Please help remove Trojan.Win32.Agent.akk

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by halljab, Dec 6, 2007.

  1. halljab

    halljab Private E-2

    Please help with this nasty trojan. I have completed the "Read Me First". I then completed the Windows XP Cleaning Guide. Nothing seems to work. Any help would be greatly appreciated. Attached are the 3 requested logs. Thank you in advance
     
    Last edited: Dec 9, 2007
    halljab, Dec 6, 2007
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please run FixIEDef which removes IE Defender, AntiSpyPro and the associated Trojan.Downloader.Delf infection.
    1. Download FixIEDef.zip by ShadowPuterDude to the Desktop.
      • NOTE: It must be saved to your Desktop or it may not work properly
    2. Double-click FixIEDef.zip, this will create a folder named FixIEDef on your Desktop.
    3. Double-click of the FixIEDef folder.
    4. Locate FixIEDef.bat and double-click on it.
    5. FixIEDef will now run.
    6. Press any key to close the CMD Console when the script is finished.
    Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created.


    Make sure you tell me how things are working now!
     
    chaslang, Dec 7, 2007
    #2
  3. halljab

    halljab Private E-2

    chaslang thanks for helping. I have attached the new C:\MGlogs.zip file you requested. Unfortunately, It still gives me the popup everytime I try to access a Windows drive, folder, etc. Maybe you'll see something in new log. Thanks again for helping me out with this issue.
     
    Last edited: Dec 9, 2007
    halljab, Dec 7, 2007
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you download and run FixIEDef?? It normally fixes this. What version of FixIEDef is showing when you run it? Did you see any error messages in the command prompt window that opens. Perhaps something (like McAfee) is stopping FixIEDef from running properly.
     
    chaslang, Dec 8, 2007
    #4
  5. halljab

    halljab Private E-2

    I disable McAfee and ran the FixIEDef and it seem to be ok at the moment (not getting the popup constantly). I reattached a new MGlogs.zip in case you need it. Thanks again for the help and I'll let you know if the problem starts back.
     
    Last edited: Dec 9, 2007
    halljab, Dec 8, 2007
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No you are still infected. Let's remove this manually and also fix a few other issues.


    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 8
    Java(TM) 6 Update 2
    Java(TM) SE Runtime Environment 6 Update 1
    Java(TM) SE Runtime Environment 6
    Now let's remove a left over service from Symantec.
    • Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
    • On the page that opens, scroll down to Symantec Core LC
    • then right click the entry, select Properties and press Stop Service.
    • When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
    • Click OK until you get back to Windows.


    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: System DivX4 - {2FA3B736-1AC7-454D-8E94-8BA8158BF064} - C:\WINDOWS\system32\sysvideo32.dll
    O2 - BHO: OFK System - {CD592DBF-7138-4805-A93B-B9491B6E53FC} - C:\WINDOWS\vipextmdx.dll
    O3 - Toolbar: The voipwet - {0F54B96C-3482-407B-9C9C-A671E08271B5} - C:\WINDOWS\voipwet.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKCU\..\Run: [LDM] D:\Logitech Remote\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Logitech Remote\Desktop Messenger\8876480\Program\LDMConf.exe
    O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
    O18 - Protocol: bw+0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - D:\Logitech Remote\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: offline-8876480 - {27B1F4F9-D93A-4861-8581-6536BABD43E2} - D:\Logitech Remote\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O21 - SSODL: kopmet - {4016BCB4-19BD-449F-8D1C-B3517178447B} - (no file)
    O21 - SSODL: jetctrl - {00F9AB91-3411-4B94-AC14-51B267EBA22B} - C:\WINDOWS\jetctrl.dll

    After clicking Fix, exit HJT.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt

    Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

    NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
    • Click the Empty Selected button.
      • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
    • Click the Empty Selected button.
      • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main ATF Cleaner menu to close the program.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Make sure you tell me how things are working now!
     
    chaslang, Dec 8, 2007
    #6
  7. halljab

    halljab Private E-2

    I completed everything that was suggested. Attached is the new C:\MGlogs.zip file but Avenger did not produce a me a text file. I went in a manually deleted "C:\WINDOWS\voipwet.dll" and "C:\WINDOWS\jetctrl.dll". The other two: "C:\WINDOWS\vipextmdx.dll" and "C:\WINDOWS\system32\sysvideo32.dll" may have been gotten when avenger ran at reboot but did not produce the log for some reason. Thanks for letting me know I still had a problem. Just let me know if I need to do anything else. On a side note though, When I walk away from pc for extended period of time, I come back and an internet explorer window is open trying to get online. I don't use IE and have removed it via add/remove programs and I told Comodo firewall to deny the explore.exe. Let me know what you think and thanks again for all your help.
     

    Attached Files:

    halljab, Dec 9, 2007
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your logs are clean.

    You should not be disabling IE or removing nor should you be blocking iexplorer.exe (which is not the same as explore.exe which you also should not block) in your Firewall. IE is an integral part of Windows. Without IE, you cannot get all of your Windows Updates and thus Windows Update, Windows Genuine Advantage and many other things will not work. Also thousands of websites require IE to work. Even some your other software updates that are trying to run in the background may require IE to run.


    As stated, your logs are clean but you should do the below.

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    F3 - REG:win.ini: load=
    F3 - REG:win.ini: run=
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

    After clicking Fix, exit HJT.


    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    10. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
     
    chaslang, Dec 10, 2007
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds