cant run combofix or MGtools memory error

foreverfree · Aug 24, 2008

ok, this is my first time actually having to post your cleaning tools work so well so here goes.

via the phone i am running my brother in law through the clean and remove malaware list we made it to combofix without issue where we started running into the error
(ref memory at 0x7c883f9c could not be written to), we tried to skip to mgtools but got the same result origional problem is a trojan win.32 agent and trojan clicker causing popups and the computer actually talks to them so we are starting at the bottom and working our way up, they run kaspersky antivirus so i have no clue how this all got thru on their system, but due to the errors should i continue on to the other programs to help list or try hijack this ect? Also, my father in law followed the Trojan warning message to buy 70.00 dollars worth of another antivirus 2008 and alpha white trax cleaner 2008 under the impression he should listen to the pop ups and we cannot find the programs as active or anything to try to shut them down or remove them im at a loss without looking at the screen can you help? i dont know which files would help the most from the cleaner process so let me know which if any to post

foreverfree · Aug 24, 2008

malwarebytes log file and we were able to get mgtools as well finally sorry for the long thread

TimW · Aug 25, 2008

You will not find a program to uninstall....it is all fake, but nasty.

Please Disable Spybot's TeaTimer

* Run Spybot and click Mode
* Select Advanced Mode.
* Then click Tools and select Resident.
* Now in the right window pane, uncheck TeaTimer.
* Also while this is open, in the left column now select IE Tweaks
* and then in the right pane make sure all the Miscellaneous locks are unchecked.
* Now quit Spybot!

Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.registrysmart.com/register.php
Click to expand...

After clicking Fix, exit HJT.

Please delete this:
C:\327882R2FWJFW

Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

* Double-click ATF-Cleaner.exe to run the program.
* Under Main choose: Select All
* Click the Empty Selected button.

If you use Firefox browser

* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

* Click Opera at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Now tell me what problems you may still be having.

chaslang · Aug 25, 2008

Note to Tim: Two antivirus programs are installed. Kaspersky and NIS.

foreverfree · Aug 29, 2008

ok sorry bout the delay work n school first lol going to follow these directions tonight, I appreciate the help, I will be working on my hijacker next!

TimW · Aug 29, 2008

Let me know how things are running....and I hope you have removed the second anti-virus program.

foreverfree · Sep 1, 2008

ok we went through and double checked spybot I had him turn off the tea timer when we did the read me run me and it was still unchecked so if you saw it somewhere I am not sure why! As for NIS it was uninstalled when we put kaspersky on so it wasnt something we could just uninstall but we deleted the remaining folders, we cannot find C:\327882R2FWJFW to delete it and found only 5 out of the ten you listed but did get them removed as well. ATF cleaner ran smoothly, I will post any problems that arise as I am notified of them Thanks again!

TimW · Sep 1, 2008

Just let me know....in the meantime:

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.

If we used Pocket Killbox during your cleanup, do the below

* Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combo-fix folder from combofix.

If we had you run Avenger, you can delete all files related to Avenger now.

If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

foreverfree · Sep 9, 2008

OK, the computer is running much better the only problem they are still having is every time they click on Mozilla they get a page pop up telling them they are infected and need that dern anti virus 2008 but no more talking PC no more pop ups about infection etc just this page, I have walked through settings and it is not his home page or anything, I will walk them through your previous post this weekend if my brother in law is up (my father in law is 74 so its difficult to get him through an email problem let alone all this)

TimW · Sep 9, 2008

Did you do this when you ran ATFCleaner:
If you use Firefox browser

* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Log in or Sign up

cant run combofix or MGtools memory error

foreverfree Private E-2

foreverfree Private E-2

Attached Files:

bruce1mbam.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

foreverfree Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

foreverfree Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

foreverfree Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

cant run combofix or MGtools memory error

foreverfree Private E-2

foreverfree Private E-2

Attached Files:

bruce1mbam.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

foreverfree Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

foreverfree Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

foreverfree Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches