Malware Removal Followup

Josr · Jan 2, 2009

I believe my computer is currently free of malware; however, I am requesting a review of the logs generated from the procedures in the "Windows XP Cleaning Procedure" before I continue with step 4.

Originally, when attempting to access Yahoo mail I would get redirected to a Google search page that stated "http://ad.yieldmanager.com/st%3Fad_type" could not be located.

I believe it began after downloading and installing FullTilt Poker by Macrovision Corporation.

My first attempt at running combofix frustrated me and I decided to do a full recovery. After removing some unwanted software I ran the "Windows XP Cleaning Procedure" again.

Combofix indicated that McAfee was still active even though this was one of the programs I deleted. I clicked through and combofix appears to have run without any issues.

I will wait on the okay from the experts before finishing the cleaning procedure and moving on with my data rebuild.

Thank you for the time spent reviewing the generated log files.

Josr

Josr · Jan 2, 2009

MGlogs.zip file attachment for previous post.

Josr

dr.moriarty · Jan 5, 2009

Welcome to Majorgeeks, Josr.

We are currently reviewing your logs and will get back to you with a set of instructions as soon as possible.

Thanks for your patience.
dr.m

Josr · Jan 5, 2009

Dear Doctor:

No sweat, you all are the ones giving us your time and it is greatly appreciated.

dr.moriarty · Jan 6, 2009

Thanks and you're welcome, Josr.

* Any further problems will be eliminated when you-

Uninstall "Browser Address Error Redirector"

Your logs look good! If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (=This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

If we had you run Avenger, you can delete all files related to Avenger now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware

Click to expand...

Safe surfing!

Josr · Jan 6, 2009

Hi Dr. M.

I have completed above steps through 9. Thus far everything looks fine. I will be doing step ten next; but, I wanted to again thank you and the Majorgeeks experts for all your assistance.

I hope to engage you all in the various forums going forward.

Sincerely

dr.moriarty · Jan 7, 2009

:major

You're Welcome!

I hope to see you around the forums, Josr - when I take a break from the logs.

dr.m

Josr · Jan 14, 2009

Hello Dr. Moriarty

Please excuse the delay in providing this folloe up post. Just want to let you know everything is clear and I have installed the reccommended software with the reccommended configurations to prevent further infections as much as possible.

I do have a couple additional questions for this session however.

With SAS pro's real-time protection running in conjunction with Avira's antivirus guard feature and Spybot S&D's sdhelper is it neccessary to continue to run Lavasofts Adaware?

No rush on the answer I just want to remove unneccessary software.

Gratefully,

dr.moriarty · Jan 14, 2009

Josr said: ↑

I do have a couple additional questions for this session however.

With SAS pro's real-time protection running in conjunction with Avira's antivirus guard feature and Spybot S&D's sdhelper is it neccessary to continue to run Lavasofts Adaware?
Click to expand...

Josr

The general consensus here is unless you have Ad-Aware Plus, you should just un-install Ad-aware as it has become a useless program.

SAS and MBAM are far superior tools.

dr.m

Log in or Sign up

Malware Removal Followup

Josr Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 01-01-2009 - 15-26-57.log

mbam-log-2009-01-01 (17-23-03).txt

ComboFix.txt

Josr Private E-2

Attached Files:

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

Josr Private E-2

dr.moriarty Malware Super Sleuth Staff Member

Josr Private E-2

dr.moriarty Malware Super Sleuth Staff Member

Josr Private E-2

dr.moriarty Malware Super Sleuth Staff Member

Log in or Sign up

Malware Removal Followup

Josr Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 01-01-2009 - 15-26-57.log

mbam-log-2009-01-01 (17-23-03).txt

ComboFix.txt

Josr Private E-2

Attached Files:

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

Josr Private E-2

dr.moriarty Malware Super Sleuth Staff Member

Josr Private E-2

dr.moriarty Malware Super Sleuth Staff Member

Josr Private E-2

dr.moriarty Malware Super Sleuth Staff Member

Useful Searches