Cannot install cleaner programs - help

Discussion in 'Malware Help (A Specialist Will Reply)' started by drthunder, Aug 25, 2009.

  1. drthunder

    drthunder Private E-2

    I am having numerous issues with my computer that I suspect are due to a virus/malware. Here are the symptoms:
    - I can only boot in safe mode (normal startup will freeze within 1 min of logon)
    - I cannot install new programs
    - System Restore does not work
    - Anti-virus (AntiVir) will not start
    - google links are sometimes hijacked to other websites
    - SuperAntiSpyware will not install (even when changing name to sas.exe)
    - Malwarebytes installation hangs on the last step and will not run
    - Combofix will not run (nothing happens when I run the program)

    RootRepeal and MGtools worked, so I attached the logs.

    The problem started when I was browsing the internet, and AntiVir said it found a virus. On the next reboot (the next day), I could no longer boot normally. I appreciate any help you can give me. Thanks.
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do this first:

    Please double-click the RootRepeal.exe previously downloaded.

    * Select File then Scan
    * On the Select Drives form select drive [ insert drive infected here ] by "ticking" the box for drive [insert drive here] and click OK
    * When the scan is complete - highlight each of the following file(s) (one at a time if more then one is listed) by left clicking it. Then use right mouse click and select the Wipe File option only for each file.
    C:\WINDOWS\system32\UACecenecwhjs.dll
    C:\WINDOWS\system32\uacinit.dll
    C:\WINDOWS\system32\UAClxruusabxn.dll
    C:\WINDOWS\system32\UACnsscnxdcbn.dll
    C:\WINDOWS\system32\UACroutxivbhd.dat
    C:\WINDOWS\system32\UACtdxcnlqape.db
    C:\WINDOWS\system32\UACycffypeqts.dll
    C:\WINDOWS\Temp\UAC4987.tmp
    C:\WINDOWS\Temp\UAC544a.tmp
    C:\WINDOWS\Temp\UAC54f6.tmp
    C:\WINDOWS\Temp\UAC5728.tmp
    C:\WINDOWS\Temp\UACfbfc.tmp
    C:\WINDOWS\system32\drivers\UACdbgqpdlidb.sys
    C:\Documents and Settings\Michael\Local Settings\temp\UAC5f5e.tmp
    * After Wiping all files, immediately reboot your pc!

    After reboot, download/install/update and run the scanning tools you couldn't run!

    Attach those logs.

    Then lets see a new MGLogs. run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * RootRepeal log
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  3. drthunder

    drthunder Private E-2

    I followed the instructions and everything appears to be OK now. I can boot normally and programs will install. I ran the cleaning programs and attached the logs. Thank you very much for your help.
     

    Attached Files:

  4. drthunder

    drthunder Private E-2

    MGlogs
     

    Attached Files:

  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It looks like the scans took care of most of it. Lets just do this.

    Please Disable Spybot's TeaTimer

    * Run Spybot and click Mode
    * Select Advanced Mode.
    * Then click Tools and select Resident.
    * Now in the right window pane, uncheck TeaTimer.
    * Also while this is open, in the left column now select IE Tweaks
    * and then in the right pane make sure all the Miscellaneous locks are unchecked.
    * Now quit Spybot!

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now use windows explorer to find and delete:
    C:\WINDOWS\system32\UACtdxcnlqape.db

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  6. drthunder

    drthunder Private E-2

    I completed the steps, and everything still seems to be working fine. Thanks again.
     

    Attached Files:

  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean. I am going to give you the final instructions, but it appears as though you have already removed Combo.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore ato create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds