Ran READ ME Programs in Safe Mode...

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by mixmistress508, Feb 20, 2015.

  1. mixmistress508

    mixmistress508 Private E-2

    I was unable to open or run anything on my laptop. In May or June, I was looking for a job and filling out online applications. In the middle of this, I got a pop up saying something about Windows Defender. I don't remember if it said I needed to update or run it. Since I was on my 7th or 8th application, I just clicked the link and the second I let go of the button, I realized I didn't use Windows Defender and I watched as it loaded a virus or malware on my laptop. I shut down the laptop and it just sat there until earlier this week. I bought and installed a new router, so the laptop cannot access the internet right now and I have the wireless signal turned off. I tried to run the programs you request in the READ ME FIRST thread, but was unable to open anything. I would get a pop up in the bottom right corner of the screen, like I do with my AV, but it was from a "Windows" program. I wish I would have got a screenshot of it, but I did not. It wanted me to click a button that would completely protect my computer. I said everything I tried to open was a virus.

    So I ran all 5 programs in Safe Mode. MalwareBytes found about 139 objects. After running all 5 programs, I restarted in normal and ran all 5 programs again. Everything seems to be working fine and the second set of scans found nothing. I have the logs from the Safe Mode scans and from the second set of scans after I restarted normally. I am just wondering if my laptop is clean and safe to connect to my router. I will attach the scans so you can look at them for me and let me know if everything is ok with my laptop.

    There are 2 MalwareBytes logs because I ran the first one before I manually installed the updated database. The second log is after I installed the updated database.

    Thank you in advance for your help. You really are the best.

    Jess
     

    Attached Files:

    mixmistress508, Feb 20, 2015
    #1
  2. mixmistress508

    mixmistress508 Private E-2

    Here are the MG logs.
     

    Attached Files:

    mixmistress508, Feb 20, 2015
    #2
  3. mixmistress508

    mixmistress508 Private E-2

    You may want to see these logs too. There are the ones I ran after rebooting normally.
     

    Attached Files:

    mixmistress508, Feb 20, 2015
    #3
  4. mixmistress508

    mixmistress508 Private E-2

    Here is the RougeKiller log.
     

    Attached Files:

    mixmistress508, Feb 20, 2015
    #4
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there. I am reviewing those logs and will get back to you with a fix soon. ;)
     
    Kestrel13!, Feb 21, 2015
    #5
  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    The R&R has cleared up alot!


    [​IMG] Fix items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:

    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670} -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | ApnTBMon : "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\APNMCP ("C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe") -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\APNMCP ("C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe") -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\APNMCP ("C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe") -> Found

    Place a checkmark next to each of these items, leave the others unchecked.
    Now press the Delete button.

    ...and the same for this entry in the Tasks tab please...

    • [Suspicious.Path] \\Test TimeTrigger -- C:\Users\Shawn\AppData\Local\Temp\Runner.exe (C:\Users\Shawn\AppData\Local\Temp\DNS.exe) -> Found

    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Reboot the machine.



    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.



    • Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
    • Let me know of any problems you may have encountered with the above instructions and also let me know how things are running!
     
    Kestrel13!, Feb 21, 2015
    #6
  7. mixmistress508

    mixmistress508 Private E-2

    I thought the R&R cleaned everything up, so I'm glad I asked you to check the logs. That's why you're the super expert. I really appreciate your help.

    I ran RougeKiller and deleted what you told me to delete, then I ran Junkware Removal Tool. Attached are the logs.

    Hopefully, all the bad stuff is now gone. :)
     

    Attached Files:

    mixmistress508, Feb 21, 2015
    #7
  8. mixmistress508

    mixmistress508 Private E-2

    I forgot to post the MG logs.
     

    Attached Files:

    mixmistress508, Feb 22, 2015
    #8
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Avira SearchFree Toolbar << I think you ought to uninstall this, it brought in a little bit of junk. ;)


    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    Everything running nicely?
     
    Kestrel13!, Feb 22, 2015
    #9
  10. mixmistress508

    mixmistress508 Private E-2

    Good evening. I hope you had a pleasant Sunday and, if you're in the frozen tundra like I am, I hope you stayed nice and warm.

    I removed the Avira SearchFree Toolbar like you suggested, along with the Yahoo! and Google ones. I will be replacing Avira with AVG since I have AVG on my other laptop and my Android.

    I saved the text and let it merge with my registry and I did receive a success message. So it worked.

    As for how's it running, well, after the registry merge, I logged into my home network and for the first time in months, it's connected to the internet. In fact, I am using it right now and it's working great. It boots us a whole lot quicker and is running great. :highfive Please let me know what the final steps I need to do.

    Thank you for all your help. You helped me in March of last year with removal of a ZeroAccess rootkit and I can't thank you enough for your help then and now. That was the first time I have ever dealt with a virus and I was hoping it was my last. I will pay better attention to pop ups and what they are for before clicking on them. Thank you again. I am indebted to you. :heart You are awesome and totally rock! :dood

    I will be sure to donate to your cause and help support MajorGeeks.

    Jess
     
    mixmistress508, Feb 22, 2015
    #10
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Thankyou very much indeed. :) We really appreciate that. Glad your machine is running nicely again.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

    7. After doing the above, you should work thru the below link:
     
    Kestrel13!, Feb 23, 2015
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds