Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 196
  • Last Modified:

Firewall arrested by malware

Hi all,
i'm having trouble for 2 reasons :
1) my AVG firewall is disabled and i'm not allowed to enable it;
2) If i try to run hijackthis it start and suddenly close down, the same if i type hijackthis in my internet browser IE;
I think is a malware and i have plenty of antivirus and antyspyware but i cant get rid of it, and i dont have any message back so i dont know what is it.
thanks for answering
davide
0
calvinnhobbes
Asked:
calvinnhobbes
  • 3
1 Solution
 
David-HowardCommented:
Calvin,
Have you (or can you) attempt to perform your scans in Safe Mode?
Safe Mode: What it is and how to access it.
http://www.computerhope.com/issues/chsafe.htm
You might want to check your Startup tab for malicious entries.
Check Startup for malicious entries.
How to use MSConfig (Directions with screen shots)
http://www.netsquirrel.com/msconfig/
David
0
 
rpggamergirlCommented:
Leave all startup entries enabled and run a hijackthis scan in safe mode.
Sometimes this is caused when Haxdoor is present in the system.
0
 
rpggamergirlCommented:
Show us the hijackthis log once you've got it.

Upload the log to any hosting sites,
or go to the below link and login using your Experts-Exchange username and password.
http://www.ee-stuff.com
Click on "Expert Area" tab
type or paste the link to your Question
"Browse" your pc to the location of your Hijackthis log and click "Upload"
Copy the resulting "url" and post it back here.

OR: paste the log to either of these sites:
1. http://www.rafb.net/paste/
then at the bottom left corner click "paste"
Copy the address/url and post it here.

2. or at --> http://www.hijackthis.de/ 
and click "Analyse", click "Save".  Then post the link to the saved list here.
0
 
calvinnhobbesAuthor Commented:
I cant access MSCONFIG (inmpossible to find error message) so i dont know how to work on the start up tab. I've already tried to run hijackthis in safe mode but it doesnt work anyway.
0
 
rpggamergirlCommented:
Infos on disabled firewall and how to fix it, but when it's caused by malware then it will just be disable again so you need to remove malware most importantly.

http://www.winxptutor.com/sp2/resetfw.htm
http://windowsxp.mvps.org/sharedaccess.htm


These were created to disable it:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"EnableFirewall"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
"EnableFirewall"=dword:00000000

values set to zero --> disables it and it greys out the buttons so it can not be changed
values set to 1      --> enables it and greys out the buttons so that it can not be changed
The value has to be removed so that the firewall is not set either way and you have control over it.



Can you run other programs??? like the below apps?
1.  Please download Silent Runners.
http://www.silentrunners.org/Silent%20Runners.vbs
* Save it to the desktop.
* Run Silent Runner's by doubleclicking the "Silent Runners" icon on your desktop.
* You will see a text file appear on the desktop - it's not done yet, just let it run (it won't appear to be doing anything!)
* Once you receive the prompt "All Done!", double-click on the new text file on the desktop and copy that entire log and upload the logfile created, go here and paste your log, http://www.rafb.net/paste/
then at the bottom left corner click "paste"
Copy the address/url and post it here:
*NOTE* If you receive any warning message about scripts, please choose to allow the script to run.


2.  Download (Download the GUI) version of BlackLight, and save it to your desktop.
https://europe.f-secure.com/blacklight/try.shtml
Doubleclick blbeta.exe, accept the agreement, click scan > next.

You'll see a list of all the items it found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (where xxxxxxx represents numbers). The application finds both bad files and legitimate ones such as "wbemtest.exe", so don't choose the rename option yet! Copy and paste the log it generated in your next reply.


3.  This one will tell us if it's caused by haxdoor:
Download haxfix.exe and save it to your desktop.
http://users.telenet.be/marcvn/tools/haxfix.exe
Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
Checkmark "Create a desktop icon"
Click "Next"
When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed
Click "Finish"

A red "dos window" (dos box) will open with options:
1. Make logfile
2. Run auto fix
3. Run manual fix
4. Run Goldun fix
E. Exit Haxfix

Select option 1. Make logfile by typing 1 and then pressing Enter
Haxfix will start scanning the computer. When it is finished a logfile will open: haxlog.txt > (c:\haxfix.txt)
Copy the contents of that logfile and paste it into this thread
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now