Look2Me and TribalFusion problem

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by dtheb, Jun 16, 2007.

  1. dtheb

    dtheb Private E-2

    ActiveScan found 3 infected files. Can anyone help? I followed the steps in Read and Run Me First. I am running 2007 Norton Internet Security and I did not know how to follow the step in Secondary House Cleaning calling for "Removing files from Norton AntiVirus Quarantine" or "Emptying the Norton Protected Recycle Bin". I went ahead and did the other steps, even so. BitDefender kept causing Internet Explorer to close, in Safe Mode and in Normal so I only did the Panda ActiveScan.

    I will post the CounterSpy and PandaActiveScan logs here and then post a second message with the GetRunKey, ShowNew, and HJT logs.

    Thanks for you help. Great site.
     

    Attached Files:

  2. dtheb

    dtheb Private E-2

    Here are the GetRunKey, ShowNew and HJT logs.
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please use add/remove programs to uninstall Counterspy as we are done with it.
    Did you install: WebIQ Client Software?
    If not ..uninstall it!

    Please download FixWareout by LonnyRJones from one of the two below links and save it to your desktop.

    http://downloads.subratam.org/Fixwareout.exe

    http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

    * Run Fixwareout.
    * Click Next,
    * then Install,
    * make sure Run fixit is checked
    * and click Finish.
    * The fix will begin; follow the prompts.
    * You will be asked to reboot your computer; please do so.
    * Your system may take longer than usual to load; this is normal.

    When you run fixwareout, just follow the prompts, you will need to restart when prompted.

    After rebooting (restart) back into normal boot mode, make sure you have all web browsers closed.

    * Go into Control Panel -->Network Connections.
    * Right click on your connection
    * and click Properties.
    * On the Properties page, highlight Internet Protocol(TCP/IP)
    * Click Properties. This will bring up another page.
    * Select Obtain DNS Server Automatically.
    * Click the ok button. The page will close.
    * Press ok on the page in front of you.
    * Restart the computer.
    * Reconnect to the Internet using Internet Explorer.
    * Now come back here and attach the log from fixwareout. It is located at c:\fixwareout\report.txt

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now (Note ---some of the items may not show after running the above fix):

    After clicking fix, exit HJT


    Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Now attach new logs for:
    ShowNew
    GetRun
    HJT
    FixWareout
     
  4. dtheb

    dtheb Private E-2

    Thanks Tim W.
     

    Attached Files:

  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    That looks good ...now please attach the other logs.
     
  6. dtheb

    dtheb Private E-2

    here are three of the requested logs.
     

    Attached Files:

  7. dtheb

    dtheb Private E-2

    here is the fixwareout log
     

    Attached Files:

  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs look clean. You may uninstall any programs we had you download (including Counterspy).

    If you are not having any other malware problems, it is time to do our final steps:

    1. If we used Pocket Killbox during your cleanup, do the below
    * Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    8. If you are running Windows XP or Windows ME, do the below:
    * go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
    * How to Protect yourself from malware!
     
  9. dtheb

    dtheb Private E-2

    lookin' good, TimW. Thanks for your help. What is the file desktop.ini on my desktop now? A warning box pops up if I select it for deletion telling me it is a system file and it's deletion could make some programs not work. Should or can I delete it without problems.
     
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    No...they are system files for folders...go back and hide the system files and folders ....should make them invisible again.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds