Please help - Malware/Virus Issues

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Paolo78, Apr 3, 2007.

  1. Paolo78

    Paolo78 Private E-2

    Hello,

    I think i have a few problems with my pc. It started last week when something called 'Microsoft Registry Scaner' tried to gain access to the internet and internet explorer wanted access as a server - zone alarm blocked both. So i researched and discovered this to be regscan.exe.

    AVG couldnt find it so i used the online McAfee scanner which found something called 'Generic Spy-e', i downloaded the 30-day trial McAfee antivirus and that discovered something called 'Ilomo' - but i could not remove it. Finally Superantispyware found 'Regscan.exe' and i was able to remove it. I assumed that all three of these were the same malware, but each scanner picked up different names.

    So i found your site looking for something that could give me the reassurance that my system was now clean. I have followed your malware removal guide but this has just revealed more and more problems.

    At first i left Counterspy as it was taking to long to download. Bit Defender discovered 'Win32.Stration.Gen@mm' and at the same time the McAfee realtime scanner detected 'New Poly Win32'. I removed both of these - I dont know how to get a report for the realtime scanner, but the virus was located in C:/Documents and Settings\****\local settings\temp and the process was internet explorer.

    The panda scan revealed nothing but i went back to counterspy and it discovered Trojan.Vissv.B and the snap toolbar which i removed. I also noticed that when i sent an email using outlook 2003 that i got an alert from McAfee about something called kernel32.exe. But whilst i was looking it up the alert disappeared and i wasnt able to remove it. I have not been able to find it since.

    I would really appreciate your help as i thought that i did all the security stuff right - firewall, antivirus, etc.

    Now i dont have a clue if i am virus/malware free or not. I have attached the requested files for your attention.

    Thank you.
     

    Attached Files:

    Paolo78, Apr 3, 2007
    #1
  2. Paolo78

    Paolo78 Private E-2

    The other files are attached...
     

    Attached Files:

    Paolo78, Apr 3, 2007
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    A few things are not quite right with your HJT log.
    • MSconfig is shown as being used. See step 0 of the READ ME and select Normal Startup mode
    • also you HJT log is not in agreement with what is showing in the GetRunKey log for processes loading at startup. Are using HJT's ability to filter information? Unfilter everything and allow HJT to show everything.
    Then attach a new HJT log.
     
    chaslang, Apr 3, 2007
    #3
  4. Paolo78

    Paolo78 Private E-2

    Sorry i think i misunderstood the instruction regarding disabling msconfig.

    It should be correct now - this was run in normal mode.

    Thanks.
     

    Attached Files:

    Paolo78, Apr 3, 2007
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You don't really have any malware issues! I do have some things for you to do though.

    Uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders which may be left behind by the uninstall:
    C:\Documents and Settings\All Users\Application Data\Sunbelt Software
    C:\Program Files\Sunbelt Software

    Also Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    J2SE Runtime Environment 5.0 Update 6
    J2SE Runtime Environment 5.0 Update 9
    Mozilla Firefox (1.5.0.11)

    Make sure you reboot after uninstalling the above!

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Then install the current version of FireFox from: Mozilla Firefox

    Now Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    After clicking Fix, exit HJT.

    Now delete the below file!
    C:\WINDOWS\system32\CMMGR32.EXE

    What is the below for?
    O4 - HKCU\..\Run: [MSGTAG] "C:\Program Files\MSGTAG\MSGTAG.exe" /startup
     
    chaslang, Apr 4, 2007
    #5
  6. Paolo78

    Paolo78 Private E-2

    I have carried out the tasks as you instructed, except i haven't removed the CMMGR32.EXE yet. Can you tell me what it does (or doesn't do) and why i should remove it?

    I have attached the latest hijack report - assuming that i am now malware free can i now remove hijackthis from my pc.

    One last thing - Once the McAfee free trial has expired i am unsure which free antivirus/antispyware programs to use - please can you advise what are the best ones in your opinion - ideally i guess i would need a realtime scanner. I previously used AVG but as it did not detect the regscan.exe trojan i have lost confidence with it.

    Thanks.

    P.S. The MSGTAG.EXE program is something i use in outlook. It tags any message that i send and advises when the recipient opens the mail.
     

    Attached Files:

    Paolo78, Apr 9, 2007
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That file would be Microsoft Connection Manager which is used in conjunction with dial-up modems. However your file is 0 bytes in size which means it is not a valid copy and also as far as I know cmmgr32.exe is not required in WinXP.

    Yes from HijackThis's Misc Tools click the button that says Uninstall HijackThis & exit

    Then manually delete the files and folder related to it.

    All recommendations are given in the link in my final steps below. (Note: AVG is recommend and is a better choice than McAfee).


    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you run Avenger, you can delete all files related to Avenger now.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    8. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    9. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Apr 9, 2007
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds