malware removal adware.command and other

Feel like I'm in the "soup nazi" line (seinfeld), and if I do it wrong, I'll be in trouble. Never posted to a forum before. Your step-by-step instructions are excellent, but being a user asking for help, I'm sure to annoy you by missing something, etc. Anyway, I tried my best to thoroughly go through steps 0-6c.

Hoping to clean pc and start over with more appropriate security measures. Thanks for your help!

p.s CounterSpy found nothing..no attachment for that one.

 

malware/spyware/adware removal - adware.command, other

Feel like I'm in the "soup nazi" line (seinfeld), and if I do it wrong, I'll be in trouble. Never posted to a forum before. Your step-by-step instructions are excellent, but being a user asking for help, I'm sure to annoy you by missing something, etc. Anyway, I tried my best to thoroughly go through steps 0-6c.

Hoping to clean pc and start over with more appropriate security measures. Thanks for your help!

p.s CounterSpy found nothing..no attachment for that one.

 

sorry about dupe message..dang it...don't know how to work this thing yet, I guess. I had problems posting, but now I see it finally went through.

 

It's not you, it our "Spam Filter", there was something in your post that was being flagged. You had about 6 threads actually.

They were all awaiting moderation so I approved the two with your logs and deleted the others.

 

Let's start by running the below utility...

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.
After you complete the above, attach fresh logs from GetRunKey, ShowNew and HJT. Also attach the ComboFix log to your next post.

 

My aol software won't load now, so I checked my email through IE, and it wasn't until after the fact, so I didn't see the welcome message with the info about the spam filter until after I thought it was user error and getting persistent with it. It seemed like it wasn't going through vs. not showing up pending approval. Sorry about that..thanks for deleting, combining, and fixing me up with a thread!

 

combofix log. Didn't include quarantine log it created..?

 

I've read the "protect yourself from malware." Once my PC is clean, is there a paid suite to recommend, or will my PC be sufficiently protected if I use the following:
1. (anti-virus) AVG free anti-virus or PC Tools Free Antivirus
2. (firewall) Zone Alarm or PC Tools free firewall
3. (anti-spyware) Comodo free
4. Switch browser use from IE to Firefox
5. Frequently run Spybot, CCleaner, Easy Cleaner, Lavasoft Adware SE, and Bit Defender free online scan

Before I had a high speed connection, I used AOL, and I still use the AOL software for my email.

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 2:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 3: Begin here after rebooting from Step 2!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 4:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 5:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

In my opinion the AOL software is a waste of resources and slows down most systems.

As far as antivirus, I would recommend AVG Free Edition and for firewall I would recommend ZoneAlarm or Comodo. For antispyware I would recommend AVG AntiSpyware or if you want to purchase one I would recommend Spy Sweeper. The Firefox browser is for sure better than IE in my opinion. The frequent scans you run are unnecessary if you have the other three programs mentions. I would however recommend running CCleaner or something similar like ATF-Cleaner to keep the junk files removed.

 

Thank you! Did each step. Here are my latest files. Looking better?

 

last file

 

Here's where I'm at since doing your last steps. I've been jacking with this and scanning for DAYS now. Getting weary, but I know it's my own deal for not better protecting myself. But, what frustrates and discourages me even more is that it seems like there is no comprehensive malware tool. Each one seems to pick up different things! Then, too, everyone has an opinion about the products..for every positive, there's a negative. It's hard to sift through the sources and figure out the more accurate opinion. I went ahead and ran the following..one by one...no other applications running. Here is what they found:

BitDefender found nothing:
BitDefender Online Scanner - Real Time Virus Report
Generated at: Mon, Sep 10, 2007 - 15:44:52
Scan Info
Scanned Files: 202639
Infected Files: 0


(FILE ATTACHED) Panda Active Scan found: c:\windows\NirCmd.exe

Spybot: nothing

(FILE ATTACHED) Lavasoft Ad-Aware SE: Updated and ran full scan..not much..cookies?

