add / remove programs list and remove all versions of Java If Java 6_u 18 is there keep it, if not up-Date to it from the up date Java link provided below second one down where it says (Click Here.

Old Java: Old Java can be an infection risk for Vundu and others...

O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll

Then

This will do the rest of the Java clean up that's needed.
Download Java RA click Here

Unzip the file and open the JavaRa.exe. That's a zip file so you will need to right click and choose Extract, you can extract to the desktop then run it and let it do it's thing.
Click Remove Older Versions JavaRa will search for and remove any outdated version of Java and remove any that are found.
Click Additional Tasks
Place a check next to Remove Useless JRE Files and click Go
Exit JavaRa
Delete the JavaRa files from the Desktop.

Now click Here and up-Date Java (JRE 6 U_18) is the current version. Only install Java. uncheck any pre-checked software or tool bars when you install.

Post back when you finish that and let me know.

Next we will run a clean up like Ccleaner and others. Then stop a few programs from starting up with windows in the 04 listing.

Another Virus issue

Comments (9)

zep516

samtom_gw
Original Author

Related Discussions

ravencajun Zone 8b TX

zep516

samtom_gw
Original Author

zep516

samtom_gw
Original Author

zep516

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Another Virus issue

Comments (9)

zep516

samtom_gwOriginal Author

Related Discussions

ravencajun Zone 8b TX

zep516

samtom_gwOriginal Author

zep516

samtom_gwOriginal Author

zep516

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

samtom_gw
Original Author

samtom_gw
Original Author

samtom_gw
Original Author