asked to post logs here

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by moss99, Sep 30, 2013.

  1. moss99

    moss99 Private E-2

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    In your other thread in the Software Forum, you stated that Malwarebytes found nothing but obviously by the log attached here, it found a bunch of things and these all can have impact on your browser. Let's do a little more cleaning, but first a question. I see signs of Avast in your logs but Avast does not appear to be installed or running. Is it installed? If not, DO not reinstall yet. I just want to know that the status in the logs is current so that we can work on removing leftovers.


    What is the below file that you are running at startup?
    C:\Shares.bat

    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
    explorer.exe
     
    :Files
    C:\Documents and Settings\Administrator\Application Data\DriverCure
    C:\Documents and Settings\Administrator\Application Data\ParetoLogic
    C:\Documents and Settings\All Users\Application Data\ParetoLogic
    C:\Documents and Settings\Administrator\Application Data\Babylon
    C:\Documents and Settings\All Users\Application Data\BrowserDefender
    C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    C:\WINDOWS\Tasks\Show-Lyrics Update.job
    
    :Reg
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "Reminder"=-
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]
    "ACS"=-
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS]
    [-HKEY_USERS\S-1-5-21-2112737959-2623711808-1284289875-500\Software\Softonic]
    :Commands
    [purity]
    [EmptyTemp]
    [start explorer]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run MSconfig and put your PC in Normal Startup mode and then reboot your PC before doing the below.
    After reboot, if you are running Chrome to be here, shutdown Chrome and open IE. Open only one tab. With IE open, complete the below.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXTlog
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    Last edited: Sep 30, 2013
  3. moss99

    moss99 Private E-2

    Hi , I was quite surprised mwbfound all those files , I ran it a few weeks ago and it found nothing . I uninstalled avast when i tried to run avira ,
    the C:\shares.bat was something the guy that set up the network did as he was having problems getting the pc to talk or something something to do with pinging , that was over 2 years ago though ,,

    View attachment JRT.txt

    View attachment MGlogs.zip

    View attachment 09302013_165252.log
     
  4. moss99

    moss99 Private E-2

    I am still getting cpu 100 percent and unusable explorer ..
    thanks.
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    OKay so now there is no antivirus installed? If that is correct, I want to cleanup all the left overs that I saw so do not install any right now. I don't think your problem is due to malware but I want to run another scan and cleanup leftovers from previous AVs. Please run the below.


    Now download and save a copy of combofix.exe and save it directly onto your Desktop folder.
    • Then double click on it to run it. Do not disturb it by clicking in the window that opens or it may stall.
    • After it finishes, it may reboot your PC. Attach the C:\combofix.txt log that it creates.
    • If after running Combofix you discover none of your programs will open up because you receive the following error:
      • Illegal operation attempted on a registry key that has been marked for deletion
    • Then you will need to reboot your computer which will normally fix this problem.
     
  6. moss99

    moss99 Private E-2

    Hi , thats correct no antivirus installed . Good news after running combofix explorer seems to be working fine . here is the log file ,

    View attachment log.txt
     
  7. moss99

    moss99 Private E-2

    Hi , Am i all good to install mse again now ?
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Interesting! The only item combofix removed they could be related is the below which is not malware:

    c:\windows\system32\drivers\etc\hosts.ics

    Let's see what was in this file. Navigate to the below folder

    C:\Qoobox\Quarantine\C\windows\system32\drivers\etc

    In this folder you should see the quarantined host.ics file renamed to hosts.ics.vir

    Put this file into a ZIP file and attach it. Alternatively, you could rename the file to hosts.ics.txt to attach it.


    Yes you can reinstall MSE now.
     
  9. moss99

    moss99 Private E-2

    I am having a problem uploading that file it says "invalid file" tried using 7-zip ??
     
  10. moss99

    moss99 Private E-2

  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hmmmm! No problems in that file. It was just a default file from Microsoft.

    I want to check for more info in a new log from MGtools.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    C:\MGlogs.zip
     
  12. moss99

    moss99 Private E-2

  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay everything looks good.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard. This opens the Run dialog box.
      • Copy and paste the below into the Run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    7. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    8. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
  14. moss99

    moss99 Private E-2

    Many thanks for all your help ..
    :wave
     
  15. moss99

    moss99 Private E-2

    Hmmm still not letting me install mse , get error code 0x8007064A ..
     
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This is not a malware problem. It is more of an issue to work in the Software Forum; however, do the below and we will see if we can find a quick fix by checking for leftover registry entries that could be the cause of the problem.

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1

    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      :regfind
      Microsoft Security Essentials
      Microsoft Security Client
      :filefind
      Microsoft Security Essentials
      Microsoft Security Client
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. You can just close this notepad window since the log is already saved on your Desktop. Be patient! It may look like it is not doing anything, but it takes awhile for this to scan thru your whole system look for matches.
    • Please attach the SystemLook.txt log found on your Desktop to next reply.
     
  17. moss99

    moss99 Private E-2

  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    If the above patch was successful then reboot your PC now.

    After reboot, see if you can install MSE now
     
  19. moss99

    moss99 Private E-2

    Ok i got the success message for the registry merge but now getting error
    0x80070645 when installing mse ..
     
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay then run the registry patch one more time. The rerun the SystemLook scan again from a few messages back and attach the new log.
     
  21. moss99

    moss99 Private E-2

    here it is
    View attachment SystemLook.txt

    i had something a bit weird when i started up this morning , it wouldnt really do anything and in the task manager processes there was a scvhost.exe using 100 cpu . i left it for about 5 mins . After a restart it was ok ..
     
  22. moss99

    moss99 Private E-2

    just had the same thing again with the scvhost.exe using 100 cpu while starting google chrome , this time i ended the process and it has been fine since ..
     
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This is something you will need to discuss in the Software Forum as it is not due to malware. Your logs were basically clean. All we have been doing is removing some minor junkware and try to also fix another NON-malware issue related to not being able to install MSE which happens all the time from what I have seen. This is a Windows and MSE issue.

    Let's try another registry patch.

    Copy the bold text below to notepad. Save it as fixme2.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    DO NOT try to reinstall MSE yet. I want to be sure everything was cleaned up by running a new scan with SystemLook.


    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      :regfind
      Microsoft Security Essentials
      Microsoft Security Client
      Microsoft Antimalware
      BB8DD09375BB24940A92D219E3E4D947
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. You can just close this notepad window since the log is already saved on your Desktop. Be patient! It may look like it is not doing anything, but it takes awhile for this to scan thru your whole system look for matches.
    • Please attach the SystemLook.txt log found on your Desktop to next reply.
     
  24. moss99

    moss99 Private E-2

  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It may have stated it worked but it did not. Let's try to force these remaining keys out by using ComboFix.

    Now download and save a copy of combofix.exe and save it directly onto your Desktop folder. Make sure that you download this version. Any older copies you may have will be out of date and will not run properly.

    Now we will use ComboFix in an attempt to cleanup more MSE entries from the registry.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:
    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
    After reboot, rerun the same last scan given with SystemLook again and attach the new log from this.
    If this does not cleanup everything, I really will have to make two suggestions since this is not a malware problem but rather a Windows problem.
    1) Don't use MSE. Use a different antivirus/antispyware program like Avast, Avira, or Comodo.
    2) Or post in the Software Forum to continue working the issue with MSE.
     
  26. moss99

    moss99 Private E-2

    Hi ,I have uninstalled the combofix i used in the run me read me , (post 13) ..
     
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay so just continue on with my instructions then after download the new version.
     
  28. moss99

    moss99 Private E-2

  29. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Excellent news. You're welcome. Now do all of th below that still applies.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard. This opens the Run dialog box.
      • Copy and paste the below into the Run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.
    8. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    9. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds