Did the "read me first" instructions....but

Discussion in 'Malware Help (A Specialist Will Reply)' started by Pvt.mom24, Jun 4, 2010.

  1. Pvt.mom24

    Pvt.mom24 Private E-2

    I think there may still be problems lurking.
    I am not a newbie but am certainly no expert which is why I am consulting MajorGeeks...recommended to me by ProVobis who had similar problems, all resolved after consulting you. I thank you in advance.
    -Computer infected with a Trojan, possibly malware. AVG apparently was not able to remedy the problem.
    -in a panic, decided to try to install Comodo to replace what I had been using: ZoneAlarm Firewall and AVG 9.
    -unistalled both ZA and AVG, but on trying to install Comodo was informed that ZA AntiVirus was still installed, something I never knew was there or even running, therefore I could not locate it to un-install it. At this point, there is no firewall or antivirus running on puter.
    -Followed the instructions in the "read me first " thread, up to RootRepeal, which would not run, giving me the error messages: "could not initialize driver, please contact author." and, " could not scan drive C (error0x0000001)".
    -The other applications (TDSSKiller, SAS, Malwarebytes Anti-Malware, combofix) removed trojans/? from various locations on puter, I will include logs (in two posts).
    -did a computer search for ZA, found a bunch of ZA related stuff, and panicking, deleted some--I know-- big mistake.
    -downloaded Windows installer clean-up utility to find ZA AntiVirus, no luck.
    -used reg-cleaner to locate "Zone Labs" , uninstalled it.
    -At this point, I am not getting weird error messages like before, and puter seems to be running more quietly and quickly, but I have not tried again to install Comodo. I feel there may still be problems simply because I have not been able to follow through with the XP Cleaning procedure and because of the error message I get from RootRepeal.
    I am in a fluster, feel as though I have done everything backwards and don't know what to do next. Help!
    Thank you.
     

    Attached Files:

    Pvt.mom24, Jun 4, 2010
    #1
  2. Pvt.mom24

    Pvt.mom24 Private E-2

    here is the 2nd post w/ remaining logs.
    thank you.
     

    Attached Files:

    Pvt.mom24, Jun 4, 2010
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    You need to attach the requested log from MGtools before we can continue.
     
    chaslang, Jun 4, 2010
    #3
  4. Pvt.mom24

    Pvt.mom24 Private E-2

    Thank you chaslang, I am really glad/relieved to find you guys.

    I hadn't att'd the MGtools log because I didn't want to take the next step past RootRepeal until I was sure I could skip that step, for now.
    But I will go ahead with the MGtools scan and then post the log.
    tnx.
     
    Pvt.mom24, Jun 5, 2010
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    The below is a direct quote from the very beginning of the READ & RUN ME. Observe the 2nd & 3rd bullet items. ;)
     
    chaslang, Jun 5, 2010
    #5
  6. Pvt.mom24

    Pvt.mom24 Private E-2

    chaslang,
    att'd is MGtools log file.
    tnx
     

    Attached Files:

    Pvt.mom24, Jun 5, 2010
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.



    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R3 - URLSearchHook: (no name) - *{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
    R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: (no name) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    After clicking Fix, exit HJT.

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jun 5, 2010
    #7
  8. Pvt.mom24

    Pvt.mom24 Private E-2

    Thank you chaslang.

    Checking mail from work, and am anxious to proceed with these instructions when I get back to my own computer--at which point I will post logs and other pertinent info. :)
     
    Pvt.mom24, Jun 5, 2010
    #8
  9. Pvt.mom24

    Pvt.mom24 Private E-2

    Ok chaslang,
    I followed the instructions to a "T" and am hoping I made no mistakes. There was one thing that made me wonder:confused if I messed up: when I dragged CFscript onto ComboFix, nothing seemed to happen; i.e. : normally when one drags a file into another file, the file being dragged generally becomes a part of the first file and disappears from its original location. This did not happen in this case and CFscript remained in its original location after I dragged it onto ComboFix and let go of the mouse. Did I mess up? :confused
    Have not re-booted after running MGtools\getlogs.bat.
    Things seem to be running normally.
    Please advise.
    see att'd logs.
    tnx.
     

    Attached Files:

    Pvt.mom24, Jun 5, 2010
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    No. ComboFix cleaned up what we wanted it to.

    Your logs are clean.

    If you are not having any other malware problems, it is time to do our final steps and get your protection software reinstalled:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Jun 5, 2010
    #10
  11. Pvt.mom24

    Pvt.mom24 Private E-2

    Clean logs??? oh, sweet words! Thank you chaslang!

    I don't seem to be having any issues with the exception of one that has been happening for a long time and is more an annoyance than anything; I don't know if it's a lasting consequence of malware/virus infection or something else. I noticed this happening just after I installed AVG (8 or 9?) many months ago: on start up when the desktop appears, a DELL program box pops up additionally on the desktop and remains there until I close it.
    ( c:\program files\dell)...I close it and try to forget about it :-o, but am ashamed to say that I have no idea what to do about it...I looked in start-up to see if it was something added to startup files , so I could uncheck it or something, but no success.
    Is this a consequence of malware/virus infection??
    Any advice? Or shall we just proceed to the next step of protection software install?
    greatful, :)
     
    Pvt.mom24, Jun 6, 2010
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    No! It is just something related to a startu[ process from Dell that has become corrupted. Normally would we not look at this in the Malware Forum, but since we are not super busy at this moint, I will see if we can find which one. This will be an iterative process. But first see, the answer to your next question below.

    Yes do not deley in getting your protection reinstalled. Do this immediately.

    Just hold off on running the MGclean.bat to remove MGtools if you have not already done so. If you have already run it, we could always redownload if I feel we need it.


    Now copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now reboot and then see if the window still appears.
     
    chaslang, Jun 6, 2010
    #12
  13. Pvt.mom24

    Pvt.mom24 Private E-2

    OK chaslang, here is the latest:

    I Downloaded and installed Comodo (firewall& AV).

    -On reboot a window pops up:
    "windows installer preparing to install Sonic DLA installation package<next window>please wait while windows configures Sonic DLA <next window> The feature you are trying to use is on a network resource that is inavailable; <next window> click OK to try again or enter an alternative to a folder containing the installation package 'DLAmsi' in the box below"

    I had to close and/or cancel each one of these windows as they popped up several, consecutive times. (i.e., I closed it and the same one would pop up again)
    This now occurs on reboot and/or when I open IE(7)browser, but not Firefox. Another corrupted file I imagine but am clueless as to how and where this came from. :cry If you would rather refer this problem to another forum area, I understand.

    Have not done this step, so it is still here to use if necessary.

    this worked beautifully.

    I never had to do this step initially therefore I skipped over this.


    looked to uninstall first, but when I couldn't find anything , just deleted : rootrepeal, TDSSkiller, etc.


    none for malware removal, but for the DELL program window popping up (now fixed) we did, and it remains there on my desktop, as it was done after these steps.

    Hijack this was nowhere to be found, I looked in ADD/REMOVE, and in CCleaner.


    This , I did NOT do, per your previous directions to hold off until after the DELL problem was fixed.


    Done! which is why it took me so long to reply!:-o


    This was a success:celebrate, rec'd success message, window did not pop up on any reboot after the fact!!!
    Thank you chaslang!:wine

    Please advise w/regard to SonicDLA window.
     
    Pvt.mom24, Jun 7, 2010
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You will have to post about this in the Software Forum.

    Okay so let's see which start program from Dell was the issue by trial and error. We will add some back and reboot and see what happens. First we will add back startups for your printer and fax.



    Now copy the bold text below to notepad. Save it as fixme2.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    Did the problem come back or is it still gone?
     
    chaslang, Jun 8, 2010
    #14
  15. Pvt.mom24

    Pvt.mom24 Private E-2

    Good morning chaslang.

    OK. will do. thank you.

    Did the copy/paste,merge. Rec'd success message and the problem has returned; the DELL window popped up right along with the SONIC DLA window. :(

    Thank you for your help.
    Will wait for further instructions.
     
    Pvt.mom24, Jun 9, 2010
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay so let's see which one of the 3 items we put back in is the problem.


    Copy the bold text below to notepad. Save it as fixme3.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now reboot and see it the problem is still there.
     
    chaslang, Jun 11, 2010
    #16
  17. Pvt.mom24

    Pvt.mom24 Private E-2

    Hi chaslang:

    .

    rec'd success message for fixme3.reg, however, on reboot the Dell window returned.

    Will wait for further instructions.
    tnx
     
    Pvt.mom24, Jun 11, 2010
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay that means that the FaxCenter startup was not the problem and one of the other two remaining entries was. We have a 50-50 chance of finding it this time.;)


    Copy the bold text below to notepad. Save it as fixme4.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.
     
    chaslang, Jun 11, 2010
    #18
  19. Pvt.mom24

    Pvt.mom24 Private E-2

    Hi chaslang,

    rec'd success message for fixme4.reg, however, on reboot the Dell window returned.


    Will wait for further instructions.
    tnx :)
     
    Pvt.mom24, Jun 12, 2010
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well we only have one remaining possibility now. ;)


    Copy the bold text below to notepad. Save it as fixme5.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now reboot and see it the problem is still there.
     
    chaslang, Jun 12, 2010
    #20
  21. Pvt.mom24

    Pvt.mom24 Private E-2

    Hi chaslang,

    rec'd success message for fixme5.reg, and on reboot the Dell window DID NOT RETURN! Oh sweet success!
    Thank You!:wine So grateful!

    Now, I'd be as grateful if someone as knowledgeable as you on the software forum will reply to my post with a solution, regarding the Sonic Window problem. :)

    Are there further instructions at this point, which I need to follow through on: deleting any logs , files or other 'stuff' on desktop and/or other locations which were used in any of these processes relating to the malware or the DELL window?
     
    Pvt.mom24, Jun 12, 2010
    #21
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay but now we need to put back in the other items we removed that do not need to be removed to fix this issue. I will add something in here to remove something related to Sonic which you really don't need anyway. Perhaps it will help.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    If the fix above did not help, just post all the specific details in the forum and wait for an answer.


    Just remove all the fixmeX.reg files from your Desktop ( see step 5 of my final instructions from msg # ) and then continue thru with my final instructions.
     
    chaslang, Jun 12, 2010
    #22
  23. Pvt.mom24

    Pvt.mom24 Private E-2

    Hi chaslang,

    rec'd success message for fixme.reg, and on reboot the Dell window DID NOT RETURN.
    However,
    this apparently was not effective, as the Sonic window smilingly reappeared :).

    I've posted the details of this problem on the software forum, and now will continue with the follow-through.
    please advise if further instructions are necessary.
    I'll wait. :)
     
    Pvt.mom24, Jun 13, 2010
    #23
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. As long as you have performed the final cleanup, you are finished here. ;)
     
    chaslang, Jun 13, 2010
    #24
  25. Pvt.mom24

    Pvt.mom24 Private E-2

    Thank you *so* much chaslang!
    :wave
     
    Pvt.mom24, Jun 13, 2010
    #25
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Jun 13, 2010
    #26

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds