Another Virus issue

16 years ago

Today, I started various pop-up messages about a Virus Alert. And, they wanted to sell me a new anti-virus software.

This is on my laptop with WinXP Home edition and Avast antivirus software. Some of these pop-ups said it was Win32/Nugel.E virus. I ran an Avast scan and it found i Malware item. I had it quarantine it, but failed to write down the name. I ran another scan and found nothing. However, I keep getting these annoying pop-ups and cannot do anything with the machine because of this invasion. I'm currently using my wife's machine as my desk-top HD finally bit the dust.

I checked on-line for the name of the file and found http://www.411-spyware.com/remove-win32-nuqel-e

I went into safe mode to look for the culprit but could not locate this nor WMSGSFTAV.exe.

So, I re-booted normally and the pop-ups started again.

Is that a reasonable solution short of re-formatting the HD and re-installing everything?

Many thanks,

Tom

Sort by:Oldest

Comments (9)

zep516
16 years ago
last modified: 11 years ago
Hi,

Tom you will need special instructions for removing that threat a bit beyond the scope here. Please visit the forum in the link. You will need to register to post.

zep516

Here is a link that might be useful: .landzdown
samtom_gw
Original Author
16 years ago
last modified: 11 years ago
zep,

Many thanks for the comments.
As an up-date, I've been thinking about what I wanted to do about this mess. Finally, I decided to reformat and start over.

I frequently proceed without reading the instructions. This time it appears to have worked in my favor. With my Restore disk in place, I hit F8 as I started the laptop and went to safe mode. My best choice seemed to be "System Restore."

I went through the Restore process and that appears to have fixed the problem. No more of their constant pop-ups.

Previously, I had had FireFox No Scripts and that does not appear now, so I'm getting ad pop-ups. That's easy to fix.

I'm going to run another Avast scan to see if that turns up anything. However, once I had gotten rid of the one item before, Avast said there no problems even when I was getting these frequent messages about being infected.

This is my first experience with any type of problem using XP. I have been a long standing Win2K type. This "system restore" appears to be very forgiving.

Just thought I'd let you all know what's happened, thus far.

Again, thanks for the input.

Tom
Related Discussions
Another (Mon 4-8-2013) rose virus paper from Minnesota
Q
Comments (1)
Thanks, Henry
...See More
another virus out there beware
Q
Comments (1)
Thanks for the warning.Dont need no virus. Jean
...See More
Another day, another issue!
Q
Comments (6)
My SD's mom has been saying she's gonna take DH to court for two years. The best way to nip it in the bud... say "go ahead!" and then say NOTHING. IF he had custody, then it is VERY difficult to change custody without proving the custodial parent is not acting in the child's best interest. You don't need a lawyer until you have been served with court papers. Then, you can ask for attorney's fees from her if she has no basis for making you seek legal counsel. If her mom forked over money for a "good lawyer" in the past and she still does not have custody, then unless you are doing something WRONG, chances are she won't have a leg to stand on... right now, all she is doing is making threats and the best thing to do is ignore her. We have gotten threats to go to court. BM actually responded to child support papers by alleging abuse of her child and asking for custody. Her abuse accusations were: 1. We make SD take at least 15 minute showers. 2. If she doesn't take a 15 minute shower, we MAKE her eat Oatmeal or chicken noodle soup while we eat the 'regular' family meal and we make her go to bed early. 3. SD doesn't have as much FUN at our house as she and her mother thinks she should. THE TRUTH: She needs to take a good enough shower and 2-3 minutes of just getting her hair wet & getting out does not cut it... we make her go back and use soap. She has been given chicken noodle soup and goes to bed when she is getting sick, even if we are having her favorite enchiladas. If we took BM's accusations seriously and got defensive or tried to justify why we do what we do, then it would only encourage BM to keep making these RIDICULOUS claims. DH asked her, 'do you really think the court is going to change custody because the custodial parent is making sure the child has good hygiene, eats healthy, gets lots of rest?' So, SD started failing in school on purpose because her mom told her if she fails in school, the court will let her live with her mom so her mom can help her in school. She was finally told that she will repeat the grade again if she doesn't start doing her work... that if he mom isn't involved in school here, the court will not 'assume' she will do better over there and that we can prove we are trying to get her help she needs to do well in school but her mom hasn't come to one conference... just sits there telling us how we are doing everything wrong while she does NOTHING. Besides, she does not know everything that happens in our house and she relies on a 10 year old's slanted information because SD is upset she has to have a bedtime, do her homework, take a decent shower, do her own laundry, and keep her room clean. It only makes BM look foolish to guess at the truth and put it in writing in court papers. The last time she threatened to take him to court was a few weeks ago and he said go ahead... we will also talk about the back child support and just how involved she is in SD's schooling. BM has not yet filed anything and the truth is, she probably won't because she does not want to discuss EVERYTHING.. just the BS that she wants to b*tch about. When you open the door, you can't pick and choose what may get brought up. The point is, you can let yourself get all worked up over what BM is doing and let your life and mind get cluttered with it when she is probably blowing smoke and laughing at the reaction she gets. From your past threads, it appears that you really don't like her and apparently have told her so. If she is as manipulative and dramatic as you say, then the best way to deal with her is to take the wind out of her sail... by NOT reacting and not giving her any attention for her antics. Let your DH deal with her. Remove yourself from it altogether as much as you can. If he gives her information regarding the children, do it in writing. When she starts a scene, calmly stay seated & ignore her.... watch the show, smile and act as if she isn't there. An 'argument' takes two. If she makes a scene, she will be the one looking foolish. Any reaction from your side of it only hurts the kids when they are there to have a nice holiday performance and end up worrying that mom and dad are going to fight... what a way to ruin the holidays for the kids. NICE!!! (and I thought it was sad yesterday when I went to my Stepdaughter's play... there was a little boy asking his teacher if he can call his stepdad really fast to see if he can come. He had nobody there from his family and all kids want is for someone to care and be there) It may not be the situation with the kid yesterday, but it is so disgusting when a parent gets angry that a stepparent has the nerve to be involved in their child's life.... and it happens all the time.
...See More
Virus or water related issue on Northland blueberry ?
Q
Comments (3)
Thanks for the response . The first pic was taken yesterday, the other on August the 2nd. The last application of AS Was given on the 4th of July. We did have an unusual dry spell lately and I must admit I didn't water as every day it looked like it was going to rain but it didn't ...Hopefully it will be ok then
...See More
ravencajun Zone 8b TX
16 years ago
last modified: 11 years ago
if you have not run malwarebytes you need to do that asap to make sure remnants are not still in your system.
How to download and install Malwarebytes' Anti-Malware application for Windows computers
run the full scan and let it clean anything it finds
zep516
16 years ago
last modified: 11 years ago
Well reformatting would have worked. There may be a slight misunderstanding of terms here. A reformat wipes out the hard drive and prepares it for installing an operating system using an xp Disk, All data is erased at that point.

In System recovery you would put your restore disk in that came with the computer that would restore the computer to a condition just like it was when you purchased it, that would have also worked.

You state that you Simply did a System Restore. System restore only restores the windows registry and is not effective when removing virus. Your first post describes whet we call an Anti Rouge virus program, once installed that program will tell you that you are infected and ask you to purchase the program to remove it. Malwarebytes will remove that. I suggest you run it and post the log file it creates. Problem with Anti Rouges is that they install additional Malware that could go unseen by scanners, that's why it's important to see the malwarebytes log.
samtom_gw
Original Author
16 years ago
last modified: 11 years ago
In looking at my Malwarebytes logs see I did one on 3/4 and
another one on 3/15. Both came up clean. I thought I'd sent one to you all, but it did not show up here.

If you want it, I can send, but decided to write first.
Anything else I should do? The machine acts about normal now.

Many thanks for the input.

Tom
zep516
16 years ago
last modified: 11 years ago
Lets look do this when you get a chance.

Click Here to download HJTInstall.exe Download the 2.02 click on installer right side of page
Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.
DO NOT use the AnalyzeThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System.
samtom_gw
Original Author
16 years ago
last modified: 11 years ago
I'm slow but steady. ;-)

Here's the "Hijack This" log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:44 AM, on 3/28/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\EzButton\EzButton.EXE
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\System32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\system32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
O2 - BHO: AcroIEHelperStub - (18DF081C-E8AD-4283-A596-FA578C2EBDC3) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [ZoomingHook] c:\WINDOWS\System32\ZoomingHook.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - (CD67F990-D8E9-11d2-98FE-00C0F0318AFE) - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7111 bytes

I'll check back in a few days. This is supposed to be our day of rest. Enjoy it.
zep516
16 years ago
last modified: 11 years ago
Got it.
zep516
16 years ago
last modified: 11 years ago
Hi,

There's nothing malicious in the log, just some clean up. You have some very old Java files that should be removed. Please go into you add / remove programs list and remove all versions of Java If Java 6_u 18 is there keep it, if not up-Date to it from the up date Java link provided below second one down where it says (Click Here.

Old Java: Old Java can be an infection risk for Vundu and others...

O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll

Then

This will do the rest of the Java clean up that's needed.
Download Java RA click Here

Unzip the file and open the JavaRa.exe. That's a zip file so you will need to right click and choose Extract, you can extract to the desktop then run it and let it do it's thing.
Click Remove Older Versions JavaRa will search for and remove any outdated version of Java and remove any that are found.
Click Additional Tasks
Place a check next to Remove Useless JRE Files and click Go
Exit JavaRa
Delete the JavaRa files from the Desktop.

Now click Here and up-Date Java (JRE 6 U_18) is the current version. Only install Java. uncheck any pre-checked software or tool bars when you install.

Post back when you finish that and let me know.

Next we will run a clean up like Ccleaner and others. Then stop a few programs from starting up with windows in the 04 listing.

Another Virus issue

Comments (9)

zep516

samtom_gw
Original Author

Related Discussions

ravencajun Zone 8b TX

zep516

samtom_gw
Original Author

zep516

samtom_gw
Original Author

zep516

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Another Virus issue

Comments (9)

zep516

samtom_gwOriginal Author

Related Discussions

ravencajun Zone 8b TX

zep516

samtom_gwOriginal Author

zep516

samtom_gwOriginal Author

zep516

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

samtom_gw
Original Author

samtom_gw
Original Author

samtom_gw
Original Author