Attempt to remove "cpmsky" and "adzgalore"

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by cwhitrod, Sep 18, 2008.

  1. cwhitrod

    cwhitrod Private E-2

    Hi,
    I have followed the READ & RUN ME FIRST malware removal instruction. And as suggested am posting my logs. Can you tell me if my PC looks fit and healthy again. Attached are my first 3 logs - saslog mbam and combo. I will attached the last ones.
     

    Attached Files:

  2. cwhitrod

    cwhitrod Private E-2

    Attempt to remove "cpmsky" and "adzgalore" - 2nd round of logs

    Hi,
    Below are the MG Tools Logs. Hopefully this is the last set. Please advise if you think i need to do more, or repeat the steps i have done.
    Massive thank you in advance
    Chris
     

    Attached Files:

  3. cwhitrod

    cwhitrod Private E-2

    What will happen if I "REMOVE" the "cpmsky extension tool program"

    Hi,

    I have been trying to remove adsgalore and cpmsky by using the MG 'READ and RUN ME FIRST' malware removal guide. (you will find my logs on my last thread). Anyway my concern is that within the 'add and remove programs' function there is a program called "Browser Extension Tool Cpmsky". Can I go ahead and press the remove button, or will this reverse everything I have done last night.
    Do you think I should remove this?
    Chris
     
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Not much left to do.

    Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it. (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now download The Avenger by Swandog469, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the "Input script here:"
    part of the window:

    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\%username%\Local Settings\Temp

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Be sure to tell us how things are running.
     
  5. cwhitrod

    cwhitrod Private E-2

    All Good!! But has it really gone?

    TimW you champion!!
    Firstly, big thank you. Massive thank you.
    I read your easy to use instructions. I have one last big Question at the bottom. However the results from you advise are as follows

    When using the messenger removal/disable tool i selected the 'remove' box.

    Couldn't find the first 3 files --
    O4 - HKLM\..\Run: [pwtnqqab....
    09 - Extra button: Messenger - {FB5F191.....
    09 - Extra 'Tools' menuitem: Windows Me .......

    My logs are attached.

    My only other concern is that in the ADD or REMOVE Programs I found a file that is called 'Browser Extension Tool Cpmsky'. Under the size column it does not register anything. Should I ignore this or press the "change/remove" button?

    Thanking you once again
     

    Attached Files:

  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Sorry, I missed that in your add/remove program list...definitely remove it. ('Browser Extension Tool Cpmsky').....then check you browser for extentions and add-ons.

    Then run CCLeaner (both the cleaner and the issues parts, and be sure to make the backup when prompted).

    Now we can start cleaning up from the scans:

    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    If you get a success message, then it is time to do our final steps:
     
  7. cwhitrod

    cwhitrod Private E-2

    Hey Tim,

    The first command to merge with the registry was successful. However because I jumped the gun and had already manually started to delete the scanning tools and logs my computer could not find the ComboFIX. But everything else was A-OK.
    So double thumbs up for you Tim and the team at MG. If I can help spread the word in anyway let me know.
    My computer is quicker, and the unwanted pop-ups have stopped. Thank you friend.
    Chris
     
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You're quite welcome......safe surfing. :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds