Do I have any malware? (1)

davidm_uk · Feb 6, 2011

This is a follow on post to my thread:

http://forums.majorgeeks.com/showthread.php?t=232166

where I was trying to resolve a slow boot problem with XP(sp3).

A summary of what I did as the result of advice from that thread is:

Now got to a more reasonable boot time of 65 seconds!

In case it's of use to anyone else this is what I did -

Restored C from old image, where boot time was nearly 4 minutes.
Uninstalled Zone Alarm (plus ran their clean up program cpes_clean.exe), Avast and Genie Timeline.
Check in Autoruns for any residual entries (none), removed a couple of entries related to programs no longer installed.
Run CCleaner to clean out "temp" files etc and clean registry (used CC settings described by Satrow earlier in this thread).
Run Sysinternals pagedefrag.
Run Bootvis repair.
Run Puran Defrag (boot defrag).
Run Bootvis - boot time now reported as 52 seconds.
Created new disk image of C in case I need to go back to it.
Installed Comodo free firewall (in place of Zone Alarm).
Installed Avast.
Run Bootvis - boot time now reported as 65 seconds.

Having done all of this, when I next used the PC the boot time had gone back up to 124 seconds, so I wondered if there may be some malware hiding in the system and was advised to follow the instructions in the "READ & RUN ME FIRST. Malware Removal Guide" in this group, which I've done. There was no obvious malware found and boot time was pulled back to 68 seconds (as measured with Bootvis), but I'd be grateful is someone could have a quick scan of the logs to see if there's anything I didn't spot.

System is Evesham Micros PC, P4 cpu, 1Gb RAM, 2 x internal HDD, 1 x usb HDD, one Lacie NAS HDD, running XP SP3, with Comodo (free) firewall and Avast (free) antivirus.

Post is in two parts, with remainder of logs in second part.

Follow on post with MGTools log

davidm_uk · Feb 6, 2011

Do I have any malware? (2)

Follow on from previous post

Kestrel13! · Feb 6, 2011

Hmm I cannot open any of your attachments except for one. I am going to delete them all and then you must follow the instructions in the link I will provide below on how to correctly attach items to your posts.

HOW TO: Attach Items To Your Post

davidm_uk · Feb 6, 2011

hmm, dunno why that happened, did it the same way for all logs. here goes again for the first 4:

Kestrel13! · Feb 6, 2011

Much better. Once you have attached the remaining log C:\MGLogs.zip then I can make a start on reviewing them all. (Or it may not let you attach the Mglogs.zip again I THINK I can view it let me check)

Kestrel13! · Feb 6, 2011

Not seeing any malware. Just a little more we can do to wrap up.

ParetoLogic PC Health Advisor <--- Uninstall this garbage.

Now we need to use ComboFix

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

If ComboFix tells you it needs to update to a new version, make sure you allow it to update.

Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
Code:
KILLALL::

SecCenter::
{7591DB91-41F0-48A3-B128-1A293FD8233D}
{41564737-3200-1071-989B-0000E87B4FB1}
{829BDA32-94B3-44F4-8446-F8FCFF809F8B}
RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOSAFEERASE02.00.00.01MSWINDOWS"="DDD8ED1356242765E9A081A0C358F2E425486FB7937321F4458894BD2B02DC3B777D2E4302B0F7B182C6FE1664F5FBFBB7B4C5E48DC405D3B289806E16D97009E8477F47A30A53840E09CB2E792D4FE4BFF95C67C8972A2C89CD98B660183977B2CFAB5CA398A0C961062F2DCEBAE0678957182F94942F3DABD3FE4F03F924DF6BFA34243D48BA16E71E26BE0758966D72CF920F97EC286A8D608AD4C53E13C0BA6AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667C038D530D6EB3452A2D97226D213B555A6A0AC4980AC793307DF501F621E64417CEAB08F0AA5FE3D7EFECAE9F95383769F36C2E242F409B00C3339808473DDD21010F629609259F9E662E1AF30357C96E04A4B04933EE41ADC9C82E1CBF487B5858C409E6C02452DEBF35DF6537C4AAB66A3DDFC7702C13E49464989835D4EC66B53CEC8C4CA6491F89144C967B7E2F5952768A7802509FBD6C000426B0EB1A105BEBB8378E3EBA8ADFCF233E89750740EA0AAE037343AF4C0FE6BD9380BC7ABC78AF0AC886C2436DEDA1AC343F1AF6C1EBD398B15DC6A9072D6A622917AB68CDE55AB29E7A2ECC11235BC13DA4235674B91FC0C09F2BE778E861EF3132ABBAD29268060026DB49804F9B1B683A42633CE91344DF66D7398EAAB15294E08A7BF386455BE32D58249A478274C885C5D609318EDBC36665827904A1F9F452ADD35535CE5B24B87EE2996E79A7428CE48C33BE48FCA121DCF17BC49A83BF0C65645F33E3FB090D3A7CF32E1E0D313846AF61A1952ED47745223E0746D613EBA1E6ACA9E45B03B306D1A01E2A193712ED857B8BBC2A00B73694BA3FA01FD8B06D6E438F5AFADF934962845CBD760DA1C3E05D2B741DE83C435CEDD70C7FDADCB3238D4200826EA1E0BDC7063D4E95FC359E5DA59022C4B3769371DCBFAD56D5478A9E85F2C21264EC8E0ABD23BE500BF7C2473550F0D733ECC4C226A2AFB848B884674D5512233C9DF2251A5838BB34E8C2BF541458A7C703B1C6388B66A2601505DA80DFB378F3A784EF0CFF8996350052CEE1754B3DF89A2798B4B559F736955FEEDF10970ABEAC85B4F26BB4F6D4C749E1EB5421A0666097BF4BA909E869B2F065DD2A5616C4D2180E1E0BE71A3EB7C38F95FE5D1CF8B827AB3C046EDE9140B8BC5E6D420AB77DF39D69E4A48CC7DD37928BAED761020BB168D2E28189EF2A8EF2AC36DC836A1FA478ADFFAA22273C42187D15A248C6E74AFF9B5BAAC987C5BD441681BFB4C27FC2E938BBFCDD1E12C352813807D02647E6DA7EDD9BC3F178DA2F3345B5DA40B03B537E8DCA1FE84FDFE4DD088A71F17C2B979D3B260EED03983E1EA0213E571BCE9F126E9733EB7400C7143EE4C85BBBCC202C5C63278D66FE75EB435CAAFA2"
Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

davidm_uk · Feb 7, 2011

Re shutting down Comodo firewall is it sufficient to just right click on the system tray icon and set each of Firewall security level, Defence+ security level and Sandbox security level to disable, then reboot or do I have to:

With both Avast and Comodo, use autoruns to disable (not delete) all the entries related to each (I can't see any other way of disabling Avast, I can turn off the real time shields, but there's still some Avast services running).

Suppose I can uninstall them (yet again) but they still seem to leave stuff behind.

davidm_uk · Feb 7, 2011

BTW, meant to ask - what is the above (ComboFix + script) doing? Just like to know!

Kestrel13! · Feb 7, 2011

Re shutting down Comodo firewall is it sufficient to just right click on the system tray icon and set each of Firewall security level, Defence+ security level and Sandbox security level to disable
Click to expand...

Well your firewall still showed as active in the last combofix log, but do not worry about it now.

Avast showed as disabled. But according to your logs it is not installed.

BTW, meant to ask - what is the above (ComboFix + script) doing? Just like to know!
Click to expand...

Well, there were remnants from avg avast and zone alarm, that would have still been detected in the Windows Security Centre. So I removed them.

You going to attach the combofix log?

davidm_uk · Feb 8, 2011

OK, so here's the new ComboFix log

ComboFix flagged that it thought AVG was running (I changed from AVG to Avast a year or so ago and thought I'd gotten rid of it), but nothing listed under services.msc, so I just let CF carry on.

Kestrel13! · Feb 8, 2011

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

davidm_uk · Feb 9, 2011

Thanks for your help Kestrel13!

All seems to be running fine now (dare I say!).

Kestrel13! · Feb 9, 2011

Glad to hear it.

Log in or Sign up

Do I have any malware? (1)

davidm_uk Private E-2

davidm_uk Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

davidm_uk Private E-2

Attached Files:

SASlog.txt

mbam-log.txt

ComboFix log.txt

RRlog.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

davidm_uk Private E-2

davidm_uk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

davidm_uk Private E-2

Attached Files:

ComboFix.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

davidm_uk Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member