Windows Live OneCare finds severe issues- cannot clean

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by brijamgel, Jul 15, 2008.

  1. brijamgel

    brijamgel Private E-2

    Hello,

    I felt that I was possibly having some performance issues and decided to run the free Windows OneCare Live full-service safety scanner. It indicated that I have 2 severe issues that it was unable to clean:

    Issue A. (1 item detected)
    VirTool:Win32/DelfInject.gen!K

    g:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30--83e44c588624}rp\1787\a0323275.exe

    Below that for this issue it says: (sfxcab)\window~1.exe

    Issue B. (2 items detected)
    Worm:Win32/Mydoom.BO@mm

    1. f:\backup_everything on original drive\documents and settings\all users\application data\symantec\norton antivirus corporate edition\7.5\aptemp\ap246.tmp

    Below that for this issue it says: hvlbcrhfpei.exe

    2. f:\backup_everything on original drive\documents and settings\all users\application data\symantec\norton antivirus corporate edition\7.5\aptemp\ap225.tmp

    Below that for this issue it says: bnjtvyc.exe

    I did use Norton AV in the past, but it is no longer installed on my machine. I carefully followed the Windows XP malware removal instructions listed here (learned some excellent info by the way, e.g. not to use msconfig to control startup, which I always have in the past) and ran all scans and have attached all pertinent logs here. I was curious what my next step would be to ensure that I am free of malware. Also, I have removed AVG free and am looking for a good replacement- it seems the professionals here mostly recommend either AVAST or AntiVIR for free software. Is this more a matter of personal preference here, or is one considered superior to the other? Any help would be greatly appreciated, and I must say that this is a very educational and helpful forum!
     

    Attached Files:

    brijamgel, Jul 15, 2008
    #1
  2. brijamgel

    brijamgel Private E-2

    Last attachment- MGlogs.zip

    Here is the MGlogs.zip attachment
     

    Attached Files:

    brijamgel, Jul 15, 2008
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The cleaning procedure took care of any minor malware issues you had. The items in your first message are not problems. The system volume information folder is System Restore and that is only cleaned up by toggling system restore off and then back on as mentioned at the end of the cleaning instructions in the READ & RUN ME.

    The other two items are just due to the scan complaining about Norton definitions stored in old backup folders. Since you don't use Norton anymore just delete the below folder:

    f:\backup_everything on original drive\documents and settings\all users\application data\symantec


    You do have a bunch on other things (mostly non-malware) to fix as given below.

    Uninstall Viewpoint Media Player as requested in step 1 of the READ & RUN ME

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O18 - Protocol: bw+0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw+0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw-0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw-0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw00 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw00s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw10 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw10s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw20 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw20s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw30 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw30s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw40 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw40s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw50 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw50s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw60 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw60s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw70 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw70s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw80 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw80s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw90 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bw90s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwa0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwa0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwb0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwb0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwc0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwc0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwd0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwd0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwe0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwe0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwf0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwf0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwg0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwh0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwh0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwi0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwi0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwj0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwj0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwk0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwk0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwl0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwl0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwm0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwm0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwn0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwn0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwo0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwo0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwp0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwp0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwq0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwq0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwr0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwr0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bws0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bws0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwt0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwt0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwu0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwu0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwv0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwv0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bww0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bww0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwx0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwx0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwy0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwy0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwz0 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: bwz0s - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)
    O18 - Protocol: offline-8876480 - {6A6C0EE7-A2AC-4239-AC22-646F8EC91D3A} - (no file)

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run reboot!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 16, 2008
    #3
  4. brijamgel

    brijamgel Private E-2

    Chaslang,

    First of all, I must offer a huge thank-you for your time and efforts!

    Sorry about the Viewpoint- I thought I had already uninstalled that. I wasn't sure if I should toggle the system restore until I had heard from a professional, so I did that process also. I deleted the folder you instructed (would not delete initially, had to use moveonboot program), as well as deleted the entries you specified in HJT. I then merged the other items into the registry- it indicated that it was successful. Things seem to be working fine as far as I can tell.

    I have attached the new MGlogs.zip file here- hopefully I am in better shape now. Thanks so much again!
     

    Attached Files:

    brijamgel, Jul 17, 2008
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.


    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
    4. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combo-fix" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    9. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Jul 17, 2008
    #5
  6. brijamgel

    brijamgel Private E-2

    Thanks again Chaslang- I believe I am now in the clear! I completed the final steps you listed.

    I have decided to go with AntiVir, as opposed to Avast for the free AV software! From everything I see and read, neither seems to have a definitive edge over the other.
     
    brijamgel, Jul 18, 2008
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Jul 18, 2008
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds