Various malware found - please review logs

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Lydster, Sep 20, 2012.

  1. Lydster

    Lydster Private First Class

    Hello there. As the go-to person for all virus/malware issues encountered by family and friends (thanks to the help of Major Geeks!), I have my niece's Acer Aspire laptop which had various malware preventing IE from launching and causing random pop-up windows.

    I've done everything in READ & RUN FIRST, and I'm attaching the max 5 logs, and I'll send a separate post with the last log, MGTools. All programs seemed to run without problems or errors, and lots of malware was found. I'm not seeing any pop-ups anymore; however, IE is still not launching. I get an entirely blank/white page with nothing in the status bar and a blank Address field. I can't even access Tools > Internet Options from the IE toolbar. (I tried instead to get to Internet Options from Control Panel, just to see what was set as Home Page. I was able to see it and change to MSN.com to see if that made a difference, but opening IE still gets me nowhere.) I've recd a couple of messages like, Internet Explorer Not Responding and Windows Shell Common Dll has stopped working (although IE shows as "Running" in Task Manager).

    Thanks in advance for your help. (MGTools log to follow...)
     

    Attached Files:

  2. Lydster

    Lydster Private First Class

    Here is the promised MGTools log.
     

    Attached Files:

  3. Lydster

    Lydster Private First Class

    Update on this: I turned on the laptop this morning, and now IE seems to be fine. It launches, brings up the web, and I can type in the Address field and go to various sites. So, that's good news! Just need to know what you think of the logs. Thanks!
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: ALOT Appbar Helper - {85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - C:\Program Files (x86)\alotappbar\bin\BHO\ALOTHelperBHO.dll
    O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll
    O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\BROWSE~1.DLL
    O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll
    O3 - Toolbar: ALOT Appbar - {A531D99C-5A22-449b-83DA-872725C6D0ED} - C:\Program Files (x86)\alotappbar\bin\ALOTHelper.dll
    O23 - Service: ALOT Update Service (AlotService) - Vertro Inc. - C:\Users\Lee\AppData\LocalLow\alotservice\alotservice.exe

    After clicking Fix, exit HJT.

    Now uninstall the below:
    ALOT Appbar
    PC Fix Speed 1.0.0.22
    Searchqu Toolbar

    Also if Yontoo Layers is still installed, uninstall it.

    Now rerun RogueKiller and run a scan. After it finishes the scan, select the Registry tab and then select any of the below that exist and then click the Delete button.

    Then select the Files tab and if the below exist, click the Delete button again.

    Then immediately reboot your PC.


    Now please download OTM by Old Timer and save it to your Desktop.
    • Right-click OTM.exe and select Run as administrator to run it.
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Services
    AlotService
     
    :Processes
    explorer.exe
     
    :Files
    C:\Windows\tasks\FWGames Updater.job     
    C:\Program Files (x86)\alotappbar
    C:\Program Files (x86)\PCFixSpeed
    C:\Program Files (x86)\Searchqu Toolbar
    C:\Program Files (x86)\Yontoo
    C:\PROGRA~2\SEARCH~1
    C:\Windows\assembly\GAC_32\Desktop.ini
    C:\Windows\assembly\GAC_64\Desktop.ini
    C:\$Recycle.Bin\S-1-5-21-599602685-3457122550-2284538837-1001\$I7JFHIH.lnk
    C:\$Recycle.Bin\S-1-5-21-599602685-3457122550-2284538837-1001\$I9G4S6K.lnk
    C:\$Recycle.Bin\S-1-5-21-599602685-3457122550-2284538837-1001\$R9G4S6K.lnk
    :Reg
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
    "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{17036B49-B7FE-40F6-B697-3605B917D338}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A531D99C-5A22-449b-83DA-872725C6D0ED}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "DATAMNGR"=-
     
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\windows\currentVersion\Run]
    "DATAMNGR"=-
    :Commands
    [purity]
    [EmptyTemp]
    [start explorer]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now run a new scan with RogueKiller and save a log as in original instructions and attach the new log.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • the new RogueKiller log
    • the C:\_OTM\MovedFiles log
    • C:\MGlogs.zip
    How are things working now?
     
  5. Lydster

    Lydster Private First Class

    Thanks so much for your time! Attached are the new logs. IE is launching fine and moving right along. No errors or pop-up windows at this time.
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The Windows Firewall service ( and possibly others ) were broken by the infection. We need to fix these.

    Be patient while doing the below. The fixes can take quite awhile to run. Especially the permissions repairs. It may be best to kick it off and goto bed or do something else. It is better not to run anything while the repairs are going on.

    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  7. Lydster

    Lydster Private First Class

    Followed your instructions, and here is the log. After the Restart, I received a message from the Firewall asking if it should allow a program to run; so it appears that the tool we ran was effective, at least in regard to Firewall.

    Computer seems to be running fine. Thanks.
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Your logs are good now.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds