need help....thanks in advance

Discussion in 'Malware Help (A Specialist Will Reply)' started by phatcat, Jul 21, 2007.

  1. phatcat

    phatcat Private E-2

    I tried to follow the instructions, but ran into this problem.

    I can not install any form of scanner, firewall, anti virus program.

    What happens is, when i go to install it it will let me start and then within 5 seconds it shuts down any type of program to detect or clean.

    I have been getting winantivirus 2006 pop ups, Jack9 rederects, and a site that always shows up in my history called s3.truth-is-out-there.org

    I have hijack this already downloaded from a previous use.

    any help, or ideas?
    Thanks
     
  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    http://www.majorgeeks.com/images/grenade.gif Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

    • Make sure you check version numbers and get all updates.
    http://www.majorgeeks.com/images/grenade.gif Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

    http://www.majorgeeks.com/images/grenade.gifAfter doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

    http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis
    • Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..
    http://www.majorgeeks.com/images/grenade.gifWhen you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
    • CounterSpy
    • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
    • Bitdefender - from step 6
    • Panda Scan - from step 6
    • runkeys.txt - the log from GetRunKey.bat
    • newfiles.txt - the log from ShowNew.bat
    • HijackThis
    NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs![/FONT]
     
  3. phatcat

    phatcat Private E-2

    I can not do so.
    When i download a program listed in the read and run, the program stops during install,whatever i have infecting my computer will not let me install new programs.
     
  4. phatcat

    phatcat Private E-2

    I was able to get the spybot and the counterspy to work, But as soon as i tried to go on to the online scanners,the page loaded, i tried to click the scan button, but it did not click or work, I then changed to mozzilla and tried and the button was clickable there,but it would not support anything exept Ie.

    I am trying hard to get this to work, and i have used this about a year ago from this site with no problems, now the malwaree i have will not let me execute certian programs...
    what do i do to get it to work.

    I will include the get run and run keys, just in case they are needed.
     

    Attached Files:

  5. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Try the online scans in Safe Mode, if you still can't do them procede and we will do them later.

    Be sure you attach a HJT log so we can get you briefly cleaned to we can get more in depth.
     
  6. phatcat

    phatcat Private E-2

    heres the highjack scan
     

    Attached Files:

  7. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please see this thread, Running AVG Anti-Spyware
    1. Download this file - combofix.exe
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it will produce a log for you. Attach this log to your next reply
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Once you complete the above, attach the logs from both steps and try the online scans again. Also, please attach a fresh HJT log, GetRunKey and ShowNew logs.
     
  8. phatcat

    phatcat Private E-2

    this is the avg scan and the other one
     

    Attached Files:

    • log.txt
      File size:
      12.2 KB
      Views:
      2
  9. phatcat

    phatcat Private E-2

    the other one sorry
     

    Attached Files:

  10. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Run another scan with AVG and this time remove all found infections, one completed attach the new log along with a fresh HJT log.
     
  11. phatcat

    phatcat Private E-2

    here they are.
     

    Attached Files:

  12. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    You're ignoring the detections in AVG, remove all found infections.
     
  13. phatcat

    phatcat Private E-2

    i re ran the avg and it said no problems found?I did delete the old problems, Things seem to bee better now, No more pop ups or old problems
     
  14. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Good, attach a fresh HJT, GetRunKey and ShowNew logs and we will finish up.
     
  15. phatcat

    phatcat Private E-2

    have at them...
     

    Attached Files:

  16. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

    Please look in Add/Remove Programs for the following and uninstall them if found:

    Java(TM) SE Runtime Environment 6 Update 1
    Java(TM) SE Runtime Environment 6


    Once you remove the above, you need to update to the newest version of Java. You can get it here, Sun Java Runtime Environment 6 Update 2.

    Now scan with HijackThis and check the boxes for the following entries:
    ( Make sure ALL browser windows are closed when you click FIX )

    O2 - BHO: (no name) - {1479999C-81B7-46AA-ADBF-AB72868E2EB1} - C:\WINDOWS\system32\mljjg.dll (file missing)

    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

    O20 - Winlogon Notify: jkkjiji - jkkjiji.dll (file missing)
    O20 - Winlogon Notify: winthr32 - winthr32.dll (file missing)

    Again, make sure ALL browser windows are closed when you click FIX.

    Next, run CCleaner to clean up cookies and temp files.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt

    After you complete the above, proceed with the rest of this fix...

    Next Reset Web Settings & Default Security Settings

    Note for IE 6 users:
    To Reset Web Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

    To Default Security Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

    Note for IE 7 users:
    Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


    Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

    • Disable and Re-enable System Restore

    • Turn OFF System Restore to flush any bad Restore Points.

    • Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.
    After you complete the above reboot once more and then scan with HijackThis and attach the new log along with the log from Avenger.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds