2011-04-30 07:03:27

Hi.
I know that I have a virus on my pc,which's not letting any antivirus update,or scan. I downloaded MSE and it said that it couldn't connect to the internet so couldn't update its definations. then I installed AVG and its not updateing either. it's saying a bin file is missing. or something like that.
Then when I am searching on google, if I click on some results a website called
http://licosearch.com/
Say I searched for antivirus on google,clicked on the first result,what will open is something like  adultdates or something on the site above.
Then when I try to access any microsoft sites,it'll give me a 444 or some such errors. I tryed the same with online scanners,the same,the page could not be found.
Any help on this would be really great. thanks,Grryf.

Of all sad words of tongue or pen, the saddest are these, ‘It might have been.
Follow me on twitter

2011-04-30 09:33:57

Hi Grryf.

What happens when you run the avg scan streight from the installer? Avg update so frequently, the installer should be the latest version anyway.

try going into the applications menue for C drive and hitting scan and seeing what happens.

Btw, when i got my own virus just before I got avg, I couldn't use the net at all without random stuff going on, so what I had to do was download the avg installer on my laptop, stick it on a memory key and then run it from there on my pc.

You might even try updating manually, sinse all the avg antivirus updates can be found and downloaded separately on their update page.

With our dreaming and singing, Ceaseless and sorrowless we! The glory about us clinging Of the glorious futures we see,
Our souls with high music ringing; O men! It must ever be
That we dwell in our dreaming and singing, A little apart from ye. (Arthur O'Shaughnessy 1873.)

2011-04-30 10:04:04

Grryfindore, see if you have the following file on your computer.  If you do, can you paste its contents for me to see?  It seems that the virus is altering the way your internet works, and the contents of this file can sometimes show how it is accomplishing that.
C:\Windows\System32\drivers\etc\hosts

- Aprone
Please try out my games and programs:
Aprone's software

2011-04-30 15:07:42 (edited by grryfindore 2011-04-30 15:09:59)

hello.
First of all, thanks guys. now on to the file's content...
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
I'll try scanning C with AVG and post what happens here.
I even tryed to install panda cloud something,but it gave me the message that it could not connect with the internet etc.
I am a little worryed now,but lets see what happens. I just had my pc formatted recently,and I think one of those (beeps) just put the virus in there so that I'd go and have it formatted again.but I won't not now anyways.:d
thanks
Edit.
I tryed scanning c drive by right clicking on it and pressing enter on scan with AVG.but nothing seems to happen.

Of all sad words of tongue or pen, the saddest are these, ‘It might have been.
Follow me on twitter

2011-04-30 18:00:19

Thanks for posting that file's contents grryfindore, it hasn't been modified by the virus in any way so that's a good thing.  I see that you've tried a few virus scanners, is the main problem that they won't download or that they won't run scans?  If they won't download, it is very possible the virus' creator designed it to block the web pages of all the common anti virus programs out there.  That would be a good way to try to keep you from solving the problem.

It seems like you are able to get online to this site at least, unless you are on a different computer.  If it helps, you could try downloading an anti-virus program from a website that the virus wont have known to block out.  I took the Avast install file and uploaded it to my file server.  It might be at least worth a try to download it from my site and see if it works.  www.kaldobsky.com/stuff/setup_av_free.exe

- Aprone
Please try out my games and programs:
Aprone's software

2011-04-30 19:12:16

Hi. Thanks for the file
I can download the panda and MSE quite well from their sites,but panda antivirus seem to requier a net connection during a installation,and that's why it says that its not able to connect to the net. please see that the computer has access to internet. andd then MSE doesn't updates virus definations,the same messages,and AVG doesn't updates,and doesn't scan too.Thanks for uploading the file,will download it,and right what happened.
When I tryed to go to the sites which have a online scanner,it wouldn't let me,nither to any site of microsoft.
Beside those,it lets my net work just fine. I can be here,download a few things,although my net speed is too slow then before,but that's something on the ISP's side,I suppose.
Thanks,again.

Of all sad words of tongue or pen, the saddest are these, ‘It might have been.
Follow me on twitter

2011-04-30 23:36:51

Just another suggestion, Malwarebytes is fantastic at removing such things. You could also give that a work after Avast.

http://malwarebytes.org/mbam.php

2011-05-01 03:33:06

If none of these work, I'm quite happy to go and download the avg installer and latest pack of virus deffinition updates and bang them on sendspace for you as well if that would help.

There might be something going around, as Avg munched some threats on friday when i ran a scan  which is unusual as I rarely see any, though as it also scans for spyware and as I'd not noticed anything going wrong at all, I don't think these were too serious.

With our dreaming and singing, Ceaseless and sorrowless we! The glory about us clinging Of the glorious futures we see,
Our souls with high music ringing; O men! It must ever be
That we dwell in our dreaming and singing, A little apart from ye. (Arthur O'Shaughnessy 1873.)

2011-05-01 05:30:47 (edited by grryfindore 2011-05-01 08:39:46)

Hello,guys.
Yesterday I started the download of Avast. and uninstalled the AVG I had. it couldn't even go to the servay page after uninstallation.lol. anything to do with antiviruses or microsoft,it'll show a page can not be found,or can't be displayed. will try Avast after the download has finished,then if nothing happens, will go to AVG again,Thanks Dark will let you know if I need it.
and I already tryed malwarebyte. it couldn't download its definations as well. and now its downloading some updates which I know that I have not checked to auto. I just got a message. that the update of your computer or some thing like that,has almost finished. windows will automaticlely restart in 14 minutes would you like to restart your computer now?
Ahh,well. lets wait for the avast download and see what happens.
Thanks,Grryf.
edit for malware bytes. I already had it installed,and just started a scan after I had whiped my disks,with the AVG pc tune up. now when  malware's scan completes,I'll install Avast. whew,beep virus.:d.

Of all sad words of tongue or pen, the saddest are these, ‘It might have been.
Follow me on twitter

2011-05-01 08:57:27

Hello guys
Had to create another post. I have already editted that one 2 times.lol.
My scan with malware finished just now,and it found a few things. 2 files were infected,2 spywheres and hm. some other things. it couldn't delete a few files,how ever.here's the log,if anyone can help me better after reading this.
The malware log begins.
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6470

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/1/2011 12:21:23 PM
mbam-log-2011-05-01 (12-21-23).txt

Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 190117
Time elapsed: 14 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\lenovo\start menu\programs\startup\lgwfowro.exe (Spyware.Passwords.XGen) -> Delete on reboot.
c:\program files\vxenbrsf\lgwfowro.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

End of log.
Now I'll restart my pc and see what happens.thannks again,I'll install avast anyways. and I don't think my problems are over yet....
Thanks,Grryf.

Of all sad words of tongue or pen, the saddest are these, ‘It might have been.
Follow me on twitter

2011-05-01 09:59:16

Hmmm, a bit odd malware bites won't remove the files (avg has the virus vault for that).

If you can get them removed you might be able to fix trouble with the registry with avg pc tuneup.

At least though it's obviously ie that's the reason you can't go to antivirus pages.

Try scanning with avast and see what happens there, and if you get the chance, have it delete infected files, you can always fix or restore stuff later, but infections are better removed.

You might also try looking on avg pc tuneup startup manager, to se what your computer is doing when started and if there is anything dodgy going on there you will be able to stop it (the virus I had actually did institute looking for a dodgy dll at startup, this is one of the things pc tuneup fixed).

With our dreaming and singing, Ceaseless and sorrowless we! The glory about us clinging Of the glorious futures we see,
Our souls with high music ringing; O men! It must ever be
That we dwell in our dreaming and singing, A little apart from ye. (Arthur O'Shaughnessy 1873.)

2011-05-01 10:21:22

Judging by the log, it looks as if Malwarebytes should remove the files on a reboot; it can't always remove them if the files are in use.

Let us know what happens.

2011-05-01 10:52:56

Hello.
I think malwarebytes removed the enfected files, I'll run a few tests and will keep you guys updated. even if the problem isn't solved completely and I have to format my pc anyways, I am really greatful to all of you guys for trying to help and to aprone for going to that much efert of uploading the setup and such. and yes,thanks for your suggestions,and offers of help to all of you guys. I'll install avast now,and see what happens.BTW I restarted my pc,and scanned with malware bytes again and it couldn't find anything else,so I think that it cleaned the things it could.
now I'll do as dark suggested ,I'll have a look at the pc tuneup's start up manager,and I'll clean my registery. then I'll install avast,restart,scan and will let you all know what happens.
I have a question though. what does this line mean in the log above?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

I know that it deleted those files,but what does the lines antivirus disable and firewall disable imply?
thanks,again.Grryf.

Of all sad words of tongue or pen, the saddest are these, ‘It might have been.
Follow me on twitter

2011-05-01 14:40:12

Hi Grryf.

I don't know about the log (though you can certainly check things like windows' firewall status in the security center in control pannel), but judging by what the files were, if your stil experiencing net problems you can either A, try pc tuneup's internet optimizer, or B, try uninstalling internet explorer and reinstalling it again, this might be able to fix things without going as drastic as a reformat which will have lots of irritating consequences for you such as invalidating several of your software keys, as well as making you reinstall everything.

Myself I'd keep that as the last resort option sinse it's certainly the one which will cause the most trouble, and hopefully if nothing is too damage pc tuneup and some careful reinstallation will hopefully be able to repare things.

With our dreaming and singing, Ceaseless and sorrowless we! The glory about us clinging Of the glorious futures we see,
Our souls with high music ringing; O men! It must ever be
That we dwell in our dreaming and singing, A little apart from ye. (Arthur O'Shaughnessy 1873.)

2011-05-01 16:01:16

grryfindore, normally windows security center notifies you when your antivirus software is turned off, out of date, or if you don't have one at all.  The same holds true for your firewall.  That line in the registry is telling windows not to notify you of those things, which makes sense because it clearly disabled your antivirus software and didn't want you to notice for as long as possible.  That's all the registry line does.

We all hope everything is finally fixed for you man.  The report you sent is very promising since it deleted lgwfowro.exe from your startup folder.  Even if that doesn't end up being everything (fingers crossed that it was) getting rid of that from the startup folder was a good thing.

- Aprone
Please try out my games and programs:
Aprone's software

2011-05-02 02:54:56

hi,
on this virus topic just a quick question.
I think I have a virus as well it won't let me instal any virus thing from any of thos sights.
Dark, if you had time would you please be able to put AVG up on sendspace?
Thanks,

Daniel

2011-05-02 05:56:23

Hello guys.
Whew,finally. Every thing seems to be alright. I scanned with Avast,it didn't showed anything,so I suppose malware bytes did its job. I am really greatful to all of you guys as I said,for all the help,suggestions,and the eferts that you put into it. I just now tryed visiting microsoft.com,and I was able to so it seems to be a good indication that the virus has finally decided to go,:d.
Thanks to all of you.
Btw, I don't want to create another topic for just asking this question,but my friend has Avast 4.8 installed on the computer, and we are not able to remove it. I tryed my own advice and was searching for the processes which were running for Avast,but again,we couldn't find out which they were. So is anyone useing Avast 4.8? or does anyone know how to uninstall it. Avast utility won't work as it needs a safe mode to work in.Thanks,Grryf.

Of all sad words of tongue or pen, the saddest are these, ‘It might have been.
Follow me on twitter

2011-05-02 10:15:29

I believe this is a problem that has been around for quite a while now; apparently, you can't uninstall it unless you go into Safe Moad, which IMHO is pretty annoying.

2011-05-02 10:54:19

Glad the virus has gone Grryf and you've got your pc back.

Hi Daniel.

Here is avg free version http://www.sendspace.com/file/kzxnqt just press next when it asks for the license and you should be running the free trial I think.

Let me know if there is a problem, I will admit there are so many avg versions finding the right one was rather interesting, though i think it's this one.

Actually, I need to install it on my laptop too myself probably along with pc tuneup as well.

Avast has just gone down in my estimation if you need safemode to uninstall it, that really isn't good.

With our dreaming and singing, Ceaseless and sorrowless we! The glory about us clinging Of the glorious futures we see,
Our souls with high music ringing; O men! It must ever be
That we dwell in our dreaming and singing, A little apart from ye. (Arthur O'Shaughnessy 1873.)

2011-05-02 13:59:55

hi,
thanks so much for the link.
I was able to get it off with AVG.
Thanks again,

Daniel

2011-05-02 15:02:48

I've been using Avast for years and I've never encountered any problems uninstalling it.  If you must uninstall it in safe mode, that is new to me.
I'm currently using version 5.1 and I've been told that the processes use different names after version 4.8 so I can't help you there.  While looking around online to find out what the process names are, I ran across an interesting article that might help you.  As it turns out, Avast 4.8 had some type of issue that caused a few problems for different users.  My first recommendation would be to update Avast to the newest version and see if that lets you uninstall it.  The version you are using is 17 months old and was originally done away with because it was glitchy, so I'm not surprised it is giving you trouble.

- Aprone
Please try out my games and programs:
Aprone's software

2011-05-02 23:09:40

That makes more sense aprone, sinse I do have friends who use avast and speak very highly of it, though i've never tried it myself.

Glad it worked daniel and fixed your problem.

With our dreaming and singing, Ceaseless and sorrowless we! The glory about us clinging Of the glorious futures we see,
Our souls with high music ringing; O men! It must ever be
That we dwell in our dreaming and singing, A little apart from ye. (Arthur O'Shaughnessy 1873.)