I've completed the required steps for malware removal...now what?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by keith h, Jul 3, 2006.

  1. keith h

    keith h Private E-2

    Hi....I'm new, and not very PC smart. It's taken me a week to go through all your steps for malware removal, but I'm still getting them!

    My OS is Windows XP Professional service Pack 2 (build 2600) version 7.1h.
    Hard Drive is 119.96GB with 107.56 free. RAM is 254MB.

    The processor is 2.4 gigahertz Intel pentium 4, 8 kilobyte primary memory cache, 512 kilobyte secondary memory cache.

    Don't know what all this means, but I think you need it....

    Here's the problem.

    Firstly, we suddenly got an automatic Windows style dial-up connection window. This had not been the normal way for us to get on line. The dialing program window shows C\WINDOWS\system32\fd2ba95f.exe

    Then a series of pop-ups which include "SYSTEM INTEGRITY SCAN WIZARD", "MALICIOUS SOFTWARE REMOVAL WIZARD", ULTIMATE WINDOWS DEFENDER" TRIUMPH ON-LINE CASINO", " BT YAHOO ONSPEED", REAL PLAYER UPDATE", "THERE IS NO VIRUS PROTECTION DETECTED ON YOUR PC", and lastly, "YOUR COMPUTER IS AT RISK. NORTON VIRUS IS SWITCHED OFF". It wasn't.

    To the best of my ability, I ran all the steps as outlined in your pre-posting requirements. I don't get these pop-ups all the time, in fact, they are quite rare, but they are annoying, and I don't like the idea the PC is still infected.
    The dial-up connection window is always there. We just ignore it.

    I have saved, ready for sending, an Activescan log, a BD scan log, and a Hijack this log, all ready on my desktop ready to send to you. I have no idea what these mean, but if you can use them to help me clean up the pc and
    remove this malware I'll be happy to attach them.

    Be gentle with me. I'm inexperienced!
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    Yes! As requested in the READ & RUN ME, attach your logs if still having problems.
     
  3. keith h

    keith h Private E-2

    Right, here goes.....
    I hope these are all ok, as I have no idea what they mean.
    I'm a little shocked and embarrassed to note a range of "sextracker" cookies in the Activescan. I use eBay a lot, and some time ago I was advised to remove cookies to make the site work better. I now do this regularly, so these came as a bit of a surprise.

    I do, however, still get the regular (but occasional) dodgy email, and also those from spammers wanting to sell me a variety of drugs, etc. These are always blocked and deleted.

    I should also explain that the PC is used by another.He is single, and has a Yahoo account. I subsequently discovered he subscribes to the Yahoo "dating" facility, so I assume they have come from there....!

    Thank you in advance for your help and expertise.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Look in Add/Remove progams for the below and uninstall if found:
    FlashTrak
    MyWeb or MyWebSearch

    Now copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now make sure viewing of hidden files is enabled (per the tutorial).

    Please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.
    C:\WINDOWS\system32\fd2ba95f.exe

    After killing all the above processes, click Back.
    Then please click Scan and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O4 - HKLM\..\Run: [ICcontrol] C:\WINDOWS\iccontrol.exe
    O4 - HKLM\..\Run: [fd2ba95f.exe] C:\WINDOWS\system32\fd2ba95f.exe
    O4 - HKCU\..\Run: [fd2ba95f.exe] C:\Documents and Settings\keith hawley\Local Settings\Application Data\fd2ba95f.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O16 - DPF: GIC - https://www.ib.albb.co.uk/ebs/ie/classes.cab
    O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/GB3_1050.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    c:\program files\MyWay <--- the whole folder
    C:\Documents and Settings\keith hawley\Local Settings\Application Data\fd2ba95f.exe
    c:\windows\system32\fd2ba95f.exe
    C:\WINDOWS\iccupdater.exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST).

    Now we need to Reset Web Settings:
    1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  5. keith h

    keith h Private E-2

    ..well, so far , so good! Apart from a 2 hour session when I could not get the PC to start in safe mode, I did eventually do everything you said, except for the following;
    I did everything ok in HJT.
    After exiting, and booting into safe mode I found and deleted c:\program files\MyWay.
    The 3 other items following this, I simply couldn't find anywhere, so if they exist, they are not deleted.
    I did everything else, and I've attached the subsequent HJT log.

    Nothing unpleasant has happened yet, but it's too early to tell, anyway.

    One success is that the dial-up window that automatically appeared and wouldn't go did NOT appear (The dialing program window showed C\WINDOWS\system32\fd2ba95f.exe), so I'm hoping the other pop-ups are linked to this, and therefore banished forever!

    I'm running Windows XP professional, so, you'll need to advise further about the System Restore/reboot/re-enable at some stage....

    I'll report back over the next few days.

    Oh, you're a wonderful person! Thanks for all your help!
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds