help with malware removal

[liggy]

Hey ..

I have a nasty malware virus on my computer .. usual situation .. making all anti virus prog. i.e hijackthis, spybot etc read only wont allow me to open and redirecting websites in google etc

my msn also keeps signing out after 10 seconds

attached is my log

any help appreciated

thanks

[chaslang]

Welcome to Major Geeks!

Originally Posted by liggy

usual situation .. making all anti virus prog. i.e hijackthis, spybot etc read only

Not true. HijackThis ran just fine as you can see inside the MGlogs.zip file you attached.

Why are you runningt with no protection installed?
Also what haven't you updated Vista to the current service packs? You don't even have SP1 and SP2 is already out.


First you must disable Spybot's Teatimer as requested in the READ & RUN ME. See this: How to disable Spybot's TeaTimer

Uninstall the below software:
Ask Toolbar
Java(TM) SE Runtime Environment 6

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Windows\system32\sdra64.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [combofix] "C:\Windows\system32\CF16558.exe" /c "C:\ComboFix\C.bat"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [PopRock] C:\Users\LIGGY\AppData\Local\Temp\a.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

After clicking Fix, exit HJT.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Drivers tp delete:
uacd.sys
gasfkyyhwmopdd.sys
gasfky
Files to delete:
C:\autorun.inf
C:\Windows\msa.exe
C:\Windows\msb.exe
C:\Windows\PFRO.log
C:\Windows\run.log
C:\Windows\win32k.sys
C:\Windows\system32\sdra64.exe
C:\Windows\System32\CF16558.exe
C:\Windows\System32\CF6794.exe
C:\Windows\System32\gasfkyaqsbmdva.dat
C:\Windows\System32\gasfkyvetpamqm.dll
C:\Windows\System32\gasfkytrpxspwv.dat
C:\Windows\System32\gasfkymhcqmbly.dll
C:\Windows\System32\gasfkyrnkbvujg.dll
C:\Windows\System32\drivers\gasfkyyhwmopdd.sys
C:\Windows\System32\drivers\UACd.sys
C:\Users\LIGGY\AppData\Local\Temp\a.dat
C:\Users\LIGGY\AppData\Local\Temp\a.exe
C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
C:\Windows\Tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job

Folders to delete:
C:\ComboFix
C:\Windows\System32\lowsec

Files to move:
C:\MGtools\temp\VSP1\cngaudit.dllmg|C:\Windows\System32\cngaudit.dll

Registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BitTorrent DNA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\Users\LIGGY\AppData\Local\Temp


Now run Win32kDiag:

• Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
• Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log

C:\win32kdiag.exe -f -r

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Then attach the below logs:

• C:\avenger.txt
• Win32kDiag.txt on your Desktop
• C:\MGlogs.zip

Make sure you tell me how things are working now!