Did I get it all ?

Discussion in 'Malware Help (A Specialist Will Reply)' started by itsmeveve, Feb 6, 2008.

  1. itsmeveve

    itsmeveve Private E-2

    Hi,
    I have my grandsons computer here (he shares it with the other 4 kids in the house). I origianaly started trying to get out all of the P2P network sharing out of it. It had trojens and viruses in it but I think I have cleaned most of it out using the guide at http://forum.grisoft.cz/freeforum/read.php?4,27725,backpage=
    How To Clean An Infected Computer. How ever when all was said and done, teatimer was asking permission to change at start up ITtoolbar. I keep on denying it but I want to stop that from happening in the first place.
    Searching around I came accross the guide to use combo fix, I had used this before with the help of someone on a forum. So I thought that would maybe help me clean out little bits that got missed in my original clean up, or find something I missed.
    On this guide is where I found the link to Major Geeks. I clicked this one because I have been to your site before and found soulutions to problems in the past.

    On the combo fix guide it showed me how to make the Windows Recovery Console...... then it told me not to turn off the computer yet.......... and to post that txt file.

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
    C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

    Im not sure if you need the above file but im not sure if it is safe to shut the computer off or reboot it yet.

    I then came to your site and found the Windows cleaning page that you had and followed that. So attached will be the zip file from your program. Now I have the combo fix file here and not sure if you collected that with your program or if you want me to also post that one?

    Since im not sure if I can reboot yet then im not sure if everything is fixed or not.

    So this is where I stand.
    Thanks in advance for your help.
     

    Attached Files:

    itsmeveve, Feb 6, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    You are in pretty good shape as far as active malware is concerned. You do however still have a few left overs from all the P2P and Torrent downloaders. You should remove the below folders if you are still trying to get rid of all traces of these programs.

    C:\Documents and Settings\me\My Documents\Morpheus Shared
    C:\Program Files\BitComet
    C:\Program Files\BitLord
    C:\Program Files\Blubster
    C:\Program Files\Clickster
    C:\Program Files\Morpheus
    C:\Program Files\MorpheusBar

    Also you should do the below.

    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 6
    Java(TM) 6 Update 3
    RelevantKnowledge <-- should have been uninstalled in step 0 of the READ ME

    Make sure you reboot after uninstalling the above!

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    After reboot delete the below folder if it still exists
    C:\Program Files\Give4Free Plugin

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created.


    Make sure you tell me how things are working now!
     
    chaslang, Feb 7, 2008
    #2
  3. itsmeveve

    itsmeveve Private E-2

    I am so sorry about not getting the java thing done first. I did read it, something must have distracted me and I know how important it is to follow directions especialy when you are trying to help me.
    When I went into each user account to run CCleaner one of the accounts got blocked :

    windows security alert in Mickeys account:

    Ares Ultra p2p for windows
    Now is that something else that needs to come out? and yes I am still wanting to get rid of the p2p stuff also and thanks for that help.

    I had assumed that you only had to log on as administrator to run any of these fixes on the whole computer meaning all accounts. Is this not true? Becaue I noticed by signing into all accounts to run ccleaner that all of the accounts dont have AVG running updated on them. I installed AVG on my account (the only administrator account) thinking it was going to work on all accounts but you cant rely on the kids to update it.

    When I get done here I plan to go install K9 I am hoping that that will stop anymore of the p2p sharing being installed by the ever curious 13 year old. Unless you have a better suggestion?

    Any ways it did start up much better. Attached are the logs you asked for.


    Thanks for the help!
    Grandma :)
     

    Attached Files:

    itsmeveve, Feb 7, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I still see RelevantKnowledge in your uninstall list. Did you forget to uninstall it or is it not showing in Add/Remove programs?

    I also still see C:\Program Files\BitLord Did you miss this folder?

    Yes Ares is just another P2P program.

    Not true. Each user account has there own registry and some user specific folders. Thus some scans, like CCleaner and even MGtools would have to be run on each account to specifically find things related to that account.

    Yes there are steps mentioned in this sticky: How to Protect yourself from malware! Read it all but make special note of steps 9 and 10 .

    You appear to have stopped GetLogs.bat before it finished running. Run it again to get a new MGlogs.zip file to attach. See the snapshot on the download page for MGtools ( Using MGtools ) that shows you what it looks like when it is finished.
     
    chaslang, Feb 7, 2008
    #4
  5. itsmeveve

    itsmeveve Private E-2

    The problem is that I dont know the names to all of the p2p programs, I googled lots of the names that I was thought could be one and removed them that way one by one.

    Relevant Knowledge seems like it should be somethig educational to me. But I did find it in add and remove programs and went to remove it and got the message that it may have already been uninstalled and would I like to remove it from add and remove so I did.

    bitlord is not in add and remove programs but I do see the folder to it still
    Do I just remove the folder ?

    also Ares Ultra p2p for windows is not in add and remove programs. I also see this folder.

    While we are on the add and remove programs topic I see two things there that I wonder about they are "silvitask.zip" and "skullcur.zip" I am not use to seeing zips in there on my computer and wonder if this is ok or not?

    There is a folder called imesh, not sure if this is ok or not? I seem to remember reading something not so positive about that. This is also not in add and remove programs.

    Someone needs to write a program that searches your computer for p2p programs for those of us who dont know all of the names.

    there is something called "Cheat Engine" and "cs_package.zip" they look to me like some kind of network items.
    There is also a folder called filesubmit with DealiioKit1-stub-0.exe in it, also in this folder are folders called "silvitask.zip,skullcur.zip, skullsicoxp.exe,vstyle.zip" even though some have the .zip on them they are folders that are not zipped up.
    These items are not in add and remove programs. Just folders I see.

    This is all thats left that looks odd to me.

    Now if I go back and run MGTools on each account will each log over write each other? Should I run all of the things I have run on the admin account (cw shreader, rouge remover,adaware,avg spyware) over again on each account?

    Im not including a log since im not sure how to run it on seprate accounts and if it will over write each other so I wait on instructions.

    Thanks again for your help it is greatly appreciated. I didnt realize it was going to be so much.
     
    itsmeveve, Feb 8, 2008
    #5
  6. itsmeveve

    itsmeveve Private E-2

    Oppps I went back and read your post from earlier and just deleted the folder called bit lord............ sorry about that. I did think I went right down your list and deleted them but I must have missed that one
     
    itsmeveve, Feb 8, 2008
    #6
  7. itsmeveve

    itsmeveve Private E-2

    I went to read the page you sent me to and I do see imesh listed there so that question is now taken care of.......... its going
    I did have a password on my account on this computer as the page also says, but I was bad at choosing a password that would be easy for me to remember, and that was ok untill the 13 year old came along and figured it out, that is how he said he got most of this stuff on the computer ............. we have now changed the password about a month ago so we should be ok in that department now:)
     
    itsmeveve, Feb 8, 2008
    #7
  8. itsmeveve

    itsmeveve Private E-2

    Here is the latest MGlogs from the account that I have been using all along. I am not sure why the last one didnt work since I waited for it to say to press any key
     

    Attached Files:

    itsmeveve, Feb 8, 2008
    #8
  9. itsmeveve

    itsmeveve Private E-2

    I just found relevant knowlage again and follwed it to
    C:\QooBox\Quarantine\C\WINDOWS\system32
    its in the program files start up menu but If im not mistaken thats quarenteened by combofix?
     
    itsmeveve, Feb 8, 2008
    #9
  10. itsmeveve

    itsmeveve Private E-2

    Hello again and sorry for so many messages. I just went a different account to try to run MGTools on that account and got a lot of access is denied in the DOS window, then a pop up of HijackThis saying "For some reason your system denied write acccess to the hosts file. If any hijacked domains are in this file , HijackThis may NOT be able to fix this." then shows you how to edit the file yourself. Shall I go ahead and do the file fix ?
     
    itsmeveve, Feb 8, 2008
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You can delete it too.

    They could be somekind of Desktop Themes. Ask your grandson. If not needed or unknown, just uninstall them.

    Yes it is a P2P downloaded too. Delete the folder.

    Again speek to your grandson. These are probably things he installed for game cheats or just in general for gaming.


    Each time you run MGtools or just C:\MGtools\GetLogs.bat once it has already been installed, it inserts new logs into the C:\MGlogs.zip file if it already exists otherwise it creates a new MGlogs.zip file.

    Yes each account on the PC needs to be cleaned separately. You only need to run Ccleaner and then GetLogs.bat on the other accounts.
     
    chaslang, Feb 9, 2008
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! But did you take note of the other information that said things like:
    • make sure the Guest account is disabled
    • all users should have their own accounts
    • all user accounts must have passwords
    • kids and irresponsible adults ;) should be given Restricted User accounts not Adminstrator accounts.
    Yes that is from ComboFix and will be remove when we get to our final instructions after all your logs are clean.

    Just be aware that when you keep posting. It will take longer for you to get a response because you lose your place in the queue. See the sticky thread: Don't Bump! It Only Hurts You!!! It does not matter whether the bump is intentional or not. It has the same effect.

    This will happen when you run the tools on Restricted User accounts. The Windows XP cleaning procedure did have the below note right at the top of the procedure.

    The last MGlogs.zip file shows me something you seem to be doing that you MUST NOT do while cleaning. You appear to be using Switch User which will leave proceses for each user running in the background. You must only have one user account active at anytime to avoid potential issues and confusion while reading logs. For example, the HijackThis process list shows the below which really looks strange (like malware). Notice 6 winlogon.exe processes, 7 Ati2evxx.exe processes, and 2 Cli.exe processes.
    However, the logs for this last user account are clean.
     
    chaslang, Feb 9, 2008
    #12
  13. itsmeveve

    itsmeveve Private E-2

    Oh yes I went to all of the computers around here and diabled the guest accounts.

    All users did have passwords when I started out I took them out to make it easier for me to jump from one account to the other without having the extra step of putting passwords in

    Only one account on the computer has the admin, the rest of the accounts are limited.

    Ok, I didnt realize bumping ment the same thing when you have already been being helped vs waiting for help to arrive, I will watch myself from here on out. I am typing this in note pad first so that I dont do that same thing again.


    As for the strange (like Malware) items they are listed with ATI Technologies that was the video card not sure if malware can be connected to that or not ......... well I gues it could be.

    Ares Ultra has been deleted ... imesh also deleted.

    I will ask grandson about the other programs .......... I more or less didnt know if they were more p2p items or not.

    My next step is to make all users admin accounts.And I did not reallize that I need to only be logged on to one account at a time and will correct this from here on out. Then run ccleaner on each account and also run GetLogs.bat and attach them.

    Attached are the logs from each seprate account on the computer. I ran ccleaner on each account then getlogs.bat right after , also logged on to only one account at a time in admin mode.

    P.S. There are 3 more logs from users accounts on this computer and so I dont bump myself I will wait till the next post to attach them.
     

    Attached Files:

    itsmeveve, Feb 10, 2008
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I will put the instructions for each user into a quote box

    Dorian's account:


    On Hailey's account:
    On Matt's account:
     
    chaslang, Feb 11, 2008
    #14
  15. itsmeveve

    itsmeveve Private E-2

    Ok, I have done the above to the three accounts.....that was easy!

    Attached are the next and last 3 accounts.

    Thanks again for your help :)
     

    Attached Files:

    itsmeveve, Feb 11, 2008
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You said Mickey for the first ZIP file. That is actually the user account named Mitchell. So for this account do the below.
    For Mikaila:
    The last account you called Mitchell is actually Mitchell_2 and it is clean as is.

    We should be finished now I assume.

    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN
      • Now type combofix /u in the runbox and click OK.
      • Note: The space between the X and the /U, it must be there.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.
    9. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    10. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    11. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    12. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    13. After doing the above, you should work thru the below link:
     
    chaslang, Feb 12, 2008
    #16
  17. itsmeveve

    itsmeveve Private E-2

    Ok I have done all of the above steps and am now working on "How to Protect yourself from malware! " page. I let AVG Anti Spyware run this morning and it found Downloader.Wimad.m and put that in quarantine.
     
    itsmeveve, Feb 12, 2008
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You should not have run anything until completing my final steps as all AVG AS may have found were things we quarantine or things in System Restore.
     
    chaslang, Feb 13, 2008
    #18
  19. itsmeveve

    itsmeveve Private E-2

    Oh im sorry for not being more clear, it wasnt untill after I did a restart after turning system restore back on, and I thought that I was done with your instructions, that I ran AVG

    It was actualy found in
    C:\Documents and settings\me\My Documents\through the fire and lames.wm
     
    Last edited: Feb 13, 2008
    itsmeveve, Feb 13, 2008
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay that may be a false positive since I assume that is something either you downloaded or created.
     
    chaslang, Feb 14, 2008
    #20

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds