Help request for Malware removal

Hi,my sisters computer has some malware on it. I successfully removed 2 of 4 of them by myself. I got rid of aother by following the READ & RUN thread but there seems to be one left after I ran panda (the part before asking for help in the READ & RUN thread) and was hoping for some help. This is my first time ever removing something other than spyware (in the Malware category). Here are the logs also for whoever helps me.

 

The other Logs are here now except counterspy, I need to redo that one.

 

Icouldn't find the edit button for the last post but here is the counterspy log.

 

Download LSP-Fix

After download is complete, Run LSP-Fix

Check the Box labeled "I know what I'm doing" and then click on the connwsp.dll file (in the “Keep” section) to select it.

Then, Select the >> button to move connwsp.dll into the Remove section.

Now, click the Finish Button. When the Repair Summary box appears, click OK.

(Note: If the file connwsp.dll is already in the remove section, then just click FINISH.)

Once you complete this post, run one more scan with CounterSpy and this time remove all found infections.

Once you have completed all of the above, reboot and attach a fresh HJT log with the new CounterSpy log.

 

OK Here are the new logs, HJT and Counterspy.

 

Here are More recent log files.

 

First, please disable Spybot's TeaTimer so it will not block anything we try to fix! How To Disable TeaTimer

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/ search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/ search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com

O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJfox000

O16 - DPF: {140F06F5-DDE8-3428-7169-2C910AE0DC3B} - http://85.255.113.214/1/gdnUS2338.exe
O16 - DPF: {357F80E7-2935-05DC-B182-4D3F7D5C4793} - http://85.255.113.214/1/gdnUS2338.exe

O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - E:\CDS300\__CDS2.dll (file missing)

Again, make sure ALL browser windows are closed when you click FIX.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

C:\Program Files\MyWebSearch ← Delete this whole folder if it exist!

C:\WINDOWS\System32\1024\ld632E.tmp

Next, run CCleaner to clean up cookies and temp files.

After you complete the above, REBOOT and proceed with the rest of this fix...

Next Reset Web Settings & Default Security Settings

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

I got most of this stuff finnished but these were the things I had trouble with.

Neither of those objects even exsisted when I looked for them. Anyway here is the new HJT log.

 

Looks good, are you having any further problems?

 

Panda Still says i have some malware.

 

Attach the log so I can see what it's picking up.

 

I will try as soon as possible its still scanning. Oh and its two hacking tools.

 

It may take longer than I thought because some thing stoped the scan from running. It will get done though.

 

Here is the new log from panda. 2 hacking tools and possibly some spyware from both.

 

I really need this done as soon as possible. I'm not trying to be rude but its been a whilee since I have gotten a response. Anyway I could use a lot of help to get this done. Thank you all who have and possibly are (God I hope so) going to help.

 

HealthCo,

I don't mind helping but just like everyone else you must be patient as we are all volunteer in this forum. We have real jobs and those come first so when we have free time we come here.

As far as the PM's, personally if someone PM's me about their thread it's the last one I get to because it's not fair to others for me to jump right to your thread and leave them for last. I started with my oldest threads and work to the newer ones.

 

As far as your Panda log goes, first run CCleaner and then the below.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

 

First off I would really like to apologize for rushing this. I know it volenteer work and I know it takes time. It's just that my sister has been very disappointed because she hasn't been able to use her computer and I really want to help her. So I really want to thank all of the help everyone has given me. I really do appriciate it and don't want anyone to think I'm impatient. But really, thank you.

Now after I have done this what will it do? Just for future reference.

 

It's ok this time

Did you perform my previous post? If so, what were the results?

 

Yes I did exactly what you told me and the keys were there. But then I ran regedit and found the keys and deleted them. I've scanned the computer about 13 time after and It couldnt find the registry keys any more. I don't know if thats bad but if you want me to run any other scans to see if they are there any more, then I will gladly do the scan. But when you wanted me to do the fixme.reg file thing, what exactly did it do?

 

The reg file should have deleted the registry entries, they could have been blocked or something may have went wrong.

Are you having any further malware problems?

 

Nope I don't think so but I may keep you posted on that. The only problems I guess Im having are teeth whiteners.

 

Glad things are running good, you can now delete and uninstall anything I had you run during this thread.

You should see this article on How to Protect yourself from malware!