Not sure what's up! Please check logs!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by insan_art, Apr 28, 2010.

  1. insan_art

    insan_art Private First Class

    Toshiba Satellite A105 - XP Media Center - 1.5 GB RAM 120 GB HD

    Well, it's been a while since I've been here for myself - been running a tight ship and not sure what the problem is, but I always do the Run & Read Me (after a clean out) when in doubt.

    Problems started a week or so ago - first boot of the day would be fine, but if I turned the laptop off for a few hours and back on, it would take 2 or 3 boots to get it to boot 100%. By this, I mean that it would boot all the way to the desktop, icons load, taskbar loads, etc...but I would watch the misc. start-up items come up in the tray and it would stall on something I noticed that Online Armor didn't load - it would let me click nothing - would have to Ctrl-Alt Del and choose shut down. Upon shut down, it would always ask to close explorer.

    Did a back-up and clean out and then ran the scans. After AVG didn't like MGtools, Online Armor wouldn't start on the next reboot. Then I couldn't get SAS to update. I was trying to uninstall OA at this point, but couldn't because it was obviously malfunctioning. OA started with the next reboot and I was able to uninstall it, since it was instructed for ComboFix anyways.

    Otherwise, had no other problems with the scans and haven't had the reboot hang since I started the heavy clean. Logs are attached. Please let me know if you find anything, otherwise, I'm off to the software forum!
     

    Attached Files:

    insan_art, Apr 28, 2010
    #1
  2. insan_art

    insan_art Private First Class

    MGTools logs attached.
     

    Attached Files:

    insan_art, Apr 28, 2010
    #2
  3. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Nothing found. :) As you say yourself, any remaining issues can hopefully be resolved in the software forum.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    Kestrel13!, Apr 29, 2010
    #3
  4. insan_art

    insan_art Private First Class

    Kestrel13!,

    Thank you for your reply. At this point I'm not sure what to think - the symptoms seem like a mix of malware infection and software malfunction.

    So, you're saying that the flagged hiberfil.sys file in Root Repeal is not an issue? I've been reading that it can become infected - it's the only thing that came up on the scans...is that something that is commonly a false positive?

    This morning when I turned on the laptop AVG did not/would not start. This raised a "malware red flag" to me, however, I had no problem uninstalling and reinstalling it. It seems to be running fine after 2 reboots.

    Please let me know what you think about the hiberfil.sys file. Is there any way to double check that file?

    Thanks again for your help and advice! ;)
     
    insan_art, Apr 29, 2010
    #4
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You're welcome. But I did not find any malware or odd looking files in any of your logs.

    Not an issue. RootRepeal scopes out hidden/locked files, and it lists that one frequently. It is not a problem and I do not believe the file is infected. You can scan it with jotti or similar if you like just for peace of mind.
     
    Kestrel13!, Apr 29, 2010
    #5

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds