Combofix gets stuck

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by msidea, Dec 14, 2007.

  1. msidea

    msidea Private First Class

    Hi Major and community,

    I'm not a geek (yet) but am trying hard. :cool So please be patient with me.

    I'm trying to clean out my mom's laptop which is ridden with trojans and malware according to the various antivirus & anti-spyware that I've installed in it (one at a time of course) prior to me finding your site recently.

    I'm following the intructions on READ & RUN ME FIRST. The malware was actually disabling some of the antivirus and wreaking havoc on the system so that it would not even show the desktop on boot up. So, first I download the antivirus on my flash drive and then install in my mom's computer.

    When I ran combofix, it runs thru with no problems until it gets to "Deleting files/folders". It has been doing this for about an hour with no advance.

    Any help would be appreciated.

    Thanks.
    Lissy
     
    msidea, Dec 14, 2007
    #1
  2. abri

    abri MajorGeek

    Hi msidea!

    Try this! Skip ComboFix for now. Just run AVG AntiSpyware and then move on to the steps with MGtools.

    Attach the logs from AVG AntiSpyware and the C:\MGlogs.zip file from running MGtools.

    abri
     
    Last edited by a moderator: Dec 14, 2007
    abri, Dec 14, 2007
    #2
  3. msidea

    msidea Private First Class

    Hi Abri,

    Thanks so much for responding. I literally have both laptops on my dining room table open and awaiting instructions from someone who knows more than me, which at this point is most people! :D

    Anyway, I did everything exactly as you said, I think. The logs are attached.

    rapport1 is the log having run the search in smitfraud in normal mode.
    rapport2 is the log having run it in safe mode
    rapport3 is the log having run the clean cycle in safe mode

    During the cleaning, I got a window from Disk Cleanup telling me that it was calculating how much space would be cleared. Whatever my mom's computer has seems to be a bit of a shyster and throw seemingly innocent windows at me which when I click "ok", the good programs don't work, or freeze, or whatever. So I ALT Tab to get back to the SmitFraudFix window and went from there.

    Now what? Do I continue with spybot, which I had run prior but did not seem to extricate too much? And then AVG & MGTools?

    I'm at your orders, Major Geek Abri! :major

    Thanks again!
    Lissy
     

    Attached Files:

    msidea, Dec 14, 2007
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes complete the other pieces of the READ ME including AVG AntiSpyware, Spybot, and MGtools. Then attach the logs from AVG Antispyware and MGlogs.zip from MGtools.
     
    chaslang, Dec 15, 2007
    #4
  5. msidea

    msidea Private First Class

    Hi Abri,

    I'm back and very frustrated.

    I did everything as you said, but I still had Trojans galore and malware that could not be moved. I also found that when I downloaded S&D from the MG link, it did not have a fix option, but when I downloaded into my computer, it did. So... I download S&D directly from safe-networking into my flash drive and put it on my mom's computer. I keep getting an error message "Error sending request. The server name or address could not be resolved."

    I used Ccleaner to uninstall S&D and some other things. I also used just a straight delete from Windows Explorer for some other things. I tried to uninstall AVG using Ccleaner. It uninstalled, but did not delete the entry. Now I can't get rid of that either.

    I'm sorry that I've made a mess of this. :eek: I was just trying to not have to bother you for help.

    The good news is that I have the logs from MG, AVG, and Hijack This.

    Well, thanks again for you help.
    Lissy

    P. S. for some reason the MG files are coming in separately so I'll post with the remaing files.
     

    Attached Files:

    msidea, Dec 20, 2007
    #5
  6. msidea

    msidea Private First Class

    I have only 2 more to upload. The runkeys and the newfiles.txt.
     

    Attached Files:

    msidea, Dec 20, 2007
    #6
  7. msidea

    msidea Private First Class

    Thanks again. :banghead
     

    Attached Files:

    msidea, Dec 20, 2007
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to attach ONLY the logs that are requested in the READ ME. We did not ask for a HijackThis log or the other logs you are attaching. Since you already attached the log from AVG Antispyware, you need to attach the C:\MGlogs.zip file and nothing else.
     
    chaslang, Dec 20, 2007
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You also need to run AVG Antispyware again and attach new log, but this time do not Ignore everything like your previous log shows. There is no sense in running the scans if you ignore the problems. You need to Quarantine or Delete what it finds.
     
    chaslang, Dec 20, 2007
    #9
  10. msidea

    msidea Private First Class

    Ok.

    Except the Hijack This log, the others were the ones in the MG folder. There was no MGlogs.zip. I am rerunning AVG. Then I will run MG again and see if I can't get that zip file.
     
    msidea, Dec 20, 2007
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    These problems are occurring because you did not follow instructions. The instructions for MGtools specifically state the MGtools.exe must be download to the Root folder of your Windows boot drive. And that is where it must be run from. You put it on drive E and you should have it on drive C.
    • Download the current version (your copy is already out of date) of MGtools.exe from here: MGtools.exe
    • Save it to C:\MGtools.exe
    • Then run C:\MGtools.exe
    • Now attach the C:\MGlogs.zip.
    You have a ton on malware on this PC. It would be much easier if you could get ComboFix to run.

    You implied earlier that you deleted or uninstall AVG with CCleaner. DO NOT do this. Leave AVG Antispyware installed.
     
    chaslang, Dec 20, 2007
    #11
  12. msidea

    msidea Private First Class

    Hi Chaslang,

    I don't know why you are blasting me. I'm asking for help, not reproaches.

    I did follow instructions. MG is on the C: but I installed it by copying onto the E: drive on my computer and copying it onto the C: drive of my mom's computer. My mom's computer was so infected prior to me cleaning it up that it would not even display icons nor would the start menu work. The antivirus programs that I would install would be disabled too. In the process of trying to fix the situation, I found MG, for which I'm grateful, but understand that I'm trying to make due with what I have. I had uninstalled Spybot and AVG only temporarily. I understand the importance of these programs. I have since reinstalled AVG and been unable to reinstall Spybot.

    Having said that, I enabled the wireless so that I could install MG directly onto her C:. It seems that some files were missing which is why the zip file was not there. I also rescanned with AVG. The logs will be attached in a post following this one since I working off another computer and will be disabling her Internet as the best protection against further attacks.

    If I somehow offended you, was disrespectful, or merited an abrupt response, please know that it was not my intent.

    Lissy
     
    msidea, Dec 20, 2007
    #12
  13. msidea

    msidea Private First Class

    Here is the MGlog.zip and the AVG log.

    Thanks.
     

    Attached Files:

    msidea, Dec 20, 2007
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not blasting you. We cannot help you if you don't follow instructions.

    Here is the results from your newfiles.txt log previously posted.
    Code:
    "E:\MGtools\"
zip.exe       Jan 13 2005      126976  "zip.exe"
getlogs.bat   Nov 27 2007        3460  "GetLogs.Bat"
getrun~1.bat  Dec 13 2007       94089  "GetRunKey.bat"
grep.exe      Apr 14 2003       80412  "grep.exe"
locate.com    Jan 13 2005       11254  "locate.com"
ltime.exe     Oct 28 1986       13184  "ltime.exe"
shownew.bat   Nov 28 2007       41576  "ShowNew.bat"
swreg.exe     Feb 15 2007      139776  "swreg.exe"
config.reg    Dec 12 2007        1552  "config.reg"
getunk~1.bat  Oct 25 2007        2271  "GetUnKeys.bat"
chodefix.bat  Jun  7 2007        6146  "chodefix.bat"
fixchode.reg  Jun  7 2007         738  "fixChode.reg"
regfix.bat    Apr 18 2007         145  "Regfix.bat"
enable~1.reg  Aug  1 2007         120  "EnableUAC.reg"
disabl~1.reg  Aug  1 2007         120  "DisableUAC.reg"
hide.reg      Jul 26 2007         213  "hide.reg"
unhide.reg    Aug  3 2007         213  "unhide.reg"
iefix.reg     Apr  2 2004        1756  "IEFIX.reg"
analyse.exe   Jul 12 2007      401720  "analyse.exe"
getdet~1.exe  Oct 30 2006      245760  "GetDetails.exe"
proces~1.exe  Aug  1 2006        6656  "ProcessDll.exe"
21 items found:  21 files, 0 directories.
   Total of file sizes:  1,178,137 bytes      1.12 M
               2 Dir(s)     189,366,272 bytes free
    Tell me where it shows you that MGtools was installed. It shows me drive E and that is the reason for my comment. It must be installed and run from the proper location and the logs show me that it was not. And neither was GetRunKey.

    Your new logs just attached while I was writing this show that you now installed it properly.
     
    chaslang, Dec 20, 2007
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The current log you just attached from AVG Antispyware still shows that you Ignored all the problems again! You need to Quarantine of Delete what it is finding and attach a log that shows me that you are fixing these problems instead of ignoring them.
     
    chaslang, Dec 20, 2007
    #15
  16. msidea

    msidea Private First Class

    Hi Chaslang,

    I admitted that there were files missing from the C: drive. Apparently, my method does not work (or I don't know how to make it work) to install MG from the E to the C, but the folder was in her C drive with some items in it. Of course, it was missing the all important exe file.

    Anyway, the only thing that I was trying to say was that I used the E: drive because my mom's computer did nothing. I was trying to follow instructions given the limitations of not being able to download directly, which I can now do.

    Well, I propose a truce. No more :boxing. I promise to consult you (or whoever else is helping me) before considering creative solutions, that may mess things up more. Ok?
     
    Last edited: Dec 21, 2007
    msidea, Dec 21, 2007
    #16
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It's not a problem! You just need to understand that we are stubborn about instructions being followed because it is important to you and for us. It speeds up the time it takes to get you working again and results in less wasted time on our parts which means we have more time to help other people. If tonight was as busy as the last few nights, message # 9 would have been the last post you saw from me until sometime tomorrow night. That would have meant another day before we were able to get started fixing this PC.

    You still need to run AVG Antispyware properly. Did you see message # 15?
     
    chaslang, Dec 21, 2007
    #17
  18. msidea

    msidea Private First Class

    I did, and I understand what you are saying.

    I'm running AVG now. What I can't figure out is why it says that I'm ignoring the infections. I guess I've missed the options. I'll be more careful this time and look for it if I don't see it. If I still don't see it, I'll send you a message.

    Thanks.
    Lissy
     
    msidea, Dec 21, 2007
    #18
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Note: the very last time you ran MGtools.exe. You still ran it wrong. You ran it from here:
    C:\Documents and Settings\Maria\Local Settings\Temporary Internet Files\Content.IE5\RRD2JY4Z\MGtools[1].exe

    which is seen in your HijackThis log which is part of the scans that MGtools automatically runs. You were lucky it worked at all. You must try to be more careful. It you could download it here, you could have downloaded it to c:\MGtools.exe.

    Don't worry about it now but from now on you must do exactly what the instructions request. I'm trying to prepare a fix now, but you must get the items from AVG Antispyware fixed.
     
    chaslang, Dec 21, 2007
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Either you missed the options or you obtained the log before you did the fixes.
     
    chaslang, Dec 21, 2007
    #20
  21. msidea

    msidea Private First Class

    Ok! I did the fixes. I had missed the options. The logs are attached.

    With regard to MGtools, I can't figure that one out. I'm look into it now because the Read & Run made it very clear to install directly into C: and I thought that I had done that. I have to see what I missed.

    Thanks again.
    Lissy
     
    msidea, Dec 21, 2007
    #21
  22. msidea

    msidea Private First Class

    Sorry!
     

    Attached Files:

    msidea, Dec 21, 2007
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Actually it says the root folder of your Windows boot drive is where MGtools.exe need to be saved and then you need to run it from there. Don't worry about it now. It is currently installed OK.

    Let's start fixing things!

    First an observation: This PC is running without any protection!!! No wonder it is so badly infected.

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.officialsearchlist.org/Email/
    R3 - URLSearchHook: FlyOrDie Games Toolbar - {70a732af-f392-4ed8-823a-85fd644d4d92} - C:\Program Files\FlyOrDie_Games\tbFly1.dll
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\lpcywinp.exe,C:\WINDOWS\system32\userinit.exe
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
    O2 - BHO: (no name) - {0CF46468-AC82-9EC5-5B79-008AA7762D88} - C:\Program Files\Vpctgfmw\xrnoqccu.dll (file missing)
    O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
    O2 - BHO: (no name) - {15F68E2E-6415-4245-8927-85B6A1EDE8FD} - C:\Program Files\Online Services\mexobaki555077.dll (file missing)
    O2 - BHO: (no name) - {171A424E-CC43-4F7C-B587-E7A14E7F8785} - (no file)
    O2 - BHO: (no name) - {19C13064-2A7F-4633-A837-8FF6BA95BAC5} - C:\Program Files\Online Services\mexobaki83122.dll (file missing)
    O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
    O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
    O2 - BHO: (no name) - {3566557D-985A-4050-BAB7-8FE9F0C9D91D} - (no file)
    O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
    O2 - BHO: (no name) - {541BA30D-17DC-4946-B054-A36E2BFA9379} - C:\WINDOWS\system32\jkhhh.dll
    O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
    O2 - BHO: 0 - {6A58A76B-315B-4D38-B19D-6564AD505243} - C:\Program Files\Windows Plus\quka.dll (file missing)
    O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
    O2 - BHO: (no name) - {6D1B52BB-694A-49E0-A12E-AC8C7956CE52} - (no file)
    O2 - BHO: FlyOrDie Games Toolbar - {70a732af-f392-4ed8-823a-85fd644d4d92} - C:\Program Files\FlyOrDie_Games\tbFly1.dll
    O2 - BHO: (no name) - {76F262CF-0308-0FB4-F7A3-043266F3A47C} - C:\Program Files\Ysvffbnb\tcowdkez.dll (file missing)
    O2 - BHO: (no name) - {8E3FBDE2-7DBD-4040-85D9-29BBC559C129} - C:\WINDOWS\system32\fccawwv.dll
    O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
    O2 - BHO: (no name) - {98C99E19-F44C-4040-984F-9A930FDBCF3B} - C:\Program Files\Online Services\mexobaki4444.dll (file missing)
    O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
    O2 - BHO: (no name) - {C08A1EFF-F2FF-4F45-BBD0-6B92DBEA95D1} - (no file)
    O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
    O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
    O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
    O2 - BHO: (no name) - {E4E749C8-FCAF-41C3-B940-BCA74A6E91E0} - (no file)
    O2 - BHO: egmulhxk.msdn_hlp - {E78B911A-6F68-4B84-8C19-EC417C9590E2} - C:\WINDOWS\system32\egmulhxk.dll (file missing)
    O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
    O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
    O2 - BHO: (no name) - {F6B4060B-D4F0-412C-BC2D-CF9B52CE7BD2} - (no file)
    O3 - Toolbar: FlyOrDie Games Toolbar - {70a732af-f392-4ed8-823a-85fd644d4d92} - C:\Program Files\FlyOrDie_Games\tbFly1.dll
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [io43mvuiw4kj] C:\WINDOWS\io43mvuiw4kj.exe
    O4 - HKLM\..\Run: [mxsxkfon] rundll32.exe "C:\Program Files\hsjolcnu\vmtsdefg.dll",Init
    O4 - HKLM\..\Run: [cxwjcrox] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\cxwjcrox.dll"
    O4 - HKLM\..\Run: [xepgzgxo] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\xepgzgxo.dll"
    O4 - HKCU\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe
    O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\kndsrngq.exe
    O20 - Winlogon Notify: fccawwv - C:\WINDOWS\SYSTEM32\fccawwv.dll
    O20 - Winlogon Notify: winsxf32 - winsxf32.dll (file missing)

    After clicking Fix, exit HJT.

    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Make sure you tell me how things are working now!
     
    chaslang, Dec 21, 2007
    #23
  24. msidea

    msidea Private First Class

    With regard to MGtools, here's what I found using Windows Explorer.

    In C:\, MGlogs.zip and MGtools file folder.

    There are some other files which I assume are unrelated that are MGA* and MGM*.

    In C:\Windows\Prefetch, there is a file called MGTools.exe-17F3E053.pf.

    I'm mentioning all of this in case there is a some malware that is distorting something. Is this the way that it should be? Should I delete the one in the Windows\Prefetch\ folder?

    Please let me know when you can.
    Lissy
     
    msidea, Dec 21, 2007
    #24
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes that's correct but you also should have seen C:\MGtools.exe. That is where your problems began. It needs to be there.

    You don't need to delete anything from Prefetch. That is normal. What you need to do now is follow Exactly what I wrote in my previous message.
     
    chaslang, Dec 21, 2007
    #25
  26. msidea

    msidea Private First Class

    Okay. I did the first part. Two items were not in the list of items to fix that Hijack This offered me this time. One was HKCU .... Malware and the other began BHO ...944864 (it's below the Fly or Die one that you listed.) I checked all the files, except these 2 since they were not there to check, and "fixed" them, closed HT.

    I enabled the Internet and opened Internet Explorer, which I had done previously to download MGTools directly. Please note that something happened that the exe file was not apparently downloaded (but then, how did it run?) Now, it just closes Internet Explorer and with an "Send Report" window. Should I try Mozilla? It is in my mom's computer. Or can I use the E: drive to download into my computer and install to her desktop, etc.?
     
    msidea, Dec 21, 2007
    #26
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just continue thru all steps. It is critical that you complete all steps without doing anything else but what is listed.

    You don't need to be doing anything with MGtools.exe anymore. Just do what was given in my last set of instructions as I requested.
     
    chaslang, Dec 21, 2007
    #27
  28. msidea

    msidea Private First Class

    I understand this, but I cannot access the Internet to download Avenger. What should I do?
     
    msidea, Dec 21, 2007
    #28
  29. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    How did you get the other tools onto this PC? Do it the same way but make sure you copy Avenger to the Desktop as requested or it may not run properly.
     
    chaslang, Dec 21, 2007
    #29
  30. msidea

    msidea Private First Class

    I got the tools onto my mom's computer using the E drive. I'm working on all the other instructions now. Unfortunately, the computer blacked out and I'm rebooting now. Until what time will you be on?
     
    msidea, Dec 21, 2007
    #30
  31. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You will need to start the fixes from message # 23 all over again and they may no longer even be totally correct since malware could spread/change due to the reboot. Just start over and ignore things you don't see. Just complete all steps.

    I was logging off already and just noticed you posted again. This will be my last reply tonight.
     
    chaslang, Dec 21, 2007
    #31
  32. msidea

    msidea Private First Class

    Ok. I'll do that over the weekend. I don't know if I will have time tomorrow and the next day to work on this. Now, can malware spread even if the computer is not used?

    Attached are the new logs from MGTools and Avenger.

    Thank you so much for all your help! :wave
     

    Attached Files:

    msidea, Dec 21, 2007
    #32
  33. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Looks like the fix worked okay and you don't need to repeat anything. Just do this.

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {6C374E14-8177-4FF7-8381-9BF1CBD78DD1} - C:\WINDOWS\system32\jkhhh.dll (file missing)
    O2 - BHO: (no name) - {8E3FBDE2-7DBD-4040-85D9-29BBC559C129} - C:\WINDOWS\system32\fccawwv.dll (file missing)

    After clicking Fix, exit HJT.

    Other than that, your logs look clean. How are things working?


    There are many kinds of infections so the answer is not straight forward:
    • if your PC is off, obviously nothing can spread
    • however the act of shutting down, or booting up can allow certain infections to be recreated or to spread even worse than previously
    • also yes some infections can do things to your PC if your PC is left on and not being physically used by you.
    You should not need to worry about any of the above since you appear to be in pretty good shape now.
     
    chaslang, Dec 21, 2007
    #33
  34. msidea

    msidea Private First Class

    You are awesome! And you get no sleep doing so!

    Should I worry about not having MGTools.exe? I can reinstall the file directly now that the computer seems clean.

    The computer seems to be working fine, but it does not give me any wallpaper.

    You are correct that my mom's computer had little if any protection. She's 71 so she does not use it herself, but her business associates and her grandchildren had a hand in it's current condition. I will now make sure that it stays protected and clean. Other than the regular maintenance, that is described in the Read & Run, are there any other posts that describe how to do this? Any other suggestions from you personally?

    Thank you so much! You cannot know how truly grateful I am.

    I am currently unemployed so I cannot make any contributions to MG, but how do you all do it? Are all of you volunteers that enjoy helping non-geeks like me? How can I support your efforts, since I'm technologically challenged, as you saw?

    Lissy
     
    msidea, Dec 21, 2007
    #34
  35. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome!

    You don't need it and my final steps will be having you remove all items from MGtools. Whenever a malware problem is found, you really should be downloading and using the current copy of MGtools.exe that is online because it can change frequently just like malware does. Basically you want to make sure you always have the current version.

    I'm not sure what you mean. Do you mean your wallpaper files are gone?

    Covered in my final instructions given below.

    Yes we are all volunteers doing this in our free time. You can support us by spreading the good word to all your friends. Do all of your downloading from Major Geeks download directories.

    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    10. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
     
    chaslang, Dec 21, 2007
    #35
  36. msidea

    msidea Private First Class

     
    msidea, Dec 21, 2007
    #36
  37. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No that will not work. The procedures are more related to the Windows boot drive which is why the MGtools.exe file had to be on that drive.

    You could use a scanner like AVG Antispyware or any other scanner (including virus scanners) to scan the removal drive. You just have to select it to be scanned.

    You can do this if you don't need anything that is on it, or you could just start by removing anything that you don't recognize.
     
    chaslang, Dec 21, 2007
    #37
  38. msidea

    msidea Private First Class

    :heart Thanks again! :wave
     
    msidea, Dec 21, 2007
    #38
  39. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Dec 21, 2007
    #39

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds