VERY URGENT.System infected with umdmgr.exe.PLEASE HELP!!!

[peterb]

For gods sake, stop with the petty bickering. Instead of putting all your effort into arguing with each other, which is what its turning into, put your heads together and actually fix the users problem.

Well by and large that is what they are doing! Different approaches perhaps, but the end result will be the same. It is always tricky diagnosing (and fixing these problems at long distance (and harder when there is a time zone difference involved. Crazymonkey has a lot of experience, Sammel has logged into the OPs machine and given some practical help. Its a good effort by both of them, and if the exchange brings out some useful points - all the better! I'm finding the thread very instructive.

[SammEl]

I have already stated what the problem is, and its fixable as he manages to fix it everytime he reboots. The problem is why it is reverting every time he restarts, i gave him some steps a few posts back and have not heard the results and subsequently i am not giving more 'fixes' until he has tried the last.

Do you not understand something here, he is not good on computers regarding all of this, if he was he would not of had this problem in the first place, He has limited internet access.

I'll fix his problem, if you're going to be rude towards me when I just think you're in someway jealous or being a douche then there is no need in me speaking to you to be quite frank, computer expert eh, pathetic.

Like I said, feel free to ask him what I did on the PC, he'll give you a rundown.

[CrazyMonkey]

Do you not understand something here, he is not good on computers regarding all of this, if he was he would not of had this problem in the first place, He has limited internet access.

I'll fix his problem, if you're going to be rude towards me when I just think you're in someway jealous or being a douche then there is no need in me speaking to you to be quite frank, computer expert eh, pathetic.

Like I said, feel free to ask him what I did on the PC, he'll give you a rundown.

Have you even read my post? It's all outlined, step by step i know he is competent enough to run through them.

I asked him in pm what you did on his pc, would you like me to quote it? Because it states exactly what i have been saying. I make sure what i say is backed up.

I don't know what planet you are from but why would i be jealous of you? Calling me a douche is a going a little bit far, and i wont flame back because that defines what pathetic really is.

You seem to make out that you are the real computer expert? If you think running 'Avira AntiVir Personal,Spybot S&D and Malware Bytes AntiMalware parallel' qualifies you for that title you are seriously bemused.

And indeed there is no need for you to speak to me not unless it has some merit.

Cheers.

[SammEl]

Quote the PM

[CrazyMonkey]

Point has been proven.

Cheers.

[SammEl]

[CrazyMonkey]

Well if that's what I get for spending my hours on someone else's PC looking through it like it was my own system, being extremely careful not to screw it up as it is full with his personal information, then I'm speechless really, someone like me, speechless.

Like I said, you sort it out.

I did not want to post it...

I don't think he meant to cause any offence or seem ungrateful.

Im sure he appreciates the input from everyone who has helped him, after all his situation is so delicately tied to that pc's situation (ie his job).

Now i feel bad for 'getting him in trouble'. At the end of the day his pc is now in a far better state than it was previously, which is thanks to everyone's input in this thread and that is what we must all take away.

[SammEl]

i did not want to post it...

[CrazyMonkey]

Would you like me to list the things I did on his PC?

Yeah i'd quite like to know, and peterb seemed to be interested in all the advice given.

Fire away.

Ok, dont worry then mate.


EDIT-

Why? Heh, I have nothing to hide, read all my posts on this forum, I am pretty open with my life regarding what I do, what my family do, what we have been through, and who I am and how you can contact me in person. If you think I am a liar then you really do not know what kind of person I am..

And neither do i, it's good that you are that type of person and its a good thing that we are both willing to help others in an area we clearly both enjoy. I do not believe you are a liar, i was simply working off the information i was provided with. On the other hand i dont like to look like i fabricate things out of thin air and make assumptions or accusations either.

Cheers.

[Amitava83]

@SammyEl and CrazyMonkey:

Since last two days I've had horrendous Net connection and as such I was unable to login into the forum.Reading from my office the last few posts you two have posted ,I'm shocked and bewildered to say the least.

Both of you wonderful guys have been helping me through the start of my complicated problem and both of you have helped me out so much in separate phases(Sammy El by logging into my system and painstakingly carrying out all sorts of detailed scans and Crazy Monkey with all his thorough analysis of Hijack This reports and eliminating bad entries and so on and so forth...)..Both of yours' help have helped my system to recover from a pretty much hopeless state to a fairly good working state as of now(except the Internet problem)

I've openly appreciated this fact on the forum.And I repeat,I'm not technically competent enough to gauge whose help has been more effective or useful as I'm a photographer,not a Windows expert.And THAT is not the point either.The point is,you guys have both helped!!!Both of you guys have given me your valuable time and nobody appreciates it more than I do

However,I'm sorry & appalled that because of me,you two guys have started petty bickering amongst each other.This is really embarrassing and puts me in an awkward position.I've found this forum to be simply fabulous for getting advice on technical matters and I'll be looking up to you people in future too for further help.Please do not make an ego-issue out of this matter and stop this arguments amongst yourselves(however technically enlightening they may be)

Sorry for my long post and sorry also if I seemed to be sermonizing.PEACE!!!

Regards
Amitava

[peterb]

@SammyEl and CrazyMonkey:

<---snip

However,I'm sorry & appalled that because of me,you two guys have started petty bickering amongst each other.This is really embarrassing and puts me in an awkward position.I've found this forum to be simply fabulous for getting advice on technical matters and I'll be looking up to you people in future too for further help.Please do not make an ego-issue out of this matter and stop this arguments amongst yourselves(however technically enlightening they may be)

Sorry for my long post and sorry also if I seemed to be sermonizing.PEACE!!!

Regards
Amitava

Thank you for that! As for the apparent disagreement, part of it is, I think, frustration that it is taking so long to fix - remote diagnosis of a problem is always tricky - more so when there are time zone differences and slow net connections involved.

[domski]

Guys stop fighting as you both are great
I do this all day, His system is compromised way beyond redemption and needs formatted.

Get data off using Linux boot disk if needed and reinstall and learn lessons from it.

If you are adamant about cleaning system up then try this. Safe Mode or MsConfig (Diagnostic)
for Dr Web standalone virus scanner.

Kaspersky Linux iso. First thing & boot from it. PM me for iso if you need.
Will scan HDD with latest Kaspersky Pattern.
Dr Web Cure iT
A Squared

The HijackThis log was full of dubious items needing removed immediately.

It's like attacking by layers, Peel and remove.

It is great to see peeps helping each other, It's not a comp

[watercooled]

What is it with this forum - it says this is page 7 but there is also a page 8, when I click it I end up back here?
Anyway, can you see why I recommended formatting in the first place? It may be the easy option but it works and provided you had software license keys the system could have been back to normal days ago now. Maybe it would be worth trying to get the keys from the software somehow or contacting the companies and say you need them for a reformat/explain the situation, even if you don't reformat now keep them somewhere safe for future use. Backups are important and the idea of them is that if your hard drive or something fails completely you can be up and running again soon with minimal fuss and as little lost work as possible, if your backup doesn't achieve that you should rethink it. Ideally an infrequent HDD image so it's easier to get the system back to the way it was without reinstalling everything again and a frequent document backup.

[CrazyMonkey]

Guys stop fighting as you both are great
I do this all day, His system is compromised way beyond redemption and needs formatted.

Get data off using Linux boot disk if needed and reinstall and learn lessons from it.

If you are adamant about cleaning system up then try this. Safe Mode or MsConfig (Diagnostic)
for Dr Web standalone virus scanner.

Kaspersky Linux iso. First thing & boot from it. PM me for iso if you need.
Will scan HDD with latest Kaspersky Pattern.
Dr Web Cure iT
A Squared

The HijackThis log was full of dubious items needing removed immediately.

It's like attacking by layers, Peel and remove.

It is great to see peeps helping each other, It's not a comp

His system is now clean, it wasnt past redemption - not many systems ever get to this point.. scanning with these will not make a difference. Im not going to get into another argument about how people believe simply 'scanning' warrants professional experience.

What is it with this forum - it says this is page 7 but there is also a page 8, when I click it I end up back here?
Anyway, can you see why I recommended formatting in the first place? It may be the easy option but it works and provided you had software license keys the system could have been back to normal days ago now. Maybe it would be worth trying to get the keys from the software somehow or contacting the companies and say you need them for a reformat/explain the situation, even if you don't reformat now keep them somewhere safe for future use. Backups are important and the idea of them is that if your hard drive or something fails completely you can be up and running again soon with minimal fuss and as little lost work as possible, if your backup doesn't achieve that you should rethink it. Ideally an infrequent HDD image so it's easier to get the system back to the way it was without reinstalling everything again and a frequent document backup.

On the note of formatting, i had previously asked him for his installation cd to recover some original windows files, he did not have the cd if you get my drift..

I also have the page8 error... wierd.

The thread should be closed now, as the malware was removed long ago. (most of the serious threats were removed in some of my first posts...) His issue has been with his corrupt winsock stack for some time now. If you are to post i think you should address this issue, not an issue that has already been resolved.

[domski]

His system is now clean, it wasnt past redemption - not many systems ever get to this point.. scanning with these will not make a difference. Im not going to get into another argument about how people believe simply 'scanning' warrants professional experience.

Clean? How are you sure no doors were opened or services added etc? You mean system was fast & seemed ok? Yeah Right!

Not many systems get to this point? You my friend are not very secure!

Infections & intrusions are not reliably cleaned & dealt with by your way

[CrazyMonkey]

Clean? How are you sure no doors were opened or services added etc? You mean system was fast & seemed ok? Yeah Right!

Not many systems get to this point? You my friend are not very secure!

Infections & intrusions are not reliably cleaned & dealt with by your way

I actually dont think you know what you are on about...

Indeed i havent yet come across a machine where i cannot get windows running again.

Please tell me what is truly secure?

How would i know if his system was 'fast', are you saying every type of malware noticeably slows down a pc? Because this is a HUGE assumption. I have been working on a trojan with a 2kb stub in ASM and its fully undetected. How would you go about detecting this, not a single anti-virus solution detects it, its footprint is tiny and it does well at bypassing HIPS detection too.

What i am saying is that the original infections were removed, how do i know services werent added? Because i checked. Whether backdoors were opened (or already existed in the first place) who knows, i dont have the time, patience or reason to thoroughly check.

If my 'way' is so incorrect would you please enlighten me as to the 'correct' way? Dont bother coming back and saying 'format' because that wouldnt be 'cleaning' now would it, thats called starting afresh (yes i know it is effective) and its not what the op wanted.

Now if you want to continue this discussion on malware please detail your responses, do not make assumptions and making sense on the whole would be good too.

The OEM keys are freely available on the net, You can always swap your XP Home for Pro
or even Wndows 7 Starter for Ultimate easily!

Oh and warez discussion is strictly prohibited.

Cheers.