Counter Spy: Updated & ran full scan. Nothing found.

Trend Micro Housecall: found nothing

(FILE ATTACHED) AVG Anti-Spyware: just cookies

 

more scans:

(IMAGE ATTACHED) **Spyware Doctor: found Trojan-PWS.tanspy

(IMAGE ATTACHED)**No Adware: found stuff

QUESTION: NoAdware no good? Some say yes, some say no..
http://www.adwarereport.com/mt/archives/000023.html

Spy Sweeper w/Anti Virus: found nothing

RemoveIT Pro: nothing

(IMAGE ATTACHED) XoftSpy: viewpoint (remnants?) & anti-virus pro

 

(FILE ATTACHED) A-Squared full scan (took no action).

I also tried the McAfee suite offered through AOL, but it was excruciatingly slow and I uninstalled before finishing.

I don't know what's legit (problem wise) and what's not or where to go from here 'cept maybe get the gun out. "No Adware" program found pretty much all the things I think I have (and maybe more?). I'd be happy to pay to get a freaking utility to catch and remove it all, but I don't want to get some rogue tool bundled with more adware or what not either. It's easy to get paranoid knowing a little info but not how it all works extensively.

Oh yeah, I switched to Firefox mostly, but some tools forced me back to IE to download.

If you really are a volunteer, you must be a Saint or glutton for punishment, because I know how frustrating it can be to help clueless users.

Have I used up my 20 questions, rants, raves? Can you help? (<< she whines)

 

Some things making me go hmmm. It may just be a setting I need to change, but this search assistance, live search stuff keeps showing up and seeming to want to take over, so I think it's related to my woes? I had two different looking search columns earlier today. The 3rd shot is how it looks now..doesn't have the search assist column, but goes to live search..not google as I believe I had set up.

 

two more:
I find it odd how it wants to change my home page and search function.

Not sure this means anything, but when I go to start menu, it seems odd that the remote desktop shows up in the left column. I thought that showed recently used items? I didn't remote desktop, so I'm not sure if that's weird or not.

 

One last thing for this fine day of pc fun...this was weird.. when I went to "save as" , notice at the bottom in the "save as type," it's in Spanish or something? What up with that?

 

Have HJT fix the below entry...

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

Let's run Avenger once more...

• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.

 

As far as all of the other scans you have ran, can you not have them remove all found entries?

If you can get the logs, exact entries or files we can remove them. I'm not going to assume or guess so I need something solid before we can remove anything else.

 

Okay, I did those two things. As far as the other stuff, I attached the files of the utilities I could get files for, but some didn't seem to have that capability..the best I could do was screen shot the file names/findings cuz I couldn't seem to copy and paste the text within/file listings.

If No Adware is okay to use, I could just get that and get rid of the trojan.pws.tanspy, mirar toolbar, etc.

Spyware Doctor also found the trojan.pws.tanspy, but that's all it found, whereas No Adware could get rid of more.

The only utility that I could use to clean what was found w/o purchase was the asquared, so that's no problem to do.

The only other things that were found that were different than what NoAdware found, were the XoftSpy's: viewpoint (I think these are just left over files maybe that didn't get removed?) & anti-virus pro (<<not sure what this one is).

Any ideas about NoAdware? I'd be more than happy to do that and be done with it and get myself set up for better protection and not bug you anymore. Do you think that would clean me up?

 

Personally, I think some of the programs are picking up things that are not in fact infections, they are displaying things that they want you to believe is infected so you will buy their software.

There are a few more scans we can run but at this point I am going to request that anything you have not purchased be uninstalled with the exception of your antivirus, firewall or anything else you have purchased.

The two scans remaining are, AVG-AntiSpyware and the Kaspersky Online Scan. Both do a great job and are free to scan/remove.

First, let's try AVG-AntiVirus and see what it picks up.

Running AVG Anti-Spyware

Once you have scanned with AVG AntiVirus, I would like the following scan to be ran and the log attached.

Click on the link below and run the online scan...

Kaspersky Anti-Virus Online Scan

• Click on "Kaspersky Online Scanner"
  
• Click Accept to procede...
  
• If you get a popup askiing if you want to Install Kaspersky's ActiveX Control, click Yes to install it.
  
• If you get a Security Warning popup asking if you want to install and run kavwebscan_unicode.cab, click Yes to install it.
  
• After all updates are downloaded, click NEXT to continue...( Note it will take awhile to download these updates based on your connection speed).
  
• Click Scan Settings and select extended and make sure both boxes are checked at the bottom, Click OK to continue.
  
• Now click on My Computer and let it run!
  
• This scan may take a while but it is very thorough. After the scan is complete save the log as a txt file and attach it to your next post.

 

I was able to get a log of the NoAdware (attached) so you can take a look. I'll work on this other stuff and post. Thanks for your continued help.

 

best I could get for what xoft spy had given initially.

 

Here are the latest scans as you requested...AVG and Kaspersky.

As far as the others, I somehow got Viewpoint back to where it was in add/remove programs, so I removed it. I found this link w/tool for Mirar files. Didn't use/try though.

http://www.2-spyware.com/remove-mirar.html
http://www.symantec.com/security_response/writeup.jsp?docid=2004-091714-4329-99&tabid=3

 

O4 - HKCU\..\Run: [You've Got Pictures Screensaver] C:\Program Files\Common Files\AOL\Screensaver\ygpsstra.exe

Any chance of getting my screensaver back? :cry Was it causing a problem or just that it was related to infamous "aol" and an unnecessary start up. rolleyes

Do you have a recommendation for a screen saver program I could use?

 

Yes! Run HJT and choose "View the list of backups", find only the entry your talking about (above), select it and click the button "Restore".

 

Thanks. I did that (re:screen saver). I ended up running the hijack file and noticed this is back >>
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

 

Here's the latest hijack log in case you want that in addition to the AVG and Kaspersky ones I sent earlier. Thank ya. :tas

 

It's a legit entry.

 

You can however have HJT fix the below entry.

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

 

So am I good to go now? What about the entries listed in this scan. Can I delete manually through editor or ? Thanks.

 

Without getting the exact registry key/value, I don't like to remove entries because it could cause major problems if the wrong one is deleted.

Will NoAdware remove the detections or does it require purchase before?

The leftovers are mainly registry entries, they really don't do anything. The files are what causes the problems, registry entries and the files sometimes work together but in your case I think your clean other than the leftover registry entries.

Like I have always said, there is no way to get every trace of malware from a system. Every program you scan with will detect different things, each programs has it's on database of malware traces so it's very hard to remove everything single trace.

 

I didn't realize it didn't give a specific key/value in the list. I'm a little confused about that part, but now I understand what you are saying...that the registry keys may still be there, but they're just leftover remains, so I'm good to go.

Thank you SO SO SO SO much for your help. The person from this thread "Help! Virtumonde drove me nuts.." said it well..."in the end, I'd like to thank you from the bottom of my soul, because this, what you guys are doin' defies the logic of the 'modern way' where selfish interest and cold profit are the only measures of life and it's quality. and I hope my gratitude will at least for a moment remind you all, how your altruism n' geeky humanism, place you far above n' beyond this society and all of it's puny idols."

I second that..thanks again for being a Major Geek Malware Fighting Freak!

 

You're Welcome! That's what we're here for.

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, and the C:\combofix.txt log that was created.
3. If we used SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
7. If we had you run Avenger, you can delete all files related to Avenger, the log (avenger.txt) and C:\avenger.
8. If we had you download any registry patches like fixme.reg, fixme1.reg or fixWLK.reg (or any others), you can delete these files now.
9. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
10. If you are running Windows XP or Windows ME, do the below:
    • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!