Trying to download SP3- possible malware issue

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by jlachey, Mar 11, 2012.

  1. jlachey

    jlachey Private First Class

    I have a Dell Dimension 8200 Desktop running Windows XP Home. I have been unable to install Service Pack 3, and a poster on this site suggested I follow the instructions in the Read & Run Me First Removal Guide. SuperAntiSpyware and Malwarebytes did not find any malware. I posted the logs in this thread for Combofix and MGtools- I hope they post correctly, as this is the first time I have done this. RootRepeal would not run. It would stop at 'initializing, please wait'. I also got a message about my computer being low on virtual memory while trying to run it. What do I need to do next? Thanks to anyone who can help!
     

    Attached Files:

    jlachey, Mar 11, 2012
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    What happened to the logs from:

    • Malware Bytes
    • SUPERantispyware
    • Rootrepeal (If not on 64 bit)
    Also you need to run the below.

    I want you to run TDSSKiller so refer to the below for how to do so.

    TDSSkiller - How to run


    Please also download MBRCheck to your desktop
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
     
    Kestrel13!, Mar 12, 2012
    #2
  3. jlachey

    jlachey Private First Class

    MalwareBytes and SuperAntiSpyware didn't find any threats. I attached the logs from them to this post. RootRepeal wouldn't run at all- when I clicked on it, it stopped at 'initializing, please wait.'
     

    Attached Files:

    jlachey, Mar 12, 2012
    #3
  4. jlachey

    jlachey Private First Class

    I have attached the log for TDSSkiller. I'm not sure if MBRCheck ran properly. It closed without asking me to click on exit, and I can't find a log for it. Should I run it again or does the fact that it didn't complete successfully mean something?
     

    Attached Files:

    jlachey, Mar 12, 2012
    #4
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Did you set this policy yourself? If not include it in our fixables

    • O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present


    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    • R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    • O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
    • O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    • O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
    • O2 - BHO: (no name) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)
    • O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
    • O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    • O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    After clicking Fix exit HJT.


    Now we need to use ComboFix by sUBs

    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
    Code:
    KILLALL::

Folder::
C:\Documents and Settings\Jess\Local Settings\Application Data\Conduit
File::
C:\Documents and Settings\Jess\Local Settings\Application Data\{D1CDF90F-5007-40A6-A0C1-9284E463A4BD}
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(8).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(7).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(6).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(9).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(3).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(4).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(5).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1037.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET111A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET11AB.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET12B2.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET140A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET152F.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1548.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET160B.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET16E1.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET190A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET19FC.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1A21.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1B01.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1B9C.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1D0B.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1E37.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1E7E.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1EE4.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1FD7.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET600.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET678.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET6C3.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET884.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET8A2.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET9E6.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETABB.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETB37.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETBFE.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETCD6.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETDAC.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETE86.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETF61.tmp
Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      [​IMG]

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.


    Now go to this MGTools and download the new version of MGtools.exe. Overwrite your previous MGtools.exe file with this one.

    Run the new C:\MGTools.exe and attach the new C:\MGlogs.zip

    Let me know how things are running.
     
    Kestrel13!, Mar 13, 2012
    #5
  6. jlachey

    jlachey Private First Class

    How do I include that policy? And how do I run C:\MGtools\analyze.exe? Do I have to rename C:\MGtools.exe?
     
    jlachey, Mar 13, 2012
    #6
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    It shows in my instructions further down, with other entries.

    No! You would just navigate to C:\MGtools\analyse.exe.

    If you are struggling do not worry, we can tackle it another way.
     
    Kestrel13!, Mar 13, 2012
    #7
  8. jlachey

    jlachey Private First Class

    Oh I understand now- I thought setting that policy was separate from your other instructions, and somehow I managed to look in the wrong folder for the MGtools file. I will follow these instructions later today and let you know how it turns out (I won't be home for the next few hours).
     
    jlachey, Mar 13, 2012
    #8
  9. jlachey

    jlachey Private First Class

    I have attached the logs. Should I try surfing the internet to see if it seems to be working? Is there anything else I should try to see if it is working better?
     

    Attached Files:

    jlachey, Mar 13, 2012
    #9
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You did not download the new version of MGTools as instructed. Further on down you must do so.


    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
    Code:
    
KILLALL::

RenV::
c:\program files\GameHouse\Jigsaw\un-Pets .exe
File::
C:\Documents and Settings\Jess\Local Settings\Application Data\{D1CDF90F-5007-40A6-A0C1-9284E463A4BD}
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(8).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(7).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(6).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(9).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(3).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(4).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(5).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1037.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET111A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET11AB.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET12B2.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET140A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET152F.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1548.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET160B.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET16E1.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET190A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET19FC.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1A21.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1B01.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1B9C.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1D0B.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1E37.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1E7E.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1EE4.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1FD7.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET600.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET678.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET6C3.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET884.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET8A2.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET9E6.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETABB.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETB37.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETBFE.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETCD6.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETDAC.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETE86.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETF61.tmp
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      [​IMG]

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.



    Now go to this MGTools and download the new version of MGtools.exe. Overwrite your previous MGtools.exe file with this one.

    Run the new C:\MGTools.exe and attach the new C:\MGlogs.zip
     
    Kestrel13!, Mar 14, 2012
    #10
  11. jlachey

    jlachey Private First Class

    Did this work? I had followed your instructions- I'm not sure why it didn't previously work.
     

    Attached Files:

    jlachey, Mar 14, 2012
    #11
  12. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    My bad, the version is ok, my apologies. Those files will not be moved by Combo though, so let's try OTM.

    Download and run OTM.

    Download OTM by Old Timer and save it to your Desktop.

    • Right-click OTM.exe And select " Run as administrator " to run it.
    • Paste the following code under the [​IMG] area. Do not include the word Code.

    Code:
    :Files
c:\program files\GameHouse\Jigsaw\un-Pets .exe
C:\Documents and Settings\Jess\Local Settings\Application Data\{D1CDF90F-5007-40A6-A0C1-9284E463A4BD}
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(8).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(7).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(6).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(9).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(3).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(4).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc(5).dll
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1037.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET111A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET11AB.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET12B2.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET140A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET152F.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1548.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET160B.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET16E1.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET190A.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET19FC.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1A21.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1B01.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1B9C.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1D0B.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1E37.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1E7E.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1EE4.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET1FD7.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET600.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET678.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET6C3.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET884.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET8A2.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SET9E6.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETABB.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETB37.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETBFE.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETCD6.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETDAC.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETE86.tmp
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\SETF61.tmp

:Commands
[emptytemp]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Push the large [​IMG] button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.

    NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.
     
    Kestrel13!, Mar 14, 2012
    #12
  13. jlachey

    jlachey Private First Class

    OTM by OldTimer - Version 3.1.19.0 log created on 03142012_115837
     

    Attached Files:

    Last edited by a moderator: Mar 15, 2012
    jlachey, Mar 14, 2012
    #13
  14. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Something seems to be blocking the fixes, let's try again with another tool.

    Download The Avenger by Swandog469, and save it to your Desktop.

    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.
     
    Kestrel13!, Mar 15, 2012
    #14
  15. jlachey

    jlachey Private First Class

    What do you think possibly could be blocking the fixes? Do you need to see the log from Avenger?
     

    Attached Files:

    jlachey, Mar 15, 2012
    #15
  16. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Well that finally shifted them! Are you ready for final steps now? :)
     
    Kestrel13!, Mar 16, 2012
    #16
  17. jlachey

    jlachey Private First Class

    Absolutely! :)
     
    jlachey, Mar 16, 2012
    #17
  18. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Safe surfing!

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required (If we renamed it please rename it back to Combofix.exe.
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    Kestrel13!, Mar 17, 2012
    #18
  19. jlachey

    jlachey Private First Class

    I must have done something wrong. I tried uninstalling combofix- it seemed to do something, then stopped. I still saw the icon on my desktop, so I wasn't sure if it worked. I renamed combofix to combofix.exe, and when I tried to uninstall it, I received a message saying Windows couldn't find it. However, I could find the exact file path by doing a search. Does this mean it is uninstalled and I just have to delete shortcuts?
     
    jlachey, Mar 17, 2012
    #19
  20. jlachey

    jlachey Private First Class

    Actually, would running CCleaner be effective enough in getting rid of remaining files from programs I deleted?
     
    jlachey, Mar 17, 2012
    #20
  21. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Well, follow that file path and see if Combofix.exe is there, if not I would not worry about it.

    What files from what programs? Yes it would not hurt to give it a run to clear temp/junk files, but do not use the registry section.
     
    Kestrel13!, Mar 18, 2012
    #21
  22. jlachey

    jlachey Private First Class

    I can find the exact file path from combofix that the uninstall says it cannot find. Should I just delete it from there? After uninstalling/deleting some files, CCleaner will tell me it has some files from those programs that were left over from the uninstallation (this is in the registry section, but I have not used it since you started helping me. I admit I have used that section in the past. It is an old computer, I have all of my important data saved on other computers, and I backup my registry before deleting anything, so it wouldn't have been an extremely huge deal if something went wrong).
     
    jlachey, Mar 18, 2012
    #22
  23. jlachey

    jlachey Private First Class

    Actually, the combofix icon on my desktop is just the installer, so the program must be gone.
     
    jlachey, Mar 18, 2012
    #23
  24. jlachey

    jlachey Private First Class

    I have removed everything I needed to remove, but now my hard drive is overheating when I try to run Avast. Is this a hardware problem or have I done something in the malware removal process that has been causing the hard drive to work too hard? Is it safe to create a new system restore point?
     
    jlachey, Mar 18, 2012
    #24
  25. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    The overheating is not topic for the malware forum. And no, I doubt it is anything I have had you run to cause it. Very doubtful.
     
    Kestrel13!, Mar 18, 2012
    #25
  26. jlachey

    jlachey Private First Class

    Well, I have flushed my restore points, created a new one, and worked through the link about protecting against malware. Do you have any other final tips for me before I go back to the software forum for assistance in installing Service Pack 3?
     
    jlachey, Mar 18, 2012
    #26
  27. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I am sure the guys and gals in the software forum will give you lots of tips prior to installing SP3. Lots of luck. Take care. :)
     
    Kestrel13!, Mar 19, 2012
    #27
  28. jlachey

    jlachey Private First Class

    Ok. Thank you for all of your help- and for being so patient with me! My computer seems like a completely different computer than it did when the problems first started. Take care and hopefully we won't have to meet on here again anytime soon! :)
     
    jlachey, Mar 19, 2012
    #28
  29. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You are most welcome. ;)
     
    Kestrel13!, Mar 19, 2012
    #29

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds