Done the Read first and still have trouble

Welcome to Major Geeks!

You need to attach the other logs that we requested from SUPERAntiSpyware, Malwarebytes, and ComboFix. Also please remain in one thread.

You also need to tell us what malwar problems you are having.

 

Per the initial instructions in the READ & RUN ME, you must only have one antivirus installed. You need to immediately uninstall either Avast or AVG and then reboot before going any further.


What are the below folders for?
2009-04-18 22:55 . 2009-04-19 01:53 -------- d-----w C:\grrr
2009-04-11 16:19 . 2009-04-17 11:25 -------- d-----w C:\eeek
2009-03-22 02:41 . 2009-03-29 18:02 -------- d-----w C:\000
2009-03-26 01:56 . 2009-03-26 02:13 -------- d-----w C:\moi

Is the recently installed Spyware Doctor a paid version or is it just a trial that does not remove malware? If just a trial, uninstall it now.


I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing.


Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 6
Mozilla Firefox (2.0.0.6)

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

We don't recommend putting anything in the Trusted Zone. Thus unless you are positive that you really have to have the below in your TZ to use this sites, you should remove this too.
O15 - Trusted Zone: http://www.bond-works.com
O15 - Trusted Zone: http://www.bondworks.ca
O15 - Trusted Zone: http://www.build-works.com
O15 - Trusted Zone: *.hkmbbonds.com
O15 - Trusted Zone: http://*.jdimibonds.com
O15 - Trusted Zone: http://www.mmbonds.com

After clicking Fix, exit HJT.


Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Also download and install the current version of Mozilla FireFox


Also delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\HP_Administrator\Local Settings\Temp

Now run Ccleaner to clean out only temp files and nothing else!

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


Now attach the below log:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You did not answer my questions and you did not fix the below:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O15 - Trusted Zone: http://www.bond-works.com
O15 - Trusted Zone: http://www.bondworks.ca
O15 - Trusted Zone: http://www.build-works.com
O15 - Trusted Zone: http://*.jdimibonds.com

I can only address the PC that you posted logs for. If you have other infected PCs, you will have to clean them as well. If you are getting hacked from outside, then you need to get better protection and you need to change your passwords.


This current PC is clean other than the above and the things I questioned.