Finished Read and Run Me First

Hi, any help greatly appreciated.

My PC has been getting fake anti virus popups and google redirections.
I went through the instructions on the google redirections thread and the Read and Run Me first.

I forgot to unhide hidden folders and files until I reached to combofix stage.
combo fix mentioned something about rootkits being found.
My internet wasnt working after I ran combo fix (combofix had mentioned this might happen) I tried rebooting as combo fix had suggested which still didnt work and then tried running combofix again(as it had suggested to do if reboot didnt work) but it didnt run. Nor did anything else run.

I rebooted in safe mode to complete read and run me, root repeal didnt work but i got mg to work.

PC seems better now and internet is working now.

Not sure if its related but I've been getting McAfee Service Host (before and after read and run me) messages saying it has encountered problems and needed to close, I'll get this message 2 or 3 times whenever computer is turned on. If I click debug internet will work if I click anything else internet wont connect but rest of PC will work ok.

Thanks in advance.

 

here are the rest of the logs

 

Hi and welcome to Major Geeks, co.mm_on!

You were infected by a rootkit known as Max++/Sirefef/ZeroAccess. This looks like it is gone. However, there are still some leftovers from the Zentom System Guard FakeAV you had. The below fix should address this.

Please download Disable/Remove Windows Messenger by Doug Knox to your desktop.

• See the download links under this icon:
• Double-click MessengerDisable.exe
• Place a check-mark in Uninstall Windows Messenger
• Click Apply
• Click Exit

Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]FireFox::[/COLOR]
FF - ProfilePath - c:\documents and settings\Pavle\Application Data\Mozilla\Firefox\Profiles\rdlfidda.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 4
[COLOR="DarkRed"]File::[/COLOR]
C:\s36o
[COLOR="DarkRed"]FileLook::[/COLOR]
c:\windows\system32\drivers\ipsec.sys
c:\docume~1\Porki\LOCALS~1\Temp\jnv4_mib.sys
C:\Documents and Settings\Pavle\pizda_ftp.dll
[COLOR="DarkRed"]Folder::[/COLOR]
C:\WINDOWS\$NtUninstallKB54969$
C:\Documents and Settings\NetworkService\Local Settings\Application Data\aemrxymtl
C:\Documents and Settings\NetworkService\Local Settings\Application Data\afgurhews
C:\Documents and Settings\NetworkService\Local Settings\Application Data\amkrlnbey
C:\Documents and Settings\NetworkService\Local Settings\Application Data\bjdxlwtlb
C:\Documents and Settings\NetworkService\Local Settings\Application Data\ewilmkwaq
C:\Documents and Settings\NetworkService\Local Settings\Application Data\idngylsnq
C:\Documents and Settings\NetworkService\Local Settings\Application Data\jppbkdqqq
C:\Documents and Settings\NetworkService\Local Settings\Application Data\lspdcnowe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\onmnwjnqj
C:\Documents and Settings\NetworkService\Local Settings\Application Data\qjrxovefr
C:\Documents and Settings\NetworkService\Local Settings\Application Data\sfhiwuraw
C:\Documents and Settings\NetworkService\Local Settings\Application Data\vhuijqgxn
C:\Documents and Settings\NetworkService\Local Settings\Application Data\wxcxminlt
C:\Documents and Settings\Pavle\Local Settings\Application Data\Conduit
C:\Documents and Settings\Pavle\Local Settings\Application Data\kaenputbc
C:\Documents and Settings\Pavle\Local Settings\Application Data\ykqkoakqr
C:\Documents and Settings\Pavle\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}
c:\documents and settings\Pavle\Application Data\searchqutoolbar

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

Please download Win32kDiag to the root of your C:\ drive. It must be saved here or the below will not work!

• Now press and hold the Windows key on your keyboard, then press the letter r on your keyboard.
• This opens the Run dialog box.
• Then copy the below bold text and paste it into the Open: text-field and press ENTER.
  C:\win32kdiag.exe -f -r
  
• When it's finished, there will be a log called Win32kDiag.txt on your desktop.
• Attach this log to your next message. (How to attach items to your post)

Download Junction by Mark Russinovich to your desktop.

• Extract junction.exe to your desktop.
• Now press and hold the Windows key on your keyboard, then press the letter r on your keyboard.
• This opens the Run dialog box.
• Then copy the below bold text and paste it into the Open: text-field and press ENTER.
  cmd /c %userprofile%\desktop\junction -s c:\ >%userprofile%\desktop\junction.txt
  
• When it's finished, there will be a log called junction.txt on your desktop.
• Attach this log to your next message. (How to attach items to your post)

Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

• This will automatically update all the logs inside MGlogs.zip
• Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

LET ME KNOW HOW THE PC IS RUNNING AFTER YOU HAVE COMPLETED THESE STEPS​

 

Thanks heaps for the help.

I've gone through the list of instructions except Junction didnt work and no log was made.

The mcafee msg only pops up once now. Everything else seems ok.

Cheers

 

Please upload the below file to VirusTotal for analysis:

• c:\documents and settings\Porki\Local Settings\Temp\jnv4_mib.sys

Then let me know the results.

 

I couldnt find the file?

I had show hidden files selected. I also searched for for the file name in the search function.

 

Try this:

Please download SystemLook by jpshortstuff to your desktop.

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  Code:

  :filefind
  jnv4_mib.sys
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (How to attach items to your post)
  Note: The log be found on your desktop entitled SystemLook.txt

 

Done.

Doesn't look like it is there?

The user profile is one that hasn't been used in a couple of days.

 

What malware problems (if any) are you still experiencing?

 

I think everything is pretty good.

Still get Mcafee msg and a msg in the bottom right tray saying couldnt connect all drives but it disappears after a while and all the drives seem connected. But are theses malware problems?

 

Your logs are clean now. It may just be residual damage caused by the rootkit you had or a problem with McAfee giving a warning too soon before it actually finishes loading.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!