Help Me Save My new Computer plz

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Drkrzr, Jul 8, 2008.

  1. Drkrzr

    Drkrzr Private E-2

    i just recently bought a laptop with vista. And it i have already managed to get it infected with 3 different freaking types threats i got
    Virtumonde.dll

    smitfraud -c.coreservice

    command service

    and PSW.WOW

    ive alreasy tried spybot but it doesnt get rid of them it says it does but then they only come back. i have also manuallly bypassed the command service restrictions and deleted it under the Regedit but it came back as soon as i closed the box. and command service doesnt let me me access system32 tools i need help BADLY please help med
     
  2. Drkrzr

    Drkrzr Private E-2

    Here are some of the logs you would prolly need i couldnt get the Mgtools log bcuz for sum reason whenever i searched for it it would pull up the combofix log instead so i provided you with the hijackthis log hopefully that will help to if not let me kno ill keep lookin for the mg tool log
     

    Attached Files:

  3. Drkrzr

    Drkrzr Private E-2

    here is the MBAM log
     

    Attached Files:

  4. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    The file you are looking for is MGLogs.zip in the root of your boot drive (C:\MGLogs.zip)

    Attach that file.
     
  5. Drkrzr

    Drkrzr Private E-2

    there we go found it here we are. i am not sure but i might have already fixed it but still i want to b sure that my computer is not infected or in danger
     

    Attached Files:

  6. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    This is an unpatched version of Windows Vista. You should be at Service Pack 1. Install Service Pack 1 and run Windows Update after I give you the all clear.

    Download
    - Pocket Killbox to your Desktop
    - ExplorerXP

    Install ExplorerXP

    Copy the contents of the below code box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*).
    Code:
    REGEDIT4
    
    [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE\0000]
    [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE]
    [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE\0000]
    [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE]
    [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE\0000]
    [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE]
    [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE\0000]
    [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE]
    [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE\0000]
    [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_CMDSERVICE]
    Close Notepad.

    Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

    Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:
    Code:
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

    Now run Pocket Killbox:

    Choose Tools -> Delete Temp Files and click Delete Selected Temp Files
    Then after it deletes the files click the Exit (Save Settings) button.

    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

    Select:
    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

    If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

    Now boot into SAFE MODE

    Open ExplorerXP navigate to and DELETE the following folders: (Some of these may have already been deleted by Pocket Killbox)
    Now run CCleaner.

    REBOOT to Normal Mode.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below log:
    C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  7. Drkrzr

    Drkrzr Private E-2

    Thanks. let me try that out i apreciate it so much
     
  8. Drkrzr

    Drkrzr Private E-2

    alrite i did everything until the hijackthis...

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    i culdnt find those line above and second i culdt run kilbox. but i ran spybot search and estroy and it didn t find anythign ive already ran 3 maintance programs such as spybot and cleaner and malwarebyte along with superantispyware and they idnt come up with anythign so i think my cumputer is all better now.but if you want me to send u sum logs for you to make sure of that i will just let me kno thhank for all ur help man
     
  9. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Why wouldn't Killbox run?

    I need the logs I requested in my last post, to make sure the system is clean.
     
  10. Drkrzr

    Drkrzr Private E-2

    alrite sir here u go
     

    Attached Files:

  11. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Everything I asked you to delete using ExplorerXP is still there.

    Now boot into SAFE MODE

    Open ExplorerXP navigate to and DELETE the following folders: (Some of these may have already been deleted by Pocket Killbox)
    Now run CCleaner.

    REBOOT to Normal Mode.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below log:
    C:\MGlogs.zip

    Make sure you tell me how things are working now!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds