A problem Microsoft cant figure out....

Welcome to Major Geeks!

HijackThis is not going to help you.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Administrator

You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

1. Rkill.exe
2. Rkill.com
3. Rkill.scr
4. Rkill.pif

Once you've gotten one of them to run then try to immediately run the following.

Now download and Run exeHelper from Raktor

• Please download exeHelper to your desktop.
• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• A log file named log.txt will be created in the directory where you ran exeHelper.com
• Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Now run this: Using Malwarebytes Anti-Malware

Now run this: Using MGtools

Now you need to attach (See: HOW TO: Attach Items To Your Post ) the below logs created while running the above scans

• exeHelper log
• Malwarebytes Anti-Malware log
• MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.

 

Yes give it a try. We need to get some information to try and get started.

 

You did not download and install Malwarebytes from our link and you also have not updated what you have in a long time. You need to download and install the version in the READ & RUN ME and then you MUST also update it to the current database during the installation. If you cannot connect to the internet to update during the installation, see the instructions given for manual update. You are more than 600 database versions out of date. Run a new scan and attach the new log.

Did you knowlingly install software from Winferno? Like the below for example? If not, uninstall it. They are not highly recommended.
PC Confidential 2008

Who install CamFrog? See the below and then uninstall it.
http://www.threatexpert.com/files/wsaecmt.exe.html
http://www.greatis.com/appdata/d/w/wsaecmt.exe.htm
http://www.prevx.com/filenames/X18833968223618789-X1/WSAECMT.EXE.html

Uninstall the below old versions of software:
Java(TM) 6 Update 15
Viewpoint Media Player

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF} - (no file)
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - (no file)
O3 - Toolbar: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - (no file)
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-21-2900003714-2480259999-1175681365-1000\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan (User '?')
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - (no file)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - (no file)
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe (file missing)
O9 - Extra 'Tools' menuitem: PC Confidential - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe (file missing)
O9 - Extra button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

After clicking Fix, exit HJT.

Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\Windows\Temp\
C:\Users\Daddy\AppData\Local\Temp\

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now see step 4 of the READ & RUN ME and put your PC into Normal Startup mode with MSconfig.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Why do you have to run them in safe mode? You need to give us logs from MGtools in normal boot mode or you need to explain in detail what happens when you try to run MGtools ( or GetLogs.bat ) in normal boot mode.

Make sure you have updated Avira since it has been having false detection problems lately with detecting and deleting MGtools.exe. We complained again (not the first time) that they need fix their bugs and they did release an update to fix this.

Please always be specific and state exactly which problems you are having. It saves us the time of having to re-read the whole thread. Remember we are help 50 to 100 users at any given time.

It is only deleting junk someone is downloading on the PC! i.e., GameVance

In my last message I asked you to do the below and you did not do this. You need to do this now.

Please download and run Win32kDiag per the below instructions:

• Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
• Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log

C:\win32kdiag.exe -f -r

 

Try the below in normal boot mode.

• First make sure that UAC has been disabled and that you have rebooted after it has been disabled.
• Navigate to the C:\MGtools folder with Windows Explorer and locate the GRK64.bat file and right click on it and select Run As Administrator. Does it run?
• If it ran, look for the C:\MGtools\runkeys.txt log and attach it.

According to your last MGlogs.zip file attached the newfiles.txt log show it was there. Here is a list of the files it saw in your root folder

Code:

"C:\"
autoexec.bak  Aug 19 2009          99  "AUTOEXEC.BAK"
autoexec.bat  Sep 24 2009          61  "AUTOEXEC.BAT"
AVENGER       Nov 12 2009              "Avenger"
avenger.txt   Nov 16 2009        6054  "avenger.txt"
AVIRA         Sep 20 2009              "Avira"
backup.reg    Nov 16 2009        2385  "backup.reg"
cleanup.bat   Nov 16 2009         574  "cleanup.bat"
cleanup.exe   Nov 16 2009       19286  "cleanup.exe"
DEV-CPP       Aug 24 2009              "Dev-Cpp"
DOWNLO~1      Sep 12 2009              "Downloads"
EASYAS~1      Sep 22 2009              "Easy Assist"
ED289C~1      Aug 18 2009              "ed289cb583746e380391c7e26bf9"
FINALW~1      Sep  4 2009              "Final Windows Registry"
founda~1.txt  Sep 24 2009       15210  "Foundation_Readme.txt"
GAMES         Sep 10 2009              "games"
INETPUB       Oct  9 2009              "inetpub"
KHG           Sep  7 2009              "khg"
lxdc.log      Oct  9 2009        6146  "lxdc.log"
mglogs.zip    Nov 16 2009      136130  "MGlogs.zip"
MGTOOLS       Nov 12 2009              "MGtools"
mgtools.exe   Nov 12 2009     2384671  "MGtools.exe"
NEWFOL~1      Sep  7 2009              "New Folder"
NEWFOL~2      Sep  7 2009              "New Folder (2)"
OVALOF~1      Sep  8 2009              "ovaloffice"
pagefile.sys  Nov 16 2009  3145728000  "pagefile.sys"
pctlsp.log    Aug 28 2009         142  "pctlsp.log"
PORTLI~1      Aug 21 2009              "portlistener"
REG_KEY       Sep  4 2009              "Reg_Key"
SCRIPTS       Sep 23 2009              "scripts"
sdklic~1.txt  Sep 24 2009        5296  "SDKLicense.txt"
STARTREK      Sep  6 2009              "startrek"
SW3DG         Sep  4 2009              "sw3dg"
UNINST~1      Sep 23 2009              "Uninstall BC-Mods"
zip.exe       Nov 16 2009      135168  "zip.exe"
_OTL          Sep 22 2009              "_OTL"

Try it the below way.

Download and save Win32kDiag to your Desktop

Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK.

"%userprofile%\desktop\win32kdiag.exe" -f -r

When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log to your next message.

Being an administrator is not the same exact thing as actually logging in with the user account that is named Administrator. They have different permissions. Also the malware has corrupted your permissions so it does not matter what account you use. This is why you really should not surf using an account with Administrator priviledges.

 

UAC is disabled in safe mode the same way it is disabled in normal boot mode. What exact problem are you having with disabling it?

Just work thru all of the steps in my previous message anyway if you cannot get it disabled.

 

If you keep doing things that we do not ask you to do, you are making it impossible for us to continue helping you. You need to stop installing and uninstalling everything but what we ask. You must only be doing what we request and nothing else if you wish us to continue helping you.

Also it is taking too long inbetween posts. 10 days to respond to my last post and you did not even answer my question about UAC. And it took 18 days to repond to the previous post. In as little as 5 days without posting, it really becomes necessary to begin the whole cleaning process over again since malware can change too much in even one day. MGtools has changed a bunch in this time and so have all other tools.

Since too much time has elapsed, I need you to list for me all of the current problems that you still have. Then also do the below.

• Go to TDSSKiller and Download TDSSKiller.zip to your Desktop
• Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
• Click Start > Run and copy/paste the following bold command into Run box and hit Enter.

"%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

• Follow the instructions to type in "delete" when it asks you what to do when if finds something.
• When done, a log file should be created on your C: drive called "TDSSKiller.txt" please attach this log to your next reply.

• Now run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
• Attach the new Avenger.txt log

Now follow the instructions in the below link to the best of your ability. Work thru all steps. If any step does not work, keep going and report back later. Be sure to redownload and use the new versions of all tools.

Vista Cleaning Procedure

 

All normal. They belong to the Vista OS and you are not allowed to enter these folders. This is not Windows XP.

Are you acutally having any malware problems that we need to deal with.

Where were you trying to save it or were you saving to the default location. You did attach a log so I'm not sure why you say you could not save one???

You have to understand that having administrator permissions does not mean you are the Administrator user account which has higher level permissions. That is why the Run As Administrator function exists. When you use this, you actually run as the Adminstrator user account, not as mommy or daddy who just have some administrator permissions.

Okay this is becoming a common issue with Vista system which now seem to object more to having things saved in the root folder. If it did not find anything and did not say you needed to reboot then all is good.

You need to keep on going no matter what. If you disable UAC per the instructions and then rebooted, it shoud be disabled. Continue on thru all steps.

 

I already answered this a few times.



You did not update Malwarebytes. You are almost 200 database versions out of date so just to be safe, I suggest rerunning it and first select the Update tab and update it. The after updating run a new scan and fix anything found. Then save and attach the new log even if nothing is found.

You should not be reenabling UAC until we have finished cleaning your PC. Remember you must only do what we ask you to do and nothing else until we are finished. Disable UAC now and then immediately reboot your PC. Keep UAC disable until we ask you to enable it. After reboot, do the below:

Please click Start, All Programs. Accessories, and locate Command Prompt and right click on it and select Run As Administrator. If this works properly, a black command prompt window should open and the Title bar of the winows should say Adminstrator Command Prompt. Do you see this? If yes then continue, if not then stop because something is wrong.

Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple and red are merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.