Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, etc.

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

Welcome to Major Geeks!

You need to attach the other four logs requested in the READ ME:

• BitDefender
• GetRunKey
• ShowNew
• HijackThis

Also if you installed the illegal copy of PhotoShop uninstall it. It was infected. Also delete the below which you downloaded:

C:\Documents and Settings\APeart\My Documents\My Music\Adobe_Photoshop_11_(CS34)_new_full.zip

Also delete the below two files which came from the above infected file:
C:\WINDOWS\system32\mshk.exe
C:\WINDOWS\system32\mszd32.dll

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

What test?


Did you delete those files I already mentioned and did you uninstall Photoshop?

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

Why are you downloading and installing many programs into a C:\BFU folder. This was/is a very bad idea. Programs should be installed into there default folders under C:\Program Files and each program should be installed into its own folder to avoid conflicts with the other programs. You should uninstall everything you installed here and delete the files that may remain in this folder. Then install the programs properly. The BFU folder should only be used for the Brute Force Uninstaller program and its scripts and nothing else.

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

Possibly because you did not do step 2 of the READ ME based on what I see in your GetRunKey log. You still have file extensions hidded!!!

What do you mean the cs one ? By cs do you mean CounterSpy? If so, are you saying you did not download it from our link?

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

Okay this is taking too long to get a HijackThis log. Let's continue without it for now and see if we can make some progress with the below steps.


Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now uninstall the below software:
J2SE Runtime Environment 5.0 Update 3
Java(TM) SE Runtime Environment 6 Update 1
Viewpoint Media Player <-- should have been uninstalled in step 0 of the READ ME

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. Avenger
2. GetRunKey
3. ShowNew
4. HJT

Make sure you tell me how things are working now!

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

I repeat you are still hiding file extensions.

If it was downloaded the same way, yes uninstall it along with anything else downloaded that way. If you look at your BitDefender log you will see that a ton of stuff (probably downloaded) was/is infected. Quite a bit of them may have already been deleted by Bitdefender. You are very badly infected.

Complete the steps in my previous message.

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

Too late!

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

You need to take care of what I mentioned in message # 6 and you need to do it now.

Then you need to disable Spybot's Teatimer which we requested in the READ ME. If you don't know how to do this, here it is:

• Run Spybot and click Mode
• Select Advanced Mode.
• Then click Tools and select Resident.
• Now in the right window pane, uncheck TeaTimer.
• Also while this is open, in the left column now select IE Tweaks
• and then in the right pane make sure all the Miscellaneous locks are unchecked.
• Now quit Spybot!

Then please uninstall CounterSpy now since we are finished with it and it could get in our way.

Then you need to rerun ALL instructions in message # 8 again since the Avenger procedure did not run properly.

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

You need to attach the other 3 requested logs to from message # 8.

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

You still did not resolve the issue I was mentioning in message # 6! All you did was rename the folder to C:\Spywareremover\cs You are missing the point!!! CounterSpy should not be installed here. GetRunKey and ShowNew should not be installed here and should not be in the same folder as CounterSpy and neither should anything else. Also I asked you to uninstall CounterSpy yet most of the files and folders remain! Did you uinstall it?

I recommend that you delete the C:\Spywareremover\cs folder now. Not rename it, delete it. Then redownload GetRunKey.zip and ShowNew.zip into a folder named C:\MGtools as requested in the READ & RUN ME. Extract all files from GetRunKey.zip and ShowNew.zip into this C:\MGtools folder and do not put anything else into that folder unless requested.



What do yu see in the below folder?
C:\WINDOWS\system32\drivers\mskg

Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: (no name) - {09A8C292-1409-4824-AFC6-AB26925C2895} - (no file)
O2 - BHO: (no name) - {15276D6D-0AF8-46CE-A0C1-9AA28554BDD2} - C:\WINDOWS\system32\efcdb.dll
O2 - BHO: (no name) - {6424B0E8-E204-40CB-92CC-020C0646CD64} - C:\WINDOWS\system32\iiffd.dll (file missing)
O2 - BHO: (no name) - {8B3F8A93-933C-4DDA-B24C-AEB0697C132A} - C:\WINDOWS\system32\ddcdbba.dll (file missing)
O2 - BHO: (no name) - {C2477643-44F1-4FA5-9514-9DB431862378} - (no file)
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\ekeaumft.dll (file missing)
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\akgbbhmi.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it
double click it and allow it to merge with the registry.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. Avenger
2. GetRunKey
3. ShowNew
4. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 8 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

We're almost done but a few things have hung around. Also you did not answer my questions.

Make sure you answer those questions after doing the below.

Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {15276D6D-0AF8-46CE-A0C1-9AA28554BDD2} - C:\WINDOWS\system32\efcdb.dll (file missing)

After clicking Fix, exit HJT.

• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. Avenger
2. ShowNew
3. HJT

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

Okay then delete that folder. Your logs are clean. Now you need to follow the below steps ASAP and be sure to install one of the antivirus programs given in the link. Follow all steps to get you properly protected because currently you are not. Yo have no antivirus, no realtime antispyware blocker, and no real software firewall (the Windows firewall is not adequate).

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, and the C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
7. If we had you run Avenger, you can delete all files related to Avenger now.
8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
9. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
10. If you are running Windows XP or Windows ME, do the below:
    • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Re: Help! Pop-ups--crush, win antivirus 2007, myspace friend likes you, sxvela.com, e

You're welcome. Surf safely.