Here are the logs... how do I get this virus off of my computer?

AltheaLyle · Dec 27, 2010

I believe I have a virus on my computer. It has been pretending to be an antimalware software called "Internet Security Suite." A friend of mine directed me to run all of the programs, save all the logs and post the results here.

Can anyone tell me how to get this virus off my computer? Thanks a million for your help.

(ps: SuperAntiSpyWare, Malwarebytes, Combofix and RootRepeal logs are attached... MGTools is below-I ran out of attachment space)

MGTOOLS LOG:

******************************************************************************
MGtools installation folder and files at Start of Scans
******************************************************************************
Volume in drive C has no label.
Volume Serial Number is 80B4-2B90

Directory of C:\MGtools

12/02/2010 10:26 PM <DIR> .
12/02/2010 10:26 PM <DIR> ..
04/23/2010 02:18 AM 388,608 analyse.exe
10/07/2010 01:11 AM 6,806 BamFix.bat
06/07/2007 01:24 AM 6,146 chodefix.bat
12/13/2009 04:25 PM 1,954 config.reg
08/01/2007 11:13 PM 120 DisableUAC.reg
08/01/2007 11:13 PM 120 EnableUAC.reg
12/02/2010 10:14 PM 5,245 ffdata.txt
12/02/2010 10:26 PM 228 filelog.txt
04/18/2009 02:48 AM 320 FindOVL.bat
08/14/2010 03:40 PM 2,027 FindRN.bat
11/28/2010 11:43 AM 6,196 FixACLS.bat
07/10/2008 01:50 AM 1,897 FixBagle.bat
01/27/2009 12:27 AM 3,765 fixBagle.reg
01/14/2009 12:28 AM 1,034 FixCF.bat
01/02/2009 09:44 PM 581 fixCF.reg
06/07/2007 01:14 AM 738 fixChode.reg
12/29/2008 01:29 AM 438 FixFA.bat
06/17/2010 10:14 PM 22,032 fixFA.reg
12/24/2009 02:37 PM 6,988 FixPerm.bat
08/14/2010 03:12 PM 439 FixSBM.bat
12/04/2006 02:20 PM 12,924 fixSBM.reg
10/30/2006 12:17 PM 245,760 GetDetails.exe
07/21/2010 12:46 AM 11,640 GetLogs.Bat
06/10/2010 12:22 AM 112,515 GetRunKey.bat
12/02/2010 10:11 PM 143,756 GetUnKey.txt
01/23/2009 05:00 PM 2,949 GetUnKeys.bat
04/14/2003 01:00 AM 80,412 grep.exe
06/10/2010 12:27 AM 117,484 GRK.bat
06/10/2010 12:24 AM 113,882 GRK64.bat
06/22/2009 10:48 PM 393 hide.reg
12/02/2010 10:23 PM 7,453 hijackthis.log
11/28/2010 11:43 AM 39,395 history.txt
03/06/2009 03:30 AM 6,606 HTAfind.bat
04/02/2004 07:44 PM 1,756 IEFIX.reg
01/13/2005 10:41 PM 11,254 locate.com
10/28/1986 12:51 PM 13,184 ltime.exe
12/02/2010 10:12 PM 623 mbr.log
03/05/2010 12:39 AM 220 mbrfix.bat
11/28/2010 11:32 AM 5,640 MGclean.bat
07/14/2010 12:58 AM 7,999 MiscInfo.bat
12/02/2010 10:15 PM 30,532 miscinfo.txt
12/02/2010 10:14 PM 191,118 newfiles.txt
09/24/2010 02:57 AM 8,996 NwkTst.bat
12/02/2010 10:15 PM 6,068 nwktst.txt
06/05/2003 09:13 PM 53,248 Process.exe
08/01/2006 09:14 AM 6,656 ProcessDll.exe
04/18/2007 01:55 PM 145 Regfix.bat
07/30/2009 11:09 PM 497 RemMWS.bat
12/02/2010 10:12 PM 47,252 runkeys.txt
06/15/2009 10:01 PM 195 RunMB.bat
12/02/2010 10:26 PM 52 scantime.txt
08/31/2000 09:00 AM 98,816 sed.exe
11/05/2010 01:26 PM 93,395 ShowNew.bat
11/05/2010 01:35 PM 103,286 SN64.bat
12/16/2007 06:36 PM 156,160 swreg.exe
12/16/2007 06:47 PM 66,048 swwhoami.exe
09/11/2009 12:37 AM 5,841 SysBU.bat
12/02/2010 10:25 PM 943,698 sysinfo.txt
12/02/2010 10:25 PM 0 sysrest.txt
12/02/2010 10:26 PM <DIR> temp
08/03/2007 05:11 PM 213 unhide.reg
05/30/2010 07:15 PM 1,755 UnKeys.bat
05/03/2010 11:11 PM 3,004 UserInfo.bat
12/02/2010 10:14 PM 4,601 UserInfo.txt
12/28/2007 03:42 PM 49,152 vfind.exe
12/28/2007 04:16 PM 861 VunFind.bat
12/02/2010 10:14 PM 500,854 winfiles.txt
01/13/2005 10:41 PM 126,976 zip.exe
67 File(s) 3,890,946 bytes
3 Dir(s) 261,590,712,320 bytes free
******************************************************************************

******************************************************************************
* File Versions Used: *
* GetLogs.Bat - 07/20/2010 Version 2.35 *
* 32 bit Windows OS found *
* GetUnKeys.Bat - 01/23/2009 Version 0.19 *
* 32 bit Windows OS found *
* GetRunKey.Bat - 06/10/2010 Version 2.54 *
* ShowNew.Bat - 11/05/2010 Version 2.76 *
* UserInfo.Bat - 04/29/2010 Version 1.02 *
* NwkTst.bat - 09/24/2010 Version 0.09 *
* MiscInfo.Bat - 07/14/2010 Version 0.01 *
******************************************************************************

******************************************************************************
MGtools installation folder and files at End of Scans
******************************************************************************
Volume in drive C has no label.
Volume Serial Number is 80B4-2B90

Directory of C:\MGtools

12/02/2010 10:31 PM <DIR> .
12/02/2010 10:31 PM <DIR> ..
04/23/2010 02:18 AM 388,608 analyse.exe
10/07/2010 01:11 AM 6,806 BamFix.bat
06/07/2007 01:24 AM 6,146 chodefix.bat
12/13/2009 04:25 PM 1,954 config.reg
08/01/2007 11:13 PM 120 DisableUAC.reg
08/01/2007 11:13 PM 120 EnableUAC.reg
12/02/2010 10:29 PM 5,245 ffdata.txt
12/02/2010 10:31 PM 5,298 filelog.txt
04/18/2009 02:48 AM 320 FindOVL.bat
08/14/2010 03:40 PM 2,027 FindRN.bat
11/28/2010 11:43 AM 6,196 FixACLS.bat
07/10/2008 01:50 AM 1,897 FixBagle.bat
01/27/2009 12:27 AM 3,765 fixBagle.reg
01/14/2009 12:28 AM 1,034 FixCF.bat
01/02/2009 09:44 PM 581 fixCF.reg
06/07/2007 01:14 AM 738 fixChode.reg
12/29/2008 01:29 AM 438 FixFA.bat
06/17/2010 10:14 PM 22,032 fixFA.reg
12/24/2009 02:37 PM 6,988 FixPerm.bat
08/14/2010 03:12 PM 439 FixSBM.bat
12/04/2006 02:20 PM 12,924 fixSBM.reg
10/30/2006 12:17 PM 245,760 GetDetails.exe
07/21/2010 12:46 AM 11,640 GetLogs.Bat
06/10/2010 12:22 AM 112,515 GetRunKey.bat
12/02/2010 10:26 PM 143,756 GetUnKey.txt
01/23/2009 05:00 PM 2,949 GetUnKeys.bat
04/14/2003 01:00 AM 80,412 grep.exe
06/10/2010 12:27 AM 117,484 GRK.bat
06/10/2010 12:24 AM 113,882 GRK64.bat
06/22/2009 10:48 PM 393 hide.reg
12/02/2010 10:29 PM 7,453 hijackthis.log
11/28/2010 11:43 AM 39,395 history.txt
03/06/2009 03:30 AM 6,606 HTAfind.bat
04/02/2004 07:44 PM 1,756 IEFIX.reg
01/13/2005 10:41 PM 11,254 locate.com
10/28/1986 12:51 PM 13,184 ltime.exe
12/02/2010 10:27 PM 702 mbr.log
03/05/2010 12:39 AM 220 mbrfix.bat
11/28/2010 11:32 AM 5,640 MGclean.bat
07/14/2010 12:58 AM 7,999 MiscInfo.bat
12/02/2010 10:29 PM 30,846 miscinfo.txt
12/02/2010 10:29 PM 191,501 newfiles.txt
09/24/2010 02:57 AM 8,996 NwkTst.bat
12/02/2010 10:29 PM 6,068 nwktst.txt
06/05/2003 09:13 PM 53,248 Process.exe
08/01/2006 09:14 AM 6,656 ProcessDll.exe
04/18/2007 01:55 PM 145 Regfix.bat
07/30/2009 11:09 PM 497 RemMWS.bat
12/02/2010 10:27 PM 48,166 runkeys.txt
06/15/2009 10:01 PM 195 RunMB.bat
12/02/2010 10:26 PM 52 scantime.txt
08/31/2000 09:00 AM 98,816 sed.exe
11/05/2010 01:26 PM 93,395 ShowNew.bat
11/05/2010 01:35 PM 103,286 SN64.bat
12/16/2007 06:36 PM 156,160 swreg.exe
12/16/2007 06:47 PM 66,048 swwhoami.exe
09/11/2009 12:37 AM 5,841 SysBU.bat
12/02/2010 10:31 PM 943,944 sysinfo.txt
12/02/2010 10:31 PM 0 sysrest.txt
12/02/2010 10:29 PM <DIR> temp
08/03/2007 05:11 PM 213 unhide.reg
05/30/2010 07:15 PM 1,755 UnKeys.bat
05/03/2010 11:11 PM 3,004 UserInfo.bat
12/02/2010 10:29 PM 4,601 UserInfo.txt
12/28/2007 03:42 PM 49,152 vfind.exe
12/28/2007 04:16 PM 861 VunFind.bat
12/02/2010 10:29 PM 500,854 winfiles.txt
01/13/2005 10:41 PM 126,976 zip.exe
67 File(s) 3,897,952 bytes
3 Dir(s) 261,589,602,304 bytes free
******************************************************************************
Begin scan time
Thu 12/02/2010 at 22:26:59.63
End scan time
Thu 12/02/2010 at 22:31:57.95

chaslang · Dec 27, 2010

Welcome to Major Geeks!

Please do not post any logs inline like you just did and that is not the correct log from MGtools. You need to attach the C:\MGlogs.zip file and nothing else

You are out of date with your version of SUPERAntiSpyware.

Please uninstall your current version (this is necessary).

Then download this SUPERAntiSpyware

Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.

After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.

Now run a new full scan of your system. And attach this new log.

Now run Malwarebytes ( which was way out of date )and click the Update tab. Then click the Check for Updates button so you update to the current version of the program and database. Then run a new scan with it too. Make sure you fix the problems found before saving a log. Attach the new log.

AltheaLyle · Dec 28, 2010

I apologize for putting the MGTools log in my post, I didn't know better.

Here is the updated logs for SuperAnti, Malwarebytes and MGTools... please let me know if you need anything else! Thanks!

chaslang · Dec 29, 2010

We have a little more to do.

First you have left overs from AVG. If you still have AVG uninstalled then delete the below folders:
C:\$AVG
c:\users\Lauren Claire\AppData\Roaming\AVG10
c:\programdata\AVG10
c:\program files\AVG

Uninstall the below software:
Java(TM) 6 Update 14
Viewpoint Media Player <-- should have been uninstalled in step 5 of the READ ME

Now we need to use ComboFix

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.

Open Notepad and copy/paste the text in the below quote box into it:

KILLALL::
Driver::
Viewpoint Manager Service
Folder::
c:\program files\Viewpoint
c:\users\Lauren Claire\AppData\Roaming\Internet Security Suite
c:\programdata\ISYDJPRXFS
c:\programdata\d52066

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Internet Security Suite"=-
Click to expand...

Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

C:\ComboFix.txt

C:\MGlogs.zip

Make sure you tell me how things are working now!

AltheaLyle · Dec 29, 2010

I deleted all of the stray folders and whatnot, and ran ComboFix-attached is the log.

But it looks like some damage was done to the registry keys during the process of running. Every time I attempt to open a program (any program) it gives me the error message: "Illegal operation attempted on a registry key that has been marked for deletion." Of course now I can't open MGTools or download anything because I can't get Internet Explorer or Firefox to run. I am hoping this is fixable too...

chaslang · Dec 29, 2010

AltheaLyle said: ↑

But it looks like some damage was done to the registry keys during the process of running. Every time I attempt to open a program (any program) it gives me the error
Click to expand...

Power down your PC and then wait a minute. Power backup and see if you can continue to get the new log from MGtools.

AltheaLyle · Dec 29, 2010

Why didn't I think of that?
Here is the attached MGTools log.

chaslang · Dec 29, 2010

Okay your logs are clean. The only thing of note is that somehow you have two slightly different name startups from Malwarebytes. Possibly from installing twice. Either way these are not needed so let's fix them before we do final instructions.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

After clicking Fix, exit HJT.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

AltheaLyle · Dec 30, 2010

I am having some issues fixing the Malwarebytes thing... I run MGTools as an admin, but there is nowhere that I see to select "do a system scan only" and I don't get a list of things to fix.

chaslang · Dec 30, 2010

AltheaLyle said: ↑

I run MGTools as an admin, but there is nowhere that I see to select "do a system scan only" and I don't get a list of things to fix.
Click to expand...

You are not supposed to be running MGtools. You need to run the analyse.exe program that is in the MGtools folder. That is what C:\MGtools\analyse.exe is.

AltheaLyle · Dec 31, 2010

Yes well, that would explain it. Sorry, I am a bit computer illiterate.
Well, I don't seem to be having any more issues - Thank you so very much for all of your help!:-D

chaslang · Dec 31, 2010

You're welcome. Surf safely!

Log in or Sign up

Here are the logs... how do I get this virus off of my computer?

AltheaLyle Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 12-02-2010 - 23-20-57.log

mbam-log-2010-12-03 (19-57-48).txt

combofixlog.txt

procdll.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

AltheaLyle Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 12-28-2010 - 00-53-57.log

mbam-log-2010-12-28 (21-03-57).txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

AltheaLyle Private E-2

Attached Files:

log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

AltheaLyle Private E-2

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

AltheaLyle Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

AltheaLyle Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member