Help! Malware attack

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by CanadaGuy, Mar 21, 2008.

  1. CanadaGuy

    CanadaGuy Private E-2

    Hi, my computer has been in rough shape lately. I somehow got a bunch of spyware/adware and cant get rid of it. I have lots of adware popups and I just removed TrustedAntivirus spyware successfully (i thought, but recently had a popup), but i still have AdvancedCleaner, ywlbook popups and winimix popups (or somethin like it). my internet is very slow and hesitates, and not all my keystrokes register when i type. please help! heres my hjt log: i ran adaware and removed what i could but there are still problems. thanks for your help.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:54:54 PM, on 21/03/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)


    Edit by chaslang: Inline HJT log removed. READ & RUN ME sticky not followed.
     
    CanadaGuy, Mar 21, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Download HostsXpert and then follow the below steps.
    • Unzip HostsXpert.zip
      [*]It will create a folder named HostsXpert in whatever folder you extract it to.
      [*]Run HostsXpert.exe by double clicking on it.
      [*]click the Make Writeable? button.
      [*]click Restore Microsoft's Hosts File and then click OK.
      [*]Click the X to exit the program
    Now please follow the instructions in the below link and attach the requested logs when you finish these instructions.

    READ & RUN ME FIRST. Malware Removal Guide
     
    chaslang, Mar 22, 2008
    #2
  3. CanadaGuy

    CanadaGuy Private E-2

    Rundll32.exe on startup processes?

    Hello, i went into msconfig today and looked under startup. i saw a couple weird things and thought i'd ask about it.

    under 'startup' item were these two items: yppovxjq and lqaaiofa

    under 'command' for the two items were:

    yppovxjq --> rundll32.exe "C:\WINDOWS\system32\yppovxjq.dll",b

    lqaaiofa --> Rundll32.exe "C:\WINDOWS\system32\lqaaiofa.dll",s


    anyone have any idea what these are? THey are both checked off to run at startup also. thanks for your help!

    jason
     
    CanadaGuy, Mar 22, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: Rundll32.exe on startup processes?

    Yes they are related to common Vundo infections.

    Please remain in one thread and please do what was already given in message # 2 of this thread.
     
    chaslang, Mar 22, 2008
    #4
  5. CanadaGuy

    CanadaGuy Private E-2

    Thanks, I am currently following all the steps in the "read and run me first" post. i will reply again once that is done. thanks for your help
     
    CanadaGuy, Mar 22, 2008
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Make sure that you attach all 3 requested logs and attach them to this thread.
     
    chaslang, Mar 22, 2008
    #6
  7. CanadaGuy

    CanadaGuy Private E-2

    Hello! I followed all the instructions and ran all the scans. I posted the 3 logs to this message. Things seem to be running better. It found and removed the Vundo infections you were talking about, as well as many other infections.

    I'm very happy I stumbled across this website, and I appreciate the help!

    I have a couple questions. I currently use Norton Antivirus Corporate Edition and use the Firewall thats in the Windows Security Center. Im sure this firewall is useless, and was wondering which is the best and simplest to use of the ones you have listed in the "how to protect yourself from malware!" thread.

    Also, what is best to use to stop startup processes. I read the thread on it, and still am not sure what to use. I couldnt stop certain processes from the program itself, so I need a program to help do it, one that I wont accidentally screw up my computer with.

    Thanks again! With Ad-Aware 2007, CCleaner, Super Antispyware, Spybot, Norton Antivirus and a firewall, I should be in good shape!

    Jason
     

    Attached Files:

    CanadaGuy, Mar 22, 2008
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    All firewalls come with some degree of difficulty, but all of the ones in the thread you mentioned are much better than the Windows Firewall as stated in that thread. Give PC Tools Firewall a try and see how you like it.

    Try one of the ones mentioned in the link in the READ ME....like AutoRuns.

    What is in the below file? You can load it into notepad to look at it and copy and paste the info here:
    C:\Program Files\Common Files\lavu130


    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 2
    Java 2 Runtime Environment, SE v1.4.2_03
    Search Assistant - My Web Search

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {01B4EE87-BDD5-49FF-973F-BE4DDBB48A6E} - C:\WINDOWS\system32\gebyv.dll (file missing)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O15 - Trusted Zone: *.gomyhit.com
    O15 - Trusted Zone: *.imageservr.com
    O15 - Trusted Zone: *.storageguardsoft.com
    O15 - Trusted Zone: *.gomyhit.com (HKLM)
    O15 - Trusted Zone: *.imageservr.com (HKLM)
    O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
    O18 - Protocol: bw+0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: offline-8876480 - {5046C033-A53E-40E9-8C62-20D4B12D3259} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O20 - Winlogon Notify: khfcyvw - khfcyvw.dll (file missing)
    O20 - Winlogon Notify: winetn32 - winetn32.dll (file missing)

    After clicking Fix, exit HJT.

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Mar 23, 2008
    #8
  9. CanadaGuy

    CanadaGuy Private E-2

    Thanks again for your time and effort, i really appreciate it.

    the C:\Program Files\Common Files\lavu130 file contains the following when opened in notepad:

    [\GRu?6KZWn:òÙÄì—Üʼ¢æÉßsy6IZn#:8];ãäÛÀ쇇ãؾ›Ž&fdR=0!,ÕØØ£ÀÆȶêõË™u"}FW&43I7ðÏüøó‹ÿ윇†ˆi}4PVLOF[j$?ìÇÎêÒ°º¨ØÃÙazdmVY5;-
    ¬ïùÍ…óÛ¼“¸É¾•Q|tcH42 Sbv‹šÉÌÁχº³’“ÉË,q\0+*+ôëøò•ÚȲ àËÁu{8TED*32÷ ûÍÁ™´§·ñœÒvxjG\>4S!<¼ù


    when i tried to uninstall "Search Assistant-My Web Search" using the 'Add or Remove Programs' in Windows a window pops up that is blank with the window named res://C:\PROGRA~1\MYWEBS~1\SrchAstt\1.bin\mwssrcas.dll/101

    also, in the 'add or remove programs' list is 'Adobe Dreamweaver CS3' and i saw other CS3 things listed in logs from MGTools. This program would not uninstall using the add or remove programs so i deleted everything in the Program Files folder for it (i did this a while ago). This and a few other programs on the 'add or remove programs' list arent on my computer anymore, but the name is still on the list. Any way to get rid of them?

    my computer seems to be running much better than a few days ago. there are no longer any popup ads and the computer is running much quicker. i have attached the logs you requested. i saw on your profile you're a Research & Development Engineer? i'm a new graduate from chemical engineering and start work next week :)
     

    Attached Files:

    CanadaGuy, Mar 24, 2008
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Okay it is a binary file then. It is strange that it has no extensions attached and does seem suspicious. Since you are not having any current problems I would just leave it alone. The alternative would be to move it to a backup folder somewhere or to just rename it in place. And then see if any error messages popup from any applications.

    You can try just running CCleaner and selecting Tools. Under Tools there is an Uninstall selection which will list the installed programs. Using the Run Uninstaller option will try to use the normal uninstall method. If that fails, you can then use the Delete Entry option.

    If these were not uninstall properly, you can use the Ccleaner Delete Entry option as above, but this will not cleanup all the junk left hanging around in the registry from Adobe. You may be able to take care of that with the Issues option of CCleaner but this is not a topic for the Malware Forum.

    Yes that's my short bio. ;) Well good luck in your new job! Things are difficult these days in some fields of engineering.


    Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. Uninstall COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN
      • Now type cf /u in the runbox and click OK.
      • Note: The space between the cf and the /U, it must be there.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.
    9. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    10. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    11. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    12. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    13. After doing the above, you should work thru the below link:
     
    chaslang, Mar 25, 2008
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds