hotbar/zango removal

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by dinointexas, Oct 25, 2010.

  1. dinointexas

    dinointexas Private E-2

    hi all, here is my delimma, i KNOW i have hotbar/zango on my laptop, im running win 7 64 bit. i have a shortcut for norton yet i cant remove it in my uninstall options. i cannot run spybot s&d, i get the following " Error sending request. A connection with the server could not be established, im post ing this here as a request from on of the mods, im tryingt to us ethe guides that you suggest but im getting blocked form something.
     
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Welcome to Major Geeks!

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click and choose Run as Administrator

    You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
    1. Rkill.exe
    2. Rkill.com
    3. Rkill.scr
    4. Rkill.pif
    Once you've gotten one of them to run then try to immediately run the following.


    Download and save the below to your PC (save it anywhere you can find it. The Desktop is fine). Then double click on it to run it.

    AVPFind.bat

    It should take a couple minutes to run. You will see a black command prompt window while it is running and it should close when it is finished. Once it finishes, attach the c:\avplog.txt file that is will hopefully create as long as the malware does not block the batch file from running. (See: HOW TO: Attach Items To Your Post )


    Now download and Run exeHelper
    • Please download exeHelper to your desktop.
    • Double-click on exeHelper.com to run the fix.
    • A black window should pop up, press any key to close once the fix is completed.
    • A log file named log.txt will be created in the directory where you ran exeHelper.com
    • Attach the log.txt file to your next message.
    Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


    Also please try running the below online scan:

    http://www.superantispyware.com/onlinescan.html

    Reboot immediately after scanning if it finds and removes anything. Let me know if anything was found. See if you can save a log with it.


    Then try running these instructions: Using MGtools


    Attach the below logs when finished with all of the above:
    • C:\avplog.txt - from AVPfind
    • a log from online SAS scan if you could make one
    • log.txt - from exeHelper
    • C:\MGlogs.zip - from MGtools
    The C:\ assumes that drive C is you Windows boot drive. If you boot from another drive, then use the correct drive letter above.
     
  3. dinointexas

    dinointexas Private E-2

    here are the two logs you requested
     

    Attached Files:

  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    and don't forget to attach the other requested logs too. :)
     
  5. dinointexas

    dinointexas Private E-2

    i have since restarted as well
     

    Attached Files:

  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Good, and now the logs from running C:\MGTools.exe ---> C:\Mglogs.zip
     
  7. dinointexas

    dinointexas Private E-2

    here it is
     
  8. dinointexas

    dinointexas Private E-2

    try again. ok it says log.exe is wrong format
     
  9. dinointexas

    dinointexas Private E-2

    i think i found it
     

    Attached Files:

  10. dinointexas

    dinointexas Private E-2

    hey kestrel13, is there anything else you need?
     
  11. dinointexas

    dinointexas Private E-2

  12. dinointexas

    dinointexas Private E-2

    can someone please help?
     
  13. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

  14. dinointexas

    dinointexas Private E-2

    im sorry , i just read it.
     
  15. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes, bumping is frowned upon because what you have to realise is that I work a job which requires me being away from the computer for a few hours each night ;) I will get to you when I can as we are working together to remove malware but it requires patience on your part. If you visit other malware removal forums you will discover that people are kept waiting alot longer in comparison to here at Majorgeeks. :)

    Going over your logs now after I have made a cup of tea.
     
    Last edited: Oct 25, 2010
  16. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Not seeing any evidence of hotbar/zango on this machine, what alerted you to that in the first place? In fact I am not seeing much to do at all here in the malware forum.

    Java(TM) 6 Update 17 <--- uninstall this outdated java.

    C:\Users\sue\Desktop\malware remoavl programs\MGtools.exe <--- Delete this as it is not where it should be anyway.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    What is inside of this directory? (Do not click on anything)
    • C:\ProgramData\{E961CE1B-C3EA-4882-9F67-F859B555D097}

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms. (That should get rid of many temp files including a few strange looking ones)

    Reboot your machine and install the most current and up to date version of Java available here at the below link:

    Java Runtime 6

    Run Malware Bytes now and attach the log it creates, regardless of whether it actually removes anything or not.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

    Tell me how the computer is behaving. (And bear in mind I will be going to sleep within the next hour and a half, so please wait for a response patiently)

    With regards to Norton, you may have to run the Removal Tool and then attempt a reinstallation.
     
    Last edited: Oct 25, 2010
  17. dinointexas

    dinointexas Private E-2

    as far as why i say hotbar/zango, its because the techs at best buy said that it was there, also i cannot get online with any kind of anti virus on, i have to turn thgem all off or else IE wont start.

    under the c/program data file here is whats inside:

    Ad-awareInstall.dst
    Ad-awareInstall.exe
    ad-awareInstall.lan\
    ad-awareInstall.msi
    ad-awareInstall.par
    ad-awareInstall.res
    instance.dat
    mia.lib

    ill have the logs for you when its finished

    again to reinerate, i cannot access the internet when i have an antivirus program running
     
  18. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Well perhaps it was, but it's not now ;)

    So use this tool for now to uninstall it. Please give the Norton Removal Tool (SymNRT) a run > reboot your machine and then run it again for good measure. Let me know if you can connect to the internet then. What happens if you use Firefox instead of Internet Explorer?
    That's fine. All good there.
    Yes, please do. :)
     
  19. dinointexas

    dinointexas Private E-2

    i have firefox installed but it wont even launch
     
  20. dinointexas

    dinointexas Private E-2

    here are the logs
     

    Attached Files:

  21. dinointexas

    dinointexas Private E-2

    as far as using the norton removal tool, it wont allow me, what i mean is, when i go tpo the site there is no button to click tyo download, the program was bundled with the laptop when i bought it, i dont have a serial number
     
  22. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I am seeing "no action taken" with the threats that MBAM found, did you indeed fix what it found or not? Either way, you need to open the program, locate the update tab, update, re-scan, fix anything it finds and attach the log regardless.
     
  23. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Please verify that this is what you see on the sitepage you were linked to:
    [​IMG]
     
  24. dinointexas

    dinointexas Private E-2

    it said it fixwed them, however here is a new file
     

    Attached Files:

  25. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    That's a Hijack This log not a log from running Malware Bytes. Please attach the log from Malware Bytes.

    Also answer Dr Moriarty's question.
     
  26. dinointexas

    dinointexas Private E-2

    dr mor, that is exactly what i see however when i go to the site i cant find a button to install, i believe its because i dont have a serial number for the nortoin, it came bundled with this crappy laptop
     
  27. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Once you have it downloaded - you just double-click the executable to run it.(right-click and Run as Administrator for Vista & Windows 7)

    dr.m
     
  28. dinointexas

    dinointexas Private E-2

    here is the scan,
     

    Attached Files:

  29. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I am not sure whether you actually have malware problems at this point. How did you get on with the Norton Removal Tool? As Dr M says, you download it, and all you have to do is double click it to run it.

    You did eventually attach a log from running Malware Bytes again, but you failed to update it first before re scanning as requested! So you need to do exactly what I asked:
     
  30. dinointexas

    dinointexas Private E-2

    hey bro, thanks for all your help, the laptop seems to be working splneded since i was able to use the Norton removal program, im sorry i didnt respond earlier, i was working on that laptop in Oklahoma for a friend but now im back home, you guys really do know ya'lls stuff about all this mal ware crapola, where did you get your d=education, would love to get some more knowledge. thank you for being patient with me and helping me through all that, i thought i was gonna have to do a disc wipe and then a reinstall of windows, you surely helped me out greatly, thanks again :)
     
  31. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    That would be hey sister ;)

    You are most welcome for the assistance. In answer to your question about how I was educated in malware removal, I attended an online university specialising in training people how to remove nasties. I spent time at this forum observing threads for hours and hours every week, watching how it worked.Then I was lucky enough to be further trained by Chaslang and TimW here at MajorGeeks. I can include a link on how to go about starting to learn.

    Becoming A Malware Forum Helper

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  32. dinointexas

    dinointexas Private E-2

    well HEY SISTA!!!!
    Sorry, i wasnt expecting a woman, dont know why but i didnt, but thanks again, however, i guess i wont be able to finish the steps until i get back to oklahoma, man, i wished i had more time, but i didnt, anyways i talked to her today and she said that tings are still doing wonderful, thank goodness, you did an awesome job! If and when i get back up there, i will be contacting you once again to try and finish this process ok? thanks
     
  33. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Life is full of surprises huh :-D
    You are *most* welcome. Safe surfing.
     
  34. dinointexas

    dinointexas Private E-2

    but i love a cute suprise like yourself
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds