Would like a check after restoring Windows Updates

Hi Guys,

I found this forum today after trying to fix a problem with some malware. My machine had the zeroaccess trojan (possibly amongst others) which I think I've managed to get rid of.

The software I usually run is TDSS Killer, Malware Bytes, Spybot, Perlovga PRT and SuperAntiSpyware, and this usually does the job.

After this though, I noticed that Windows Updates wouldn't run and was missing from the Services.

I found this post on here: http://forums.majorgeeks.com/showthread.php?t=264176 and have followed it down to making the FRST log (attached).

Windows updates is working now but I wondered if someone could have a look over the log and check there is nothing else suspicious lurking.

Also, there seems to be a small abnormality with my machine in that whenever I restart, it doesn't remember how my desktop icons were laid out and puts them back to how they were when I had the machine in safe mode.

Could someone have a look for me when you get a minute please.

Thanks in advance for your help.

Cheers,

Stu

 

Welcome to MajorGeeks, Stu
You are still somewhat infected. I recommend going through the Read and Run Me First - Malware Removal Guide thread after you complete the below:

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

• Save fixlist.txt to your flash drive.
• You should now have both fixlist.txt and FRST.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

 

Thanks for the quick reply. Fixlog attached.

Had a look over the Removal Guide and will carry out all the suggested scans now.

Cheers,

Stu

 

Latest logs here chaps. TDSS Killer found no threats.

Cheers,

Stu

 

From Programs and Features (via Control Panel), please uninstall the below:

• Java(TM) 6 Update 31

__

Run C:\MGtools\analyse.exe by double-clicking it (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Choose "Do a system scan only" and select the following lines but do not click fix until you exit all explorer windows and all browser sessions including the one you are reading in right now:

• O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

After clicking Fix, exit out of Trend Micro HiJackThis - v2.0.4

__

Any other issues? Didn't find much in your remaining logs.

 

Done.

All seems to be running okay apart from one small niggle.

Everytime I reboot, the desktop icons always go back to where they were when I booted in safe mode.

They're set to large, randomly positioned, and all bunched up on the left of the screen.

Whenever I reboot, I set them to small, and lay them out in the correct place but after each reboot, they go back to where they were.

Am I okay to run a CCleaner clean up and registry clean now?

Cheers,

Stuart

 

The icons resetting their position upon reboot is a known side-effect of this infection. The cure for it is still unknown. I will post back with information on how to fix it if I find a solution.

Yes you can do CCleaner at this time if you'd like.

__

If you are not having any other malware related problems, it is time to do our final steps:

• Any programs we had you download and/or install can be removed at this time.
• If we had you download and run ComboFix, here is how to uninstall it:
  • Press and hold the Windows key and then press the letter R on your keyboard.
  • This opens the Run dialog box.
  • Copy and paste the below text inside the text-field:
    • "%userprofile%\desktop\ComboFix" /uninstall
  • Now press ENTER
  • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
• You can re-enable your Disk Emulation software at this time via DeFogger.
• If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
• Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
• Now we will toggle System Restore to remove any infected system restore points.
  • Read this: How to Disable And Enable System Restore
• Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
• Be safe

 

Thanks for all your help with this.

It has been most useful and looks like I'm clean again.

Please do let me know if you find a way of sorting those icons.

You guys rock!

Cheers,

Stu

 

You're welcome, Stu.
Be safe.