Windows System Defender Problems

Discussion in 'Malware Help (A Specialist Will Reply)' started by mhendrix, Nov 15, 2009.

  1. mhendrix

    mhendrix Private E-2

    I'm a newbie. About 5 days ago computer became sluggish. Default search engine was changed. Any searches done on Google were redirected to suspect looking sites. Prompted through the systems tray that computer was infected. I'd have to pay to get the bugs removed. Ran Malwarebytes and it did find some problems. The Windows System Defender is gone from the control panel. But my computer is still being directed to bogus sites. All of which will cost me money, of course. Avast, AVG, Panda, TrendMicro and others have been stumped.

    I have gone through the read and run me first. However, MGTools won't work. The Cprompt window flashes on and off very quickly. No MGTools log file generated.

    Please help. Thanks.
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Then you need to attach the logs from the below that were requested:
    • SUPERAntiSpyware
    • Malwarebytes
    • ComboFix
    • RootRepeal
    What version of Windows are you running?
     
  3. mhendrix

    mhendrix Private E-2

    Thank you for your response. I will post logs tonight when I get home from work.

    I use Windows XP on my home computer -- the one that is infected.

    :)
     
  4. mhendrix

    mhendrix Private E-2

    Here are the logs:
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    There is no malware showing in your logs. The first instructions in the READ & RUN ME state to only have one antivirus installed. You appear to have at least two (AVG and Avast). You must now uninstall both of these to clear up complications cause by doing this. After uninstalling both, reboot your PC. If you have any others installed then uninstall them too and stop downloading anymore antivirus programs. This is the main reason your PC is slow. The secondary reason is that you don't have enough memory to run Windows XP. You ony have 512MB which is have of the minimum we suggest.


    After reboot, continue with the below.

    Delete the below folder if it still exists:
    c:\documents and settings\All Users\Application Data\ff202ad

    Download and run the current version of ComboFix: combofix.exe

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )




    Now attach the below log:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  6. mhendrix

    mhendrix Private E-2

    Thank you for your help.

    Once infected AVG disappeared from the systems tray and the add/remove section so I couldn't uninstall it. A search revealed some files were still on the computer but clicking the exe file said I would need to reinstall it.

    I reinstalled, ran, and then uninstalled.

    I followed your directions. See logs attached.

    The computer seems to be working fine now. I am no longer being redirected. Hopefully, it is fixed.

    Awaiting your feedback re: logs. Thank you so much. It's been over a week of having my computer hijacked. My kids use this computer for homework and their work was hampered by being redirected to inappropriate sites all the time.
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    You appear to have forgotten to delete the below folder based on your ComboFix log:
    c:\documents and settings\All Users\Application Data\ff202ad


    Your logs are otherwise clean. You now need to do the below.

    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds