Infected and most scans will not run

Welcome to Major Geeks!

Did you try shutting down McAfee before running the above? It is very possible that McAfee is also getting in the way. Did you just install McAfee after getting infected? I see a folder date of Nov 20th on McAfee. If so, I would recommend uninstalling it now ( yes right now before continuing ) since it may be corrupted from the malware and as stated, it could be just more of a hinderance than a help.


Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: (no name) - {FC5058F4-A29C-4F9B-9737-334F09108A58} - C:\WINDOWS\system32\vtUmkhgE.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O20 - AppInit_DLLs: karna.dat

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.
After clicking Fix, exit HJT.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Now see if you can install and run SUPERAntiSpyware and Malwarebytes. If so, run them and fix what they find and attach the logs from them.

Also try running ComboFix and attach a log from it if it runs now.

 

Hmmm?? What else had you done or where had you been surfing since posting the logs in message # 4?

Please download the current version of MGtools.exe and run it to get a new log. Attach the new MGlogs.zip file.

 

Okay let's continue removing the current malware. We need to try and get to a point where we can get SAS and MBAM to run.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {2496BA9E-E10B-442F-934C-B184B5B51A48} - C:\WINDOWS\system32\vtUmkhgE.dll (file missing)
O2 - BHO: {a299824e-ff85-6cda-8aa4-622d5e546c27} - {72c645e5-d226-4aa8-adc6-58ffe428992a} - C:\WINDOWS\system32\efaryy.dll
O2 - BHO: (no name) - {A63E645F-13BD-45ED-B15F-6E8C1BD57279} - C:\WINDOWS\system32\efcDVpmm.dll
O2 - BHO: (no name) - {E55CF06B-DE51-4583-BC1B-F2D7C1797703} - C:\WINDOWS\system32\geBsTNgh.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [f8f60933] rundll32.exe "C:\WINDOWS\system32\vcqqtwgt.dll",b
O20 - AppInit_DLLs: efaryy.dll
O20 - Winlogon Notify: efcDVpmm - C:\WINDOWS\SYSTEM32\efcDVpmm.dll

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.
After clicking Fix, exit HJT.

• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

Now uninstall whatever versions of SUPERAntiSpyware and Malwarebytes that you have installed. Then goto the links below and download the current versions. Install them, run them and update them immediately from within the program. And then run scans and attach the logs if they run.

• SUPERAntiSpyware
• Malwarebytes Anti-Malware

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\avenger.txt
• the logs from SAS and MBAM if they ran.
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You still should uninstall SAS and install the current version as I requested. You have an older version installed. Just to be safe run a new scan to make sure it is still clean.


Uninstall the below old versions of Java:
Java(TM) 6 Update 10

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {B8C19ECB-5908-4021-B636-483382991D83} - C:\WINDOWS\system32\geBsTNgh.dll (file missing)
O20 - Winlogon Notify: efcDVpmm - efcDVpmm.dll (file missing)

After clicking Fix, exit HJT.

Now reboot your PC.


After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!