Cannot use Spybot,system retore,etc,etc

bear7556 · Jun 20, 2009

Problem started about 1 week ago i found Spybot S&D would not run,i tried System Restore, also would not restore(i got to restore point,but couldn't go any further) I tried uninstalling S&D and re-installing, still wouldn't run. Also my PC would not Shut Down it keeps restarting. My web broswers (IE and Mozilla Firefox) sometimes open up different web sites from what i have clicked onto. I have tried downloading Malwarebytes, it installs but will not run. I have AVG 8.5, Ad-Aware Anniversary Edition and Sygate firewall.My system has- an AMD Athlon(tm)64-3000+ and i have XP-sp3. More problems seem to happen everyday, i would be grateful for any advice. thanks

bear7556 · Jun 21, 2009

could not run Malwarebytes or Combofix.

bear7556 · Jun 22, 2009

bear7556 said: ↑

Problem started about 1 week ago i found Spybot S&D would not run,i tried System Restore, also would not restore(i got to restore point,but couldn't go any further) I tried uninstalling S&D and re-installing, still wouldn't run. Also my PC would not Shut Down it keeps restarting. My web broswers (IE and Mozilla Firefox) sometimes open up different web sites from what i have clicked onto. I have tried downloading Malwarebytes, it installs but will not run. I have AVG 8.5, Ad-Aware Anniversary Edition and Sygate firewall.My system has- an AMD Athlon(tm)64-3000+ and i have XP-sp3. More problems seem to happen everyday, i would be grateful for any advice. thanks
Click to expand...

Ran Combofix(after renaming it), then i could run Malwarebytes,i have attached the following logs,when running Malwarebytes, AVG popped up with the following-
Trojan Horse Rootkit-Agent.DZ C:\Qoobox\Quarantine\C\Windows\System32\drivers\MSIVX----------------------
Trojan Horse Injector.EL C:\Qoobox\Quarantine\C\Windows\System32\MSIVXetoabp----------------------- Trojan Horse Injector.EL C:\Qoobox\Quarantine\C\Windows\System32
\MSIVXnspftf------------------------

Trojan Horse Injector.EL C\System Volume Infomation\_restore{75A7C-----------------}RP203A0060717.dll
Trojan Horse Injector.EL C\System Volume Infomation\_restore{75A7C-----------------}RP203A0060718.dll

TimW · Jun 23, 2009

Your MBAM log indicates that you didnt fix anything. If you did, please attach the log. And now that you were able to run it and combofix, you need to re-run MGTools so we have a new log. Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

bear7556 · Jun 24, 2009

i have attached 2 logs for MBAB as well MGlogs, my pc seems to be back to normal although i have not used system restore.exactly what have we picked up? i've read your 'how to protest yourself from malware guide' and added Spyware Blaster, is there anything else we could do,some of the family use 'myspace' is that a trusted site? Thanks alot for your advice.

TimW · Jun 25, 2009

Your logs are clean. Frankly, limewire is probably far more dangerous than MySpace. It really depends on how you use them and what you click on.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

bear7556 · Jun 26, 2009

TimW said: ↑

Your logs are clean. Frankly, limewire is probably far more dangerous than MySpace. It really depends on how you use them and what you click on.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

everthing seems to be ok. followed your instructions, unistalled combofix,deleted MGtools and toggled system restore.going through 'how to protect yourself from malware' now. These Guides are great for your average or not so average user.
Thanks for the advice and time you spent looking at our problem we appreciate it

TimW · Jun 28, 2009

You are most welcome....safe surfing.

Log in or Sign up

Cannot use Spybot,system retore,etc,etc

bear7556 Private E-2

bear7556 Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 06-21-2009 - 18-18-50.log

RRlog.txt

MGlogs.zip

bear7556 Private E-2

Attached Files:

ComboFix.txt

mbam-log-2009-06-22 (12-27-31).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

bear7556 Private E-2

Attached Files:

mbam-log-2009-06-22 (12-28-09).txt

mbam-log-2009-06-22 (23-03-44).txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

bear7556 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member