Many Malware

Please try again. MGtools automatically chooses whether to run 32 bit or 64 bit. Perhaps you are misreading what you see in the black command prompt window and you just need to let it run until it finishes? Also make sure that you have just downloaded it from the READ & RUN ME and are not trying to use some old version you had.

 

It is not running the correct version. It appears the your C:\MGtools folder is locked based on those messages complaining about a subdirectory or file in C:\MGtools already existing. Can you right click on the C:\MGtools folder and delete it?

• Is your protection software disabled?
• Do you have UAC disabled?
• When you run MGtools.exe are you using right click and then select Run As Administrator?

 

Let's try to get started even without the log from MGtools.
Run RogueKiller and run a scan. After it finishes the scan, select the Registry tab and then select any of the below that exist and then click the Delete button.

Then immediately reboot your PC.

After reboot, run a new scan with RogueKiller and save a log as in original instructions and attach the new log.

Please download OTM by Old Timer and save it to your Desktop.

• Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe

:Files
C:\Program Files (x86)\Linkey
C:\Program Files (x86)\Settings Manager
C:\Program Files (x86)\Common Files\Spigot
C:\Users\Sophea\AppData\Roaming\OpenCandy
C:\Program Files (x86)\Application Updater
C:\Program Files (x86)\YTD Toolbar
C:\ProgramData\YouTube Downloader\ytd_installer.exe
C:\Windows\Temp\*.*
:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2503}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2503}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622]
[-HKEY_USERS\S-1-5-21-3160159426-1812147292-984883957-1000\Software\APN PIP]
[-HKEY_USERS\S-1-5-21-3160159426-1812147292-984883957-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{54739D49-AC03-4C57-9264-C5195596B3A1}]
[-HKEY_USERS\S-1-5-21-3160159426-1812147292-984883957-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2503}]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

Now please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

Now attach the below logs:

• the C:\_OTM\MovedFiles log
• the JRT.TXT log

 

Looks good now.

Are you having anymore malware problems?

 

Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.

• Right click the Command Prompt entry and select Run As Administrator.
  • It is critical that you run it this way.
• If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
• Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple/brown is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
SN64 <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
nwktst <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
GRK64 <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
getnetinf<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.

Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above.

 

Actually they all ran properly except SN64 which ran partially.

Please do the below.


Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.

• Right click the Command Prompt entry and select Run As Administrator.
  • It is critical that you run it this way.
• If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
• Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple/brown is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
set > c:\mgtools\env.txt << This should create the env.txt file in the C:\mgtools folder

UserInfo <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.

GetNetInf <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.

GetMsrv <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.

GetBrSet <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.


Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above. Also please attach the C:\MGtools\env.txt file and also the C:\MGtools\newfiles.txt log.

 

Are you still with us?

 

You're welcome. This is really strange! I thought perhaps the problem was that your Windows environment variables may have been messed up and that was the cause for making MGtools think your OS was 32 bit rather than 64 bit. But the environment variable look ok. It is strange though because in several places in the suite of MGtools scans, it is failing to properly get your %systemdrive% setting properly and that cause the failures.

Please run the below.

Be patient while doing the below. The fixes can sometimes take quite awhile to run. Especially the permissions repairs. It may be best to kick it off and goto bed or do something else. It is better not to run anything while the repairs are going on.

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

• Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
• Now select the Start Repairs tab.
• The click the Start button.
• Create a System Restore point if prompted.
• On the next screen, click the Unselect All button to first deselect all repairs.
• Now select the following repair options:
  • Reset Registry Permissions
  • Reset File Permissions
  • Register System Files
  • Repair WMI
  • Remove Policies Set By Infections
  • Repair Winsock & DNS Cache
  • Repair Proxy Settings
  • Repair Windows Updates
  • Repair MSI (Windows Installer)
• Now on the lower right side check the box to Restart/Shutdown System When Finished
• Then make sure the Restart System radio button is enabled.
• Shutdown any other programs that you are running now before continuing.
• Now click the Start button.
• Be patient while the tool repairs the selected items.
• It should reboot automatically when finished. If it does not then reboot it yourself.

After reboot, please do the below.

Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.

• Right click the Command Prompt entry and select Run As Administrator.
  • It is critical that you run it this way.
• If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
• Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple/brown is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>

SN64 <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see. EVen capture a screen shot if it fails but make sure you wait until it finishes running or it aborts!!!

 

Did you disable your protection software as even noted in the image you attached? If you did disable protection, then try running in safe boot mode.

 

In the C:\MGlogs.zip file or you can just attach the C:\MGtools\newfiles.txt log.

 

This is really weird. I have never seen anything like this.

Can you please uninstall your protection software ( I believe I saw Avast ) and then reboot your PC back into normal boot mode. Then try running SN64 the same way as at the end of my last message from the command prompt window.

Make sure you let SN64 run all the way through to the end. Grab a screen shot when it finishes. And attach the new newfiles.txt log.

Also while the command prompt window is open run GRK64 and when it finishes, attach the C:\mgtools\runkeys.txt

 

Ah hah! Did you notice that everything ran okay now that you uninstalled Avast? Avast some how was locking all kinds of files from being accessed even though it was just a simple read of the file information.

How is your PC running right now?

Please also try running the below to see if all of MGtools will work now that Avast has been removed.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

Note that Avast does not normally do things like this by default. So either yours was broken or you some how configured it to block all access to system files.

 

You're welcome.

Look at your previous snapshots. Access was denied. This time it was not and the files were found. Also MGtools ran properly this time without having to go to the command prompt to run special commands.

Yes you did. You uninstalled it as requested. Thus t is no loner running.

No there was no more malware. And these issues were not caused by what you had in the beginning. This was caused by Avast.

Let me know. But I recommend a quickly general test to see how it is working. You don't want to do too much surfing while your PC has no protection software installed. So I think you should complete the below ASAP.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
3. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
5. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
8. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
9. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
   • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore​
   • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
   • Then we want you to Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!