aaah please help...anti-malware toolkit, comodo, xp restore

wow...please help....i dunno where to begin...

so i had spywareblaster and spybot s&d on my computer....but leave it to me not to trust that 'congratulations no malware found!' message....

so i replaced them with CA internet security since it was free and came with my isp....BIG MISTAKE.... of course CA gives you a false sense of security so by the time i figured out my active x wasn't the cause of all my browser crashes... i already had smitfraud and vundo and agent trojans before i realized my mistake...

so a friend gave me anti-malware toolkit and last night i uninstalled the CA and reinstalled spywareblaster & spybot s&d, along with avira antivir and comodo firewall pro and malwarebytes anti malware (already had CCleaner)....

i tried to scan with spybot s&d which found the smitfraud...and was able to remove all but 2 items and i tried to have it run on restart......which crashed...
so i tried to run malwarebytes....found one object and also crashed....
so i ran avira antivir and found the trojans and quarantined them...

after that i was able to run my spybot and the malwarebytes...
which came up 'clean'....

i'm thinking..kool..maybe i did something right....::sigh::

everything seemed fine for about a half hour...next thing i know.. my comodo won't run....won't uninstall.....can't shut it down......cmdagent.exe cannot be stopped...can no longer do any system restores (although that wasn't a problem a few days ago)

was gonna get the removal tool from my anti-malware toolkit but it will not connect to the remote server anymore...go figure...

at this point i'm ready to just reformat and go back to factory settings but..i'm not even sure if i can do that on this computer...and i have no OS cd...

so...that's where i'm standing...
this site has been a big help in the past and i'm hoping it can save my PO..err PC again....

and yeah i know i'ma lose most of what i have on the computer...no way to back it up....at this point i don't even care....it's long past due...

(i guess i should also mention this computer has had multiple firewalls and other software installed on it in the past and for some reason it still believes trend micro pc-cillin is installed...but it's been gone..and isn't in add/remove programs.... i wasn't aware there is so much crap left behind on this computer...but i found an ini file in comodo that doesn't bode well.... i'll post what it says here so you can get an idea of how screwed up this cpu is :

so yeah...rock! heh....
like i said it might just be best to go back to factory settings.....
please help!!


any help is much appreciated...

 

http://www.majorgeeks.com/images/grenade.gifWelcome! to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif

Please follow the instructions in the READ & RUN ME FIRST link given further down and attach the requested logs when you finish these instructions.

• If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.
  • TDSSserv Non-Plug & Play Driver Disable
• If something does not run, write down the info to explain to us later but keep on going.
• Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide


Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in Safe Mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. To avoid additional delay in getting a response, it is advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!
4. Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

 

hey thanx alot for your help....it's much appreciated...
i did try to run some of the things in the READ & RUN ME FIRST previously...but i am unable to remove old versions of my java or update it.
It tells me that I already have it installed and when i tell it to reinstall it anyways it says that this option is only available for previous installations.

I had also checked for TDSServ beforehand as well and did not find it.

I am unable to go into safe mode now, my computer just hangs when i try to. Not sure why.

I went through all the procedures in the Windows XP cleaning procedure. I am attaching the logs here. I had already run malwarebytes before posting this thread so I will be posting two logs from malwarebytes. The first found infections and the 2nd was clean.

I have yet to be able to complete a spybot scan. Each time I try my computer restarts. (restart on system fail has already been disabled previously)

when i ran combofix I was told that Trend Micro PC-cillin Internet Security realtime scanner was enabled...but...that's been uninstalled for quite some time and I have been unable to remove it. The log from combofix said that my COMODO firewall is also enabled but I received no message stating this when the scan was run.

posting log attachments...
thx again

 

here are the other two attachments for combofix and mgtools

 

Pre-Instructions:

1. First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.
   
2. Print out these instructions or save them to a text file so that you can operate with All Browser Windows CLOSED.

Step 1:

Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

Again, make sure ALL browser windows are closed when you click FIX.​

Step 3:

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.​

Step 4:

Default Security Settings

To Default Security Settings:
For Internet Explorer 6 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up navigate to the Security Tab and click Default Level for the following:

• Internet
• Local Intranet
• Trusted Sites
• Restricted Sites.

Click OK to exit.

For Internet Explorer 7 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up, navigate to the Security Tab and simply click the "Reset all zones to default level" button. Click OK to exit.

NOTE: If it's "grey" then it's already at the default level.​

Step 5:

Please download ATF-Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF-Cleaner menu to close the program.​

Step 6:

Finally, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

​

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

ty much i did the things you said..the only problem i encountered, again, was that combofix informed me that my trend micro pc-cillin internet security is active and again i am unable to disable it....hope it didn't effect the scan in any way...

attaching the logs you requested...

things seem to be running pretty well now...
although i haven't attempted to reinstall the java yet...

i can't run my comodo but i assume i'll need to reinstall it...
leaving that alone for now as well..

i can connect to remote servers and obtain updates now...so that's a plus...

i am somewhat concerned about some of the other non plug and play devices i have listed but....this is a malware removal thread so i assume i may need to go elsewhere for other forms of assistance...

thanx again

 

Your logs are clean! If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware & Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources (except a little disk space) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combofix folder from combofix (if it exists)
3. If we had you run Avenger, you can delete all files related to Avenger now.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to Add/Remove Programs and uninstall HijackThis.
8. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
9. If you are running Windows Vista, Windows XP or Windows ME, you need to follow the below:
   • Refer to the cleaning steps in the READ ME for your Windows version and see the steps to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

thanx again for all your help... i followed your instructions and removed all the tools that were used. I also downloaded and installed a shareware version YourUninstaller which was able to remove the comodo firewall and trend micro and an old sim city installation as well
take care

 

You're Welcome!

Surf Safely!:major