PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal info

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

Welcome to Major Geeks!

Your starting point is to run the below procedure and attach the requested logs:

READ & RUN ME FIRST. Malware Removal Guide

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

I'm sorry but you need to attach the correct log. We specifically stated the log from MGtools is C:\MGlogs.zip

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

Yes that is the log that was requested and what you should have attached previously which would have prevented the additional delay in getting your problems fixed.

You have a serious Master Boot Record infection.


Please run the below tool from Prevx

Prevx 3.0 use the button that says Download Prevx 3.0

After running the Prevx scan, reboot and then continue with the below.


Uninstall the below software:
J2SE Runtime Environment 5.0 Update 12
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 17
Java(TM) 6 Update 7
Viewpoint Media Player <-- should have been uninstalled in step 5 of the READ ME

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL (file missing)
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - C:\PROGRA~1\VOL_TO~1\VOL_TO~1.DLL (file missing)
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FunWebProducts; GTB6; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.2scarygames.com/scary-games/33/Hostel_The-Killing-Floor.html"
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

After clicking Fix, exit HJT.


Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\TEMP
C:\Documents and Settings\Debra\Local Settings\Temp

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

Your MGlogs.zip file contains incomplete info. Something must have caused a glitch. Please do the below so we can be sure you are clean.

• First delete the current C:\MGlogs.zip file that you have.
• Disconnect your PC from the internet by unplugging your cable
• Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).
• Make sure you do not run anything else while GetLogs.bat is running and collecting information.

Then attach the new C:\MGlogs.zip

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

Yes this was why I was stressing getting another log from MGtools. I did not think you were clean and the log shows that PrevX failed to remove the root of the MBR infection. You will have to do the below which will require you having your Windows Boot CD.

Now boot to the Recovery Console and run the fixmbrto clear a Master Boot Record infection that you have.

You can read the below to help you do this:

http://support.microsoft.com/kb/307654


After running the fixmbr command and boot back to normal mode, continue with the below. Do not waste any time doing the below until you have run the fixmbr command from the Recovery Console.

• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

You're welcome.

You can and should do this ASAP.

Not yet! Don't make any changes other than what we request.

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

As stated in one of my last messages, PrevX failed to remove the problem. You need to run th fix I gave in message # 14 with fixmbr.

It is not complicated. 98% of what is in there has nothing to do with what you are going to do. The link given was mainly to provide additional information.

You don't need to do the installation part. You just need to boot from your CD and run the Recovery Console. And when the prompt appears you select your Windows partition (normally 1) and then you will run the fixmbr command. Afterwards, you will remove the CD and reboot.

Yes as stated you should do this.

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

I did not notice all of your remarks previously stated about PrevX.

Run it again and of course let it fix (Cleanup Now) the problem which is why we were running it.

Then run the Avenger fix again and attach anothe new log from Avenger and run C:\MGtools\GetLogs.bat and attach the new MGlogs.zip file.

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

That's a very old post. For quite awhile at the end of 2009 and the beginning of 2010, Prevx would still fix this infection for free. Their website has multiple pages where they even stated this. Read the bottom of the below direct from their website: http://www.prevx.com/blog/131/MBR-Rootkit-reloaded.html Obviously now not true.

We used it many times in the last few months successfully. They must have recently decide to not do this for free which means we will no longer be recommending there tool, and thus they shoot themselves in the foot. No free advertising..... in fact more bad advertising.

You will have to find your Windows Boot CD or borrow one so that you can boot to the Recovery Console and run fixmbr.

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

You should be working on getting a boot CD to help avoid future problems like this. A CD is an absolute must and has been for the last few years due to how malware has progressed and also due to many problems that can occur within the Windows Operating System itself. If you had a CD now, you would not need to do the factory recovery. Even if you borrow one just to do the fixmbr you could avoid this. While I expect that restore to the way it was shipped should overwrite the infected MBR, I'm not positive that it will. Which could mean, you would still be infected afterwards and wasted your time. Also you would have a load of work in front of you in getting your PC back to the way you have it now.

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

Exactly when did you see this? Was it after you got into the Recovery Console and when you tried to run fixmbr?

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

You are not following the instructions for Booting to the Recovery console. I do not want you to install the Recovery Console. You should not have Windows running at all. What you need to do is boot up your computer from the CD (this may require changing your BIOS boot order to boot from the CD first). See option # 2 in this link which may help you understand better: http://support.microsoft.com/kb/314058

I only want you to refer to option 2 in the above just to get you booted to the RC. I do not want you to run the procedures in that link. All we want you to do is get to the RC prompt which will be a DOS like screen saying C:\Windows> and then you need to just type in fixmbr and hit return.

If you still need help doing this, perhaps the below will help with some screen snapshots:

How to Enter Recovery Console From the Windows XP CD

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

You have to make sure that you are not trying to attach the log as previously attached. Let's make sure it is new by doing the following:

• delete the current C:\MGlogs.zip file
• re-run C:\MGtools\GetLogs.bat and make sure you allow it to finish
• then attach the new C:\MGlogs.zip file. Watch for any specific errors when trying to upload. Like does it say the file is too large or anything else. It is very possible that your log got too large due to what the infection had done by adding the HelpAssistant folder

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

What is the size of the file?

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

And that is why you cannot attach it. If you read the message being displayed you would see it told you it was too large.

It is too large due to the infection you had. As stated in my last message, the Help Assistant folder was massive.

Delete the C:\Avenger folder. Then rerun C:\MGtools\GetLogs.bat. Now you should be able to attach it.

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

Your MBR infection has been removed. Now we have some miscellaneous cleanup to do before we can get to final instructions.


Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Now uninstall Prevx since you don't need it and we are finished with it.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-8CB0-AB60BB9AAE22} - (no file)

At your option, fix any of the below since they are unnecessary and waste resource and slow down startup.[
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|12.0" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|12.0" (User 'Default user')

After clicking Fix, exit HJT.

Now please download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe and select Run as administrator to run it.
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of the code box

Code:

:Processes
explorer.exe
 
:Services
 
:Files
  
:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
:Commands
[purity]
[createrestorepoint]
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt%21.png button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\TEMP
C:\Documents and Settings\Debra\Local Settings\Temp

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• the C:\_OTM\MovedFiles log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

Okay your logs are clean. Just do the below and then final instructions.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

After clicking Fix, exit HJT.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

None of these are malware problems. You should post these in the Software Forum for continues help. Your other choice ( since you already did a backup of your data ) would be to reinstall Windows since your currently installed copy could be unpredictable.

 

Re: PLEASE. I'm BEGGING! Need MAJOR help! Redirect to pages asking for VERY personal

Yes! Software/Hardware since the problem is with the file system on your hard disk.