After smitfraud

You did not run this READ & RUN ME FIRST Before Asking for Support as requested in the procedure you ran! It stated that this must be run before attaching a HijackThis log! You need to run it. You more than likely have a load of things remaining including PurityScan infections.

 

Yes I know! But you also attached a HijackThis log and the special removal procedure clearly states this:

You are still infected and you need to follow all of the directions in the READ & RUN ME and then attach the six logs that are requested in the READ ME. The procedure must be followed in the order written. Some of the items you show as disabled in your Spybot log are related to Virtumonde and it typically can put a load of other files on your system.

 

You have a PurityScan infection. Please run ComboFix as indicated below.

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

You just need to allow it to run thru to completion. Based on your ShowNew log, I can see you did not allow GetRunKey to finish running. That is not a message that causes the program not to work. It is an intermediate message about a particular key that does not exist. The program just continues after that. Run it again and wait for it to finish. Then attach the log.


Do you or did you play games (maybe Maple Story) on this PC? I see the below file which is considered a rootkit install for game guard.

C:\WINDOWS\system32\drivers\dump_wmimmc.sys

I also see the below files that have todays date. Do you know what they are from?

Code:

"C:\WINDOWS\system32\drivers\"
km1885~1.u2k  21 Apr 2007          64  "kmxcfg.u2k4"
km1895~1.u2k  21 Apr 2007          64  "kmxcfg.u2k5"
km18a5~1.u2k  21 Apr 2007          64  "kmxcfg.u2k6"
km18b5~1.u2k  21 Apr 2007          64  "kmxcfg.u2k7"
kmxcfg~1.u2k  21 Apr 2007      178962  "kmxcfg.u2k0"
kmxcfg~2.u2k  21 Apr 2007          64  "kmxcfg.u2k1"
kmxcfg~3.u2k  21 Apr 2007          64  "kmxcfg.u2k2"
kmxcfg~4.u2k  21 Apr 2007          64  "kmxcfg.u2k3"

Now make sure you attach the below logs when you come back:

• ComboFix
• GetRunKey
• a new log from ShowNew

 

Please put the below files into a ZIP file and attach the ZIP to your next message.

Code:

 "C:\WINDOWS\system32\drivers\"
km1885~1.u2k  22 Apr 2007          64  "kmxcfg.u2k4"
km1895~1.u2k  22 Apr 2007          64  "kmxcfg.u2k5"
km18a5~1.u2k  22 Apr 2007          64  "kmxcfg.u2k6"
km18b5~1.u2k  22 Apr 2007          64  "kmxcfg.u2k7"
kmxcfg~1.u2k  22 Apr 2007      248984  "kmxcfg.u2k0"
kmxcfg~2.u2k  22 Apr 2007          64  "kmxcfg.u2k1"
kmxcfg~3.u2k  22 Apr 2007          64  "kmxcfg.u2k2"
kmxcfg~4.u2k  22 Apr 2007          64  "kmxcfg.u2k3"

Uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders which may be left behind by the uninstall:
C:\Documents and Settings\All Users\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software

Continue by downloading a tool we will need - Pocket KillBox

Save it to its own folder somewhere that you will be able to locate it later.

Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
• Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\catchme.exe
C:\WINDOWS\GPInstall.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But if you do get this message, please let me know!)

If Killbox does not reboot just reboot your PC yourself.
After reboot locate the below folder and delete if found:
C:\Program Files\PopAdStop

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

 

Yes that is what they look like! Some one should smack them in the head for naming files like that. They should know better in this day and age. Those look just like malware.

Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you run Avenger, you can delete all files related to Avenger now.
7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
8. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
9. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

yes you hard disk only had the below available in your log from ShowNew:

Code:

               2 Dir(s)     567,775,232 bytes free

That is not enough free space to properly run Windows. You need to cleanup whatever is hogging all of your diskspace or you need to get a larger hardisk.

But as you suggested, this is not an issue for this forum. You can try the Software (or Hardware) Forum but before doing that, you really need to first free up a lot diskspace. How large is your hard disk?

 

Thanks for the follow up! Surf safely!

 

According to more than thirty scanning tools there is nothing wrong with x.exe. It seems have something to do with compressed java scripts.

Did you delete them?

Are you having malware type problems? Have your GetRunKey, ShowNew, or HJT logs changed from what was last posted?

Have you downloaded or installed anything else since your last logs were posted?

These may not be a topic for the malware forum. Your last logs showed that you are running WinXP. Try using tools that are not doing scans online. Take a look at all the tools available for download in the below file system folders:

http://www.majorgeeks.com/downloads9.html

http://www.majorgeeks.com/downloads7.html


As far as CAetrust issues, try uninstalling the program, rebooting (don't skip) and then reinstalling.

Try the same for Sun Java!

 

Just delete them!

Did you also download and install PC MightyMax which CounterSpy has been fixing?

The logs you attached are all clean!

Are you having any malware issues?

 

Do yourself a big favor, never download any tools online. Download from Major Geeks to be sure that you are not getting a rogue tool or a piece of garbage. Many download sites do not test their downloads (even though some say they do). They wait until people complain about infected downloads. And then some sites remove them and some sites (the ones that make try to make money from infecting you) do not remove them.

You're welcome. Surf safely!