MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 08-09-08, 22:13
outdoorlady79 outdoorlady79 is offline
Private E-2
 
Join Date: Aug 2008
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Default Had multiple Trogans/Malware, want to make sure I'm clean

Last night my Zone Alarm and AVG Antivirus both started throwing warnings left and right at the saem time. I remember seeing Generic11.gdc, Pakes.O, and dialer.sap. Some of the zone alarm alerts refered to beauty.exe, a.exe, and c.exe trying to run.

So this morning I booted the machine and attempted to restore to my last restore point thinking I had only gone to two websites that were out of the ordinary to me yesterday (both of which I wouldn't have expected would be contaminated but wouldn't rule it out). After restoring to that point I did full scan with AVG and it again found the Generic11 again. From there I did a quick google search and found this forum and a couple other posts in recent days referring to these trogans, both of which refered the users to the Read & Run Me First Malware Removal Guide. So I went ahead and followed the guide as a starting point. The system seems to be running better now but I'd still like someone to take a look at the logs if you don't mind before stoping and restarting the restore program.

Edit to add.........after all the alerts last night my wifi monitor in the tray started showing my linksys network had assigned an unusual IP address (don't remember what it was and didn't think to write it down at the time) while other computers using the router still showed the proper address. I wasn't able to resolve this until doing the restore this morning.

Thanks,
OL79
Attached Files
File Type: txt SASlog.txt (513 Bytes, 4 views)
File Type: txt mbam-log-8-9-2008 (21-22-23).txt (907 Bytes, 3 views)
File Type: txt log.txt (11.6 KB, 1 views)
Reply With Quote
Sponsored links
  #2  
Old 08-09-08, 22:14
outdoorlady79 outdoorlady79 is offline
Private E-2
 
Join Date: Aug 2008
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Had multiple Trogans/Malware, want to make sure I'm clean

Just adding the last log attachment
Attached Files
File Type: zip MGlogs.zip (66.1 KB, 2 views)
Reply With Quote
  #3  
Old 08-10-08, 14:16
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,346
Thanks: 61
Thanked 7,650 Times in 4,121 Posts
Default Re: Had multiple Trogans/Malware, want to make sure I'm clean

Welcome to Major Geeks!

You are in pretty good shape. We just have some minor finishing touches to do.


Did you copy tasklist.exe here like this or is this malware? It does not belong here!
Code:
2008-08-02 17:51 . 2008-08-02 17:51 72,192 --a------ C:\Documents and Settings\Sara\tasklist.exe

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall the below software:
Viewpoint Media Player <-- should have been uninstalled in step 1 of the READ ME

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
Quote:
REGEDIT4

[-HKEY_CURRENT_USER\Software\Kazaa]
[-HKEY_LOCAL_MACHINE\SOFTWARE\knight]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-
Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.


Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:
  • C:\MGlogs.zip
Make sure you tell me how things are working now!
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #4  
Old 08-10-08, 16:35
outdoorlady79 outdoorlady79 is offline
Private E-2
 
Join Date: Aug 2008
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Had multiple Trogans/Malware, want to make sure I'm clean

Ok I've followed all the instructions in the last post and was successfull with the fixme.reg changes. I did not put that tasklist.exe there that I remember, I have deleted it. Attached is the new log as requested.

I'd also like to add that AVG has alerted me today to two different generic viruses, one was generic7.**** (if I recall the **** were abfx but I won't swear to it) and the other was another variant of Generic11. Both of these appeared to be in the system restore files (which if I read correctly will be wiped out once I'm clean of the other stuff and reset the system restore program). Or should I go ahead and reset it now and see if they quit appearing?

Thanks,
OL79
Attached Files
File Type: zip MGlogs.zip (67.3 KB, 1 views)
Reply With Quote
  #5  
Old 08-11-08, 16:29
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,346
Thanks: 61
Thanked 7,650 Times in 4,121 Posts
Default Re: Had multiple Trogans/Malware, want to make sure I'm clean

You're welcome.

Quote:
Originally Posted by outdoorlady79 View Post
Both of these appeared to be in the system restore files (which if I read correctly will be wiped out once I'm clean of the other stuff and reset the system restore program). Or should I go ahead and reset it now and see if they quit appearing?
Since your logs are clean, you can just follow my instructions below and see what happens afterwards.

If you are not having any other malware problems, it is time to do our final steps:
  1. You can uninstall SUPERAntiSpyware now.
  2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
  3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
    • "%userprofile%\Desktop\combofix" /u
      • Notes: The space between the combofix" and the /u, it must be there.
      • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    • Delete the C:\combofix folder from combofix.
  4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  7. Go to add/remove programs and uninstall HijackThis.
  8. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
  9. If you are running Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  10. After doing the above, you should work thru the below link:
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
Sponsored links
  #6  
Old 08-11-08, 21:17
outdoorlady79 outdoorlady79 is offline
Private E-2
 
Join Date: Aug 2008
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Had multiple Trogans/Malware, want to make sure I'm clean

All seems to be ok so far. Thanks for all your help! I'll be back if any more issues pop up in the next few days.
Reply With Quote
  #7  
Old 08-11-08, 21:34
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,346
Thanks: 61
Thanked 7,650 Times in 4,121 Posts
Default Re: Had multiple Trogans/Malware, want to make sure I'm clean

You're welcome. Surf safely!
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Trying to make sure my PC is clean MFLucky7 Malware Removal 1 04-13-08 08:04
Trogans & Pop Ups irishpooh Malware Removal 7 07-27-07 14:39
Please make sure I'm clean chadwilson7 Malware Removal 14 08-27-06 22:40
Someone's Getting Canned Over This (I've Cleaned up, just make sure I'm clean) orty Malware Removal 2 07-03-06 22:57
Want to make sure I am clean now Alicia74 Malware Removal 3 10-18-05 00:28


All times are GMT -5. The time now is 07:20.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger