Trying to clean up dad's laptop

ONEEYEMAN · Sep 30, 2015

Hi,
My parents cam to visit and brought their laptops with them.
One laptop I was able to fix, the other I couldn't.

Just finished R&R. Here are the logs.
Unfortunately they will be leaving soon back home, so I'd like to take care of this ASAP.

Thank you.

Kestrel13! · Oct 2, 2015

Re run Hitman Pro and allow it to remove all that it finds.
Re run Malware Bytes and have it fix what it finds too, there may be more.

Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>

nwktst<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.

GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.

ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.

analyse <-- this attempts to run HijackThis. Be sure to click the Accept button twice in the license agreement popup or it will just sit there and wait.

Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above.

ONEEYEMAN · Oct 2, 2015

Kestrel13!,
I re-run the scanners and fixed everything it found.
Then I ran the batch files that you asked. The only issue I had was:

Code:

C:\MGtools>shownew


ShowNew.bat    - 08/06/2015 Version 3.20


    ************************** WARNING **************************
     If you see a popup saying that:

          SteelWerX WhoAmI application has stopped working

     do not click the Cancel button that first appears.  Wait for
     the Close program button to appear and click it to continue
    ************************** WARNING **************************

    Scanning please Wait.
Access is denied.
    ============= Finding copies of actxprxy.dll
    ============= Finding copies of beep.sys
    ============= Finding copies of csrss.exe
    ============= Finding copies of ctfmon.exe
    ============= Finding copies of eventlog.dll
    ============= Finding copies of explorer.exe
    ============= Finding copies of kernel32.dll
    ============= Finding copies of lsass.exe
    ============= Finding copies of netlogon.dll
    ============= Finding copies of ntfs.sys
    ============= Finding copies of powrprof.dll
    ============= Finding copies of proquota.exe
    ============= Finding copies of regedit.exe
    ============= Finding copies of scecli.dll
    ============= Finding copies of services.exe
    ============= Finding copies of spoolsv.exe
    ============= Finding copies of svchost.exe
    ============= Finding copies of termsrv.dll
    ============= Finding copies of userinit.exe
    ============= Finding copies of user32.dll
    ============= Finding copies of winlogon.exe
    ============= Finding copies of ws2_32.dll
    Checking for .COM files to Delete. They will only print if deleted

    Listing COM, DLL, EXE, and SYS file in C:\WINDOWS
    Locating COM files in C:\WINDOWS\system32 - recursive
    Locating DLL files in C:\WINDOWS
    Locating DLL files in C:\WINDOWS\system32 - recursive
    Locating EXE files in C:\WINDOWS
    Locating EXE files in C:\WINDOWS\system32 - recursive
    Locating SYS files in C:\WINDOWS
    Locating SYS files in C:\WINDOWS\system32 - recursive
    Zipping newfiles.txt
    Finished Zipping newfiles.txt
    Zipping ffdata.txt
    Finished Zipping ffdata.txt
    Zipping winfiles.txt
    Finished Zipping winfiles.txt

    All finished with ShowNew.  The log is in C:\MGtools\newfiles.txt

Also, I'm attaching the "analyse" log.
Please review.

Thank you.

Kestrel13! · Oct 3, 2015

Remember I had said:

Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above.
Click to expand...

Are you seeing a MGLogs.zip? (a new one not the one you attached at first)

ONEEYEMAN · Oct 3, 2015

Sorry, attached.

Kestrel13! · Oct 3, 2015

What are these?

O4 - HKCU\..\Run: [Tetatet] "C:\Documents and Settings\Semen Korot\tetatet\tetatet.exe" auto

O4 - HKCU\..\Run: [Kuku] "C:\Documents and Settings\Semen Korot\kuku\kuku.exe" auto

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

How are things running now?

ONEEYEMAN · Oct 3, 2015

OK, log is attached.

Those 2 are internet TV providers.

Thank you.

Kestrel13! · Oct 4, 2015

OK. Let me know how things are running please.

ONEEYEMAN · Oct 4, 2015

It still takes a lot of time to start FF. ;-)

Kestrel13! · Oct 4, 2015

Firefox takes a long time to fire up for me too, I usually open it then go and put the kettle on whilst it loads. Are there any actual malware problems remaining?

Log in or Sign up

Trying to clean up dad's laptop

ONEEYEMAN Corporal

Attached Files:

HitmanPro_20150930_1930.log

mbytes.txt

roguekiller.txt

TDSSKiller.3.1.0.5_30.09.2015_19.09.30_log.txt

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ONEEYEMAN Corporal

Attached Files:

hijackthis.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ONEEYEMAN Corporal

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ONEEYEMAN Corporal

Attached Files:

JRT.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ONEEYEMAN Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Trying to clean up dad's laptop

ONEEYEMAN Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ONEEYEMAN Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ONEEYEMAN Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ONEEYEMAN Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ONEEYEMAN Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches