Still having problems after READ ME and cleaning procedure

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by ochre111, Jul 10, 2010.

  1. ochre111

    ochre111 Private E-2

    The problems started after my browser locked up while on the internet. I had previously used MalwareBytes and it fixed my problems, so I tried it again this time (before consulting the READ AND RUN ME post, which I found afterwards). So I ran MalwareBytes and it deleted multiple items. However, my internet explorer no longer opens and while browsing in Firefox random sites will open in new tabs and google links will go to random sites. (Also, my computer warns me that the Internet Explorer Firewall is disabled upon startup). These problems still continue after following the Windows XP Cleaning Procedure.

    I apologize for having to run SUPERAntiSpyware twice. The first time took a very long time and then got locked up while scanning my external hard drive. So I re-ran it on just the external hard drive a few days later.

    MalwareBytes found nothing new this time, but I will also include the old log file with the previously deleted stuff. (When I did the initial MBAM scan it asked me to reboot to complete the removal, which I did, and then it seemed to have errors after it rebooted, and I had to reboot again.)

    I had no luck with ComboFix. It would get to the point where it says "scanning for infection." Usually takes 10 minutes but could easily double. I left it for an hour or more and it did nothing.

    No luck with RootRepeal either. After double clicking it would say "Initializing, please wait." Then windows virtual memory would get too low and nothing more would happen.

    Also, and I regret this, MG Tools would not proceed past the initial lines and "NOTE: Ignore any error messages about not finding registry keys!
    Just wait for the program to finish running!!"


    Any help would be immensely appreciated and I look forward to doing anything I can to fix this.

    Thank you.
     

    Attached Files:

    ochre111, Jul 10, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The red is merely informational.

    cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
    GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
    ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.
     
    TimW, Jul 11, 2010
    #2
  3. ochre111

    ochre111 Private E-2

    After entering GetRunKey it was the same as before. It says, "Running scan with GenRunKeys.bat Version 2.54 - (C) 01/28/2006 By Chaslang

    NOTE: Ignore any error messages about not finding registry keys!
    Just wait for the program to finish running!!"

    and then it doesn't proceed any further. No errors.

    Since that didn't work I had to close it and end the program, and then I retried with just the ShowNew. That worked and said: "Scanning please Wait.
    The system cannot execute the specified program.
    ==== Finding copies of actxprxy.dll===" and so on, and at the end it added newfiles.txt
    ffdata.txt
    winfiles.txt

    Do you need those?
     
    ochre111, Jul 12, 2010
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Attach the current C:\MGlogs.zip file which should have these file already in it.


    Also try the below:

    Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The red is merely informational.

    cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
    GRK <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
     
    chaslang, Jul 12, 2010
    #4
  5. ochre111

    ochre111 Private E-2

    Here's the MGlog zip.

    GRK went one step further and said "32 bit Windows OS found," but didn't get any further than that.
     

    Attached Files:

    ochre111, Jul 12, 2010
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What protection software are you running and have you disabled it before trying to run ComboFix and MGtools.


    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis.
    • Select Do a system scan and save a log
    • Accept the license agreement from TrendMicro if one appears. You need to click the Accept button twice for it to work.
    • Wait for the log file to open in notepad and then just close the notepad window.
    • Also close the HijackThis window
    Now look in the C:\MGtools folder and you should see the hijackthis.log file. Attach this to your next message.



    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7 make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 12, 2010
    #6
  7. ochre111

    ochre111 Private E-2

    Ok, alot of breakthroughs today...

    I discovered that Internet Explorer now opens, and Windows Firewall is active again, not sure when that happened.

    I followed all of the instructions in your last post and all went well. The first time I double clicked the new MGTools.exe it seemed to open and close right away. I double clicked it again, and it said "The process tried to write to a nonexistent pipe." -- then went on to

    "GetUnkeys.bat

    zip diagnostic: GetVolumeInformation failed
    zip warning: name not matched: GetUnKey.txt

    zip error: Nothing to do! (C:/MGlogs.zip)"

    Get RunKeys.Bat had the following errors:
    "Registry Editor
    Cannot export C:\MGTools\temp\xrkey01.txt: Error opening the file. There may be a disk or file system error."

    "sgmain.exe - Application Error
    Cannot export C:\MGTools\temp\xrkey02.txt..."

    The exception Floating-point inexact result.
    (0xc000008f) occurred in the application at location 0x7c812afb.

    Click on OK to terminate the program

    Registry Editor: regedit.exe - Bad Image

    The application or DLL C:\WINDOWS\system32\MSCTF.dll is not a valid Windows image. Please check this against your installation diskette.


    After all that I decided to give it one more try to see what would happen and this time it went through the entire process beautifully!

    I've attached the files you requested. And actually things seem to be working well now, no real sign of infection.

    The first time I opened IE it loaded my homepage but there were no menus or buttons at all at the top. The second time I opened it all seemed to be fine.
     

    Attached Files:

    ochre111, Jul 13, 2010
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's great but you have some more to do. Mostly to get rid of outdated applications and you need to get proper protection installed.

    Uninstall all of the below ( if still showing in Add/Remove Program. Some may not show):
    Ewido << very outdated and unsupported
    Java(TM) 6 Update 2 << very outdated
    Java(TM) 6 Update 3 << very outdated
    SpywareGuard << very outdated, unsupported, and ineffective
    Viewpoint Manager << foistware/junkware

    Is your Symantec AntiVirus a current version and do you get updates for it? Or is it very old and without updates?


    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O4 - Startup: PowerReg Scheduler V3.exe
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

    Optionally fix the below which are unnecessary wastes of System Resources
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office (2).lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

    After clicking Fix, exit HJT.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7 make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 14, 2010
    #8
  9. ochre111

    ochre111 Private E-2

    Ewido, SpywareGuard, and Viewpoint Manager were unavailable to uninstall from add/remove programs, but I did remove the two Java 6 updates. (Are there any other ways to remove those programs? or did avenger mostly do it for me?)

    My Symantec is very old and without updates. It came free from a college campus about 7 years ago and cannot be updated. I basically regard it as useless now, though I've left it just in case.

    I removed the lines from HiJackThis and ran the Avenger quote you gave me. All kinds of scary things started happening when I rebooted after Avenger (it made me activate Windows at startup, and then all kinds of application errors occured when my desktop was loading, and IE didn't open) so I just rebooted again figuring it had to do with the Avenger stuff. All was well after the second reboot.

    I updated Sun Java and ran MGtools again. Here are the files.
     

    Attached Files:

    ochre111, Jul 15, 2010
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your logs are clean.

    You should not be running your PC with outdated protection software like you have been doing. Uninstall Symantec now and follow my final instructions which includes getting protected.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Jul 17, 2010
    #10
  11. ochre111

    ochre111 Private E-2

    Thank you so much. I appreciate all of your time and help. You guys are a credit to mankind!
     
    ochre111, Jul 18, 2010
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Jul 18, 2010
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds