Muliple Malware Detected

Discussion in 'Malware Help (A Specialist Will Reply)' started by gbrenham, Sep 4, 2008.

  1. gbrenham

    gbrenham Private E-2

    Originally, I had an issue just booting up and couldn't get the mouse or keyboard (USB) to work. Something had taken control of the USB hub subsystem. I couldn't work at all (Dell XPS with USB only) until I finally had to use UBCD4WIN and repaired the OS.

    After that, I finally was able to run the required steps for malware removal.

    Here are the logs and yes I know I forgot to stop McAfee, mainly because I didn't know how.

    Thanks for your help!
     

    Attached Files:

    gbrenham, Sep 4, 2008
    #1
  2. gbrenham

    gbrenham Private E-2

    4th log file
     

    Attached Files:

    gbrenham, Sep 4, 2008
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please see the some of the first instructions in the READ & RUN ME. You must not have multiple antivirus programs installed. You have AVG7.5 and McAfee installed. One of them must be uninstall immediately and then you need to reboot.

    You also need to uninstall SideStep

    I strongly recommend that you cleanup all the junk from your Desktop.

    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll (file missing)
    O2 - BHO: Yapta BHO - {2020dfef-8c87-4229-aa41-549d82210355} - C:\Program Files\Yapta\YaptaOverlay.dll (file missing)
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll (file missing)
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k42037/sb02b.cab

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below log:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Sep 5, 2008
    #3
  4. gbrenham

    gbrenham Private E-2

    I've uninstalled McAfee, but am getting error messages on reboot.
    "McAfee SiteAdvisor Install - Failure - Couldn't start McAfee SiteAdvisor installer"

    Also getting:
    "Microsoft Visual C++ Runtime Library - Runtime Error! Program: C:\Program Files\Dell Support Center\bin\sprtcmd.exe R6029 - This application cannot run using the active version of the Microsoft .NET Runtime"

    Add/Remove programs failed to remove.


    Ran and rebooted successfully.

    Successful

    Successful

    Completed

    File is attached.

    Other than the errors mentioned above on restart, everything seems to be ok though it's still early in the day!
     

    Attached Files:

    gbrenham, Sep 5, 2008
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Run the below, reboot, and then run it one more time.

    McAfee Consumer Product Removal Tool

    Did that fix the issue with SiteAdvisor?

    This cannot be a new problem and it is not malware. This junk software from Dell that you probably don't need. It is complaining about the version of Microsoft .NET software that you are using which you probably had all along. Get your updates from Microsoft to newer versions of .NET and see if the problem goes away. Did you pay for a multi-year extended contract of some kind from Dell?



    See if the below can uninstall SideStep

    Your Uninstaller! 2008
     
    chaslang, Sep 6, 2008
    #5
  6. gbrenham

    gbrenham Private E-2

    Yes

    No, it's not new but thought it might have something to do with it. My internet connection is active ( I can get Windows Update to access the correct Microsoft site and AVG to update it's definitions), but when I start IE on my own and then try to go to another site by just typing in the URL bar I get another IE window and IE hangs.

    Since the last post, I've installed the following:
    AVG 8.0
    Comodo Firewall Pro 3.0.25.378
    Spyblaster 4.1

    AVG is picking up the following:
    - Trojan horse BackDoor.Generic10.BYI (one in the subdirectory C:\Qoobox & one in C:\System Volume Information)
    - Trojan horse Clicker.PIK (in C:\Windows\system32\edtxfst.sys)

    Worked.
     
    gbrenham, Sep 6, 2008
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Not a problem since it is just due to what ComboFix has removed and put into a backup folder.


    This is a new issue.

    Did AVG removed this? If not, we will have to do it manually.

    Please download the attached ShowNew3.zip file to the C:\MGtools folder. Then extract the ShowNew3.bat file from this ZIP file into the C:\MGtools folder. Then run the ShowNew3.bat file by double clicking on it. You can just close the log when it pops up after it finishes running the scan. Now attach the C:\MGlogs.zip file which will contain this new log.
     

    Attached Files:

    chaslang, Sep 8, 2008
    #7
  8. gbrenham

    gbrenham Private E-2

    AVG did in fact said it was moved to the Virus Vault.

    Done.

    AVG is finding (& seems to be removing) other trojans too. Dropper.Bravix.B, HideExec.EX and HackTool.EAV
     

    Attached Files:

    gbrenham, Sep 8, 2008
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    But where is it finding them? Attach a log. It could just be quarantines, system restore, or false postive detections of ComboFix files.
     
    chaslang, Sep 8, 2008
    #9
  10. gbrenham

    gbrenham Private E-2

    Logs are attached.

    AVG seems to be taking care of them, but I still can't use IE to get to the internet. IE seems to be hijacked (?). When I start the browser, it comes up with a blank page and then spawns a second browser window and then the whole program hangs.
     
    gbrenham, Sep 8, 2008
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You did not attach them.

    What happens if you use another browser? Like try Mozilla FireFox
     
    chaslang, Sep 9, 2008
    #11
  12. gbrenham

    gbrenham Private E-2

    Dang!! Don't punish me and make me wait 3 days for a reply...please...please...please!! :crybaby

    I'm online for real time chat...yahoo, msn, aim....your call!

    A brand new installation of Firefox work perfectly, but what about IE?
     

    Attached Files:

    gbrenham, Sep 9, 2008
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sorry but we read threads in queue order so I did not even see your post until just now.

    You will have to work this in the Software Forum as it does not appear to be a malware issue. Make sure that you are not blocking iexplore.exe in your firewall.




    Your AVG logs only shows things from System Restore being detected. Do the below:
    • Disable System Restore ( see Disable And Enable System Restore) Make sure you disable on all drives including whatever drive G is since that is what AVG was pointing to.
    • Now reboot your PC
    • Now Enable System Restore using the same link as above
    Now does AVG still have new detections? You need to erase all the old info in your log from AVG and only look at new info.
     
    chaslang, Sep 11, 2008
    #13

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds