Malware removal logs.

justpk · Dec 12, 2008

I have went through the read and run me, and logs are attached. I am attempting to clean my nephews computer. From what I learned from him was, He came home from work Wed 12/11/08, and got on the computer, but he didn't say what and where he went. Then he went to bed and when he woke up, he went back to computer to find it had no taskbar, no icons, couldn't get anything to run. Had to ctrl Alt Delete, then search for running anything, some things didn't run, like control panel and system restore. I was able to get on the internet and download SAS and ran it under safe mode and was able to bring back the desktop and icons. Tried removing myself, but, wasn't completely removing, then resorted to you. Thanks for your time on helping!

justpk · Dec 12, 2008

Here are the other logs. Thanks again!

justpk · Dec 13, 2008

Sorry I just realized I didn't attach SAS logs here they are.

Kestrel13! · Dec 16, 2008

Not alot to do, let's start with:

1) Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - (no file)
O2 - BHO: (no name) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - (no file)
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

After clicking Fix exit HJT.

2) Next..please Click Start > then My Computer > Double- click Local Disk (C) and locate the following bold file and delete it:

c:\windows\Ozuqifaniv.dat

3) Now Run Ccleaner!

4) Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.
Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Also please note: I would like for you to tell me what exactly you have installed and are running with Symantec.

Thanks
Kestrel13!

justpk · Dec 16, 2008

Thanks for helping. Here is the log. Also as far as the symantec, was old virus software, now using McAfee. Also as I was looking for logs to attach, I came across a file, when I go to my computer and double click c:\ it is,

Qoobox, I am not sure, and did not want to click on to find out. I really appreciate your time.

Oh, I can't seem to find an easier way to disable McAfee AND empty the quarantine files. If you have any suggestions, I would be very greatful.

Pam

Kestrel13! · Dec 16, 2008

HI

Qoobox is nothing to worry about, it's a folder created by Combofix to quarantine any infected files.

1) Please run the below then reboot. After reboot run it one more time.

Norton Removal Tool SymNRT

2) Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Thanks
Kestrel13!

justpk · Dec 17, 2008

Here is the log you requested.

Kestrel13! · Dec 18, 2008

Pleas delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\Craig Kidney\Local Settings\Temp

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

justpk · Dec 18, 2008

I tried deleting those files but... in

C:\WINDOWS\Temp
All These are from 12/17/08
Error message:
Cannot delete mcmsc_6DrJVkD9Za6EEO, it is being used by another person or program. Close any that might be using the file and try again, then the same with these,
Perflib_Perdata_d8.dta
Perflib_Perdata_95c.dat

and..

C:\Documents and Settings\Craig Kidney\Local Settings\Temp

cannot delete ~DF4185.tmp, reason same as above.
cannot delete ladHide5.dll: access denied, make sure disk is not full or write protected and that the file is not currently in use.

I didn't do anything else till I hear from you. I do have a question about something. When I was restarting after one of the steps, I noticed a box came up about ending program, and there were buttons below that said end now or cancel. And the program was
app.Bl879elQUTVEQLK4424YZQ6. I tried to do a search to find it but nothing came up. And when I rebooted to see if it would come up again, it didn't.

Also, I noticed the screen blink when i did the search. Any suggestions??

Kestrel13! · Dec 19, 2008

When I was restarting after one of the steps, I noticed a box came up about ending program, and there were buttons below that said end now or cancel. And the program was
app.Bl879elQUTVEQLK4424YZQ6. I tried to do a search to find it but nothing came up. And when I rebooted to see if it would come up again, it didn't.
Click to expand...

is the "end program" happening each time you shut down or reboot or was it just the once? Either way your logs are clean

justpk · Dec 19, 2008

Not every time. When I first started cleaning this computer, on one of the restarts I saw it, then I saw it again the other day. But when I rebooted it didn't show. I can't figure it out. I rebooted a couple times, but it didn't show again. I will now complete the last steps. Thanks soooo much for all your help.

Kestrel13! · Dec 19, 2008

you're welcome, safe surfing

justpk · Dec 19, 2008

Uh Oh!! I just finished with the system restore and rebooted. I decided to run SUPERAntiSpyware and within the first couple minutes, it found this:

Trojan.Unclassified/Helper-, detected 13. It hasn't finished yet. I will reply when it finishes. ERRR! Sorry.

Kestrel13! · Dec 20, 2008

Hi there, please refer to this "sticky" Resetting Registry and File Permissions

and follow through the instructions listed there.

Next I would like for you to update SUPERantispyware and rescan with it.

Then reboot your machine and run a new scan.

Upload the log it generates and attach it to your next reply.

Thanks
Kes13!

justpk · Dec 20, 2008

Here is the log, Nothing showed up when I scanned either time. I can see the light at the end of the tunnel. Awaiting your next instruction. You're awesome for helping. Thanks again.

Kestrel13! · Dec 21, 2008

Looks good Now just make sure you follow thru the final steps in my message #8

justpk · Dec 21, 2008

Thanks again.. HAPPY HOLIDAYS!!!!

Kestrel13! · Dec 21, 2008

you're welcome and the same to you :wave

Log in or Sign up

Malware removal logs.

justpk Private E-2

Attached Files:

log.txt

mbam-log-2008-12-12 (15-37-51).txt

ComboFix.txt

justpk Private E-2

Attached Files:

MGlogs.zip

justpk Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 12-12-2008 - 14-16-32.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 12-20-2008 - 18-26-20.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Malware removal logs.

justpk Private E-2

Attached Files:

justpk Private E-2

Attached Files:

justpk Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

justpk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches