Re: Help! Confusing issues going on...

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by PunyN00b, Feb 4, 2011.

  1. PunyN00b

    PunyN00b Private E-2

    Hey Kestrel, I'm back. :( I figured I would just continue in this thread rather than starting a new topic for an old issue.

    My folks' desktop seems to be infected again. It's not near as bad as it was last time, but it's still not running right. Malwarebytes and Super Anti-Spyware say nothing is wrong but I'm not buying it. It's running a lot slower than it should be, it keeps losing internet connection, it is unable to connect to Windows Updates, I can't get it off of selective startup. In Mozilla Firefox when I right click on the page the menu is just a blank grey box (none of the options appear). Just all kinds of little issues like that which lead me to believe something is still amiss on this thing. I installed all the stuff listed in the "How to keep your computer spyware free" thread and everything. The main thing that leads me to believe that there is some rogue file on here somewhere is when I run the registry cleaner tool on CCleaner. It will find the bad registry files and I'll delete them, but if I go back in and run it again this one registry file pops right back up and it's the same one every single time. No matter how many times in a row I run the registry cleaner it's right back in there; it just won't go away. I went through the Read Me again. Like I said, I can't get it off of selective startup for the life of me. Whenever I run msconfig and click on normal startup it just goes back on selective startup as soon as I hit apply. Also Root Repeal wouldn't run (again). Can you take a look at the logs for me and see if you see something?
     

    Attached Files:

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I moved your thread here because piggy backing off of the other one would have made thing awkward for us both.

    Try setting it again and applying in SAFE mode.

    Important Notice: A new version of SUPERAntiSpyware is available.
    • Please uninstall your current version (this is necessary).
    • Then download this SUPERAntiSpyware
    • Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.
    • After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.
    • Now run a new full scan of your system. And attach this log later.

    Ask Toolbar <--- Uninstall this.

    it is unable to connect to Windows Updates

    You are using Comodo Internet Security. Ae you only using the firewall as you aleady have antivirus in the form of avira?

    You should make sure that windows updates is allowed through your firewall.

    There are so many possible causes of problems with Windows Update that it would probably be best to send you to the Software Forum. However, there are a few things we can try first.

    1. Make sure time and date and TimeZone are correct
    2. See if it works in safe boot mode
    3. Reset HOSTS file

    Download HostsXpert and then follow the below steps.
    • Unzip HostsXpert.zip
    • It will create a folder named HostsXpert in whatever folder you extract it to.
    • Run HostsXpert.exe by double clicking on it.
    • Click the Make Writeable? button. (if you only see a Make Read-Only selection, it is already writeable so skip this button).
    • Click Restore Microsoft's Hosts File and then click OK.
    • Click the X to exit the program

    4. flush DNS server

    Right-click on the Command Prompt icon and select
    "Run as administrator". Then type in: ipconfig/flushdns
    and press the Enter key on your keyboard.

    5. add Microsoft URLs to the Trusted Zone (see below)
    6. shutdown firewall and retry
    7. shutdown AntiVirus and try

    MS URLs

    http://*.update.microsoft.com
    http://download.windowsupdate.com
    http://genuine.microsoft.com
    http://go.microsoft.com
    http://support.microsoft.com
    http://update.microsoft.com
    https://*.update.microsoft.com <--Notice the https designation.

    The first thing to always check for Windows Update problems! make sure that Automatic Updates is not turned off. It needs to be on and the service status needs to be Started and the Service type needs to be Automatic.

    Which one exactly?? :confused
     
  3. PunyN00b

    PunyN00b Private E-2

    This is the suspect registry key:

    Just used the tool about 5 times in a row or so and it came back every single time, even after I got rid of it. Restarting computer in safe mode now to try to work on the rest, I'll get back to you with the results in a little bit.
     
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    There's only one way to get it to exclude:

    • Start CCleaner, then click Options->Advanced, now tick:
      Save all settings to INI file
    • Close CCleaner.
    • Open Notepad, then open this file with it:
      C:\Program Files\CCleaner\ccleaner.ini
    • If you have other exclusions they'll be listed in ccleaner.ini, and this new exclusion must be in alphanumerical order, i.e.; if you already have say two exclusions like Exclude1 and Exclude2 this new one must be Exclude3.
    • This is the exclusion to put into ccleaner.ini,:
      Exclude3=REG|HKCR\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}
    Or you can open CCLeaner and click on options then on exclude and add that reg. key.
     
  5. PunyN00b

    PunyN00b Private E-2

    Okay, finished. Here are my results:

    1. I couldn't uninstall the Ask Toolbar because it wasn't in the Add/Remove Programs list.

    2. Did all the things suggested on the Windows Updates. It's still not fully working, though something I did there allowed me to install a few updates that were failing before. Specifically, they are still running Service Pack 1 on this machine and it won't allow me to access Service Pack 2. I tried to download it manually from Microsoft and it didn't work either. I tried going to the Microsoft website and troubleshooting it myself, but the steps they suggested didn't work either. I don't know what the deal is. Also, it is set for automatic updating.

    3. Yes, I am only using the firewall on Comodo and updates are allowed.

    4. When I rebooted in safe mode I still couldn't put it on normal startup. It did the same thing. As soon as I hit apply it automatically just reverted back to selective startup.

    5. I uninstalled Super Anti-Spyware and downloaded the new version. The results of the new scan are attached.

    One of the tools (likely Combofix) must have fixed something, because now my right click menu on Firefox is showing up. Programs are still taking forever to load though, and I'm still experiencing slow startups. Also, I used TimW's suggestion to fix the registry key (I googled it and it turns out it was something from Avira and therefore probably harmless) and it has stopped showing up.
     

    Attached Files:

  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Time for final steps then as you are malware free. You can post in the software forum regarding any outstanding issues. :)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  7. PunyN00b

    PunyN00b Private E-2

    Done. Thanks for taking a look.
     
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    No problem. :) Safe surfing.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds