help i have spyware & malware protection error cleaner and privacy protection

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by kmcoburn, Nov 19, 2007.

  1. kmcoburn

    kmcoburn Private E-2

    Hi. I cant get rid of these. I've done the READ & RUN ME FIRST steps. I have attached AVG, BitDefender and Panda files. GetRunKey and ShowNew coming in next post.
     

    Attached Files:

  2. kmcoburn

    kmcoburn Private E-2

    here are the other two files
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    You forgot to attach a HijackThis log as requested in step 7 of the READ ME. But do not attach one yet. I will ask for one later after we fix some problems.

    Also you missed step 3 of the READ ME. You have both Symantec and Authentium's Command AV installed. One of these must be uninstalled. You may have gotten Authentium along with a bunch of other tools from your ISP. You also have too many realtime antispyware protection tools installed due to this too.

    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    J2SE Runtime Environment 5.0 Update 9
    Java(TM) 6 Update 2
    Java(TM) SE Runtime Environment 6 Update 1


    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it
    double click it and allow it to merge with the registry.
    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    Now run Ccleaner!

    Now attach the below new logs and tell me how the above steps went.

    1. Avenger
    2. GetRunKey
    3. ShowNew
    4. HJT


    Make sure you tell me how things are working now!
     
  4. kmcoburn

    kmcoburn Private E-2

    OK. Followed the steps. I don't know what "Authentium's Command AV" is. I uninstalled all of the Verizon programs that I could find. Hopefully it was in those. I haven't had any pop-ups since I ran Avenger and the three icons are gone from my desktop. However, the "Your Privacy Is In Danger" red wallpaper is still there. See attached files. Thanks so much for helping! HJT file on next post.
     

    Attached Files:

  5. kmcoburn

    kmcoburn Private E-2

    here's hjt. also, picture of my desktop.
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member


    You got it! But it looks like you uninstall Comodo's BOClean which you should have kept for active realtime malware protection.[/b]

    Did you set your main local page to blank like the below R0 line? If not, add this line to the HijackThis fix
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
    O2 - BHO: MSVPS System - {27A5292F-0C87-4E81-A34E-3131DBFCE994} - C:\WINDOWS\oprevxlw.dll (file missing)
    O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
    O3 - Toolbar: The bonsws - {2181E54F-274D-48B7-9E51-BC374933CD24} - C:\WINDOWS\bonsws.dll (file missing)
    O4 - HKLM\..\Run: [Verizon Custom Uninstall Tracking] C:\DOCUME~1\Default\LOCALS~1\Temp\InstallHelper.exe /uninstalltrackingvendor=Verizon
    O4 - HKLM\..\Run: [Verizon_UninstallTracking] C:\DOCUME~1\Default\LOCALS~1\Temp\InstallHelper.exe /uninstalltrackingvendor=Verizon
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.comcastsupport.com/sdcxuser/asp/tgctlsr.cab
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://www.comcastsupport.com/sdccommon/download/tgctlcm.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.2.89.cab
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
    O16 - DPF: {94837F90-A2CA-4A8A-9DA0-B5438EC563EA} (WildTangent Active Launcher) - http://install.wildtangent.com/cda/islandrally/ActiveLauncher/ActiveLauncherSetup.cab
    O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.kontiki.com/kdx/Client402/kdx.cab
    O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/shockwave/meninblackII/install.cab
    O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - https://www.verizon.net/WhatsNext/CheckMyPc/MotivePreQual.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
    O21 - SSODL: nopctrl - {9169F14E-80C0-4E11-A08A-B3C3E584E5C7} - C:\WINDOWS\nopctrl.dll (file missing)
    O21 - SSODL: ddkret - {4104E12B-1BC2-4E77-A81B-723BC6BDF6CD} - C:\WINDOWS\ddkret.dll (file missing)

    After clicking Fix, exit HJT.

    Now attach the a new HJT logs

    If you are still having problems with your wall paper now, do the below:

    Fixing Locked Desktop
    • Right click on your Desktop and select Properties.
    • Then click the Desktop tab and then the Customize Desktop button.
    • Now in the next window that comes up click the Web tab.
    • Make sure at the bottom that Lock desktop items is unchecked.
    • Then in the Web pages: box delete all items but My Current Home Page and make sure it is unchecked too.
    • Then click OK.
    • Click Apply and then OK.
     
  7. kmcoburn

    kmcoburn Private E-2

    OK. I reinstalled BOClean.

    I couldn't find:
    O4 - HKLM\..\Run: [Verizon_UninstallTracking] C:\DOCUME~1\Default\LOCALS~1\Temp\InstallHelper.exe /uninstalltrackingvendor=Verizon

    but I fixed everything else.

    The desktop is good now.

    Sweet.

    Attached hjt.

    Should i toggle system restore?

    Mike
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your log is clean. If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    9. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    10. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
     
  9. kmcoburn

    kmcoburn Private E-2

    Thank you very much!
     
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds