another malware infection!

Welcome to Major Geeks!

Your logs are clean. You may not be having malware problems

This may just be due to McAfee. Unless you stop McAfee from running it can prevent you from being able to run ComboFix properly thru to completion.

Did you check to see what new tasks/processes load when you close all of your browsers?


Attach the below two logs which are more important than the ones you already attached

Code:

"C:\Documents and Settings\admin\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\"
2009-06-01        1797  "SUPERAntiSpyware Scan Log - 06-01-2009 - 12-31-32.log"
 
"C:\Documents and Settings\admin\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\"
2009-05-31        3549  "mbam-log-2009-05-31 (21-47-55).txt"

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.


Delete the below file:
C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job


Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Also how long did you wait? I have seen it take up to 15 or 20 minutes before ComboFix even pops up a blue command prompt type window to start running its scan.

Did you shutdown WinPatrol, Ad-Aware and CounterSpy too? ALL protection software must be shutdown or uninstalled before running ComboFix. It may be a good idea for you to uninstall Ad-Aware, McAfee, WinPatrol, and definitely CounterSpy as stated below to make sure that:

1. They are not interferring with running ComboFix
2. They are not responsible for any of your problems
3. Ad-Aware is not effective enough to waste resources on it anyway

After uninstalling everything, redownloaded the current version of ComboFix and leave it named combofix.exe and save it to your Desktop

Unless you give us a log, this info is not helpful since it could just be things we have already removed and/or that are in quarantines or system restore and those would not be issues. Did you purchase CounterSpy? If not, uninstall and please follow the instructions given in the READ & RUN ME which state not to do anything unless we ask you to.


Now download HostsXpert and then follow the below steps.

• Unzip HostsXpert.zip
• It will create a folder named HostsXpert in whatever folder you extract it to.
• Run HostsXpert.exe by double clicking on it.
• Click the Make Writeable? button. (if you only see a Make Read-Only selection, it is already writeable so skip this button).
• Click Restore Microsoft's Hosts File and then click OK.
• Click the X to exit the program

Uninstall the below old versions of software:
Java(TM) 6 Update 4


Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now install the current version of Sun Java from: Sun Java Runtime Environment
Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You did not directly address part of my question which was the below

I have another fix for your to run to remove some additional problems that are starting to show up. Make sure that you shutdown CounterSpy and McAfee before doing the below.

• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now make sure you update these programs first and then run full scans with SUPERAntiSpyware and Malwarebytes. Fix what they find and save logs.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\avenger.txt
• the SUPERAntiSpyware log
• the Malwarebytes log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You're welcome. We have another fix to run on this PC which I will give down below.

Only via PayPal if you wish.

Yes. You should run the cleaning procedure on each PC. Each belongs in its own thread. Be sure to state it is another PC (like PC2, PC3, & PC4) to avoid having anyone think it is related to PC1 in this thread.

Now let's continue with this current PC.

• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Just an additional item related to what we have been removing. As we slowly removed each layer of the onion, more items were able to show. As long as this gxsx.... key no longer shows after a reboot and another scan, then you are okay.

Obviously Avenger being detected is a false positive. And anything in System Restore will be removed when you complete my final instructions below.

Since your logs are clean and if you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combofix folder from combofix (if it exists)
4. If we had you run Avenger, you can delete all files related to Avenger now.
5. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
8. Go to add/remove programs and uninstall HijackThis.
9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
10. If you are running Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

You will find that no antivirus program provides perfect or even near perfect protection. They are far from it. That is why the How to protect yourself thread is giving you multiple layers of protection which is necessary. However no protection solution will protect you from yourself which is also emphasized in that link. If you like McAfee and don't mind the performance hit nor mind paying for it each year then stick with. But in reality, the free multi-layered protection along with smarter surfing are quite sufficient.

 

They are not problems. They are false detections by SUPERAntiSpyware. Those are left overs from ComboFix. You can simply delete the C:\32788R22FWJFW folder if it still exists and look in the C:\windows folder for pev.exe and nircmd.exe and delete them if found. After deleting that folder and the files:

• Empty your Recycle Bin
• And toggle System Restore again.