Followed Chaslang Procedure

5uper · May 16, 2011

MY hotmail email acct. was hacked into a couple days ago and an email was sent to everyone in my contacts list. It did not seem to be mailicious, it sent advertisements like growing hair, male enhancement, and ads about certain medicines, etc..

Also, there have been other times when the pc just shuts down for no apparent reason when on either a webpage or in Hotmail. this issue has lasted for about 4 months and had gotten progressively worse

Avast found 14 viruses: java:agent-fp (many other permutations to this one were found)> I think it is a trojan. svchost.exe, and at least one 'decomprssion bomb'.

Please look over these logs and let me know if you think my system is clean or suggest what I need to do next.

Combofix and MBtools gave me a report log (attached). Superantispyware did not find anything and/or did not produce a report. (or I cannot find it to send). Malwarebytes also didn't find anything nor produce a report? RootRepeal hung up and never completed its' scan.

CCleaner looked like it cleared out the most from the scans that were performed.

Kestrel13! · May 16, 2011

You are going to have to attach the C:\MGlogs.zip from running C:\MGTools.exe as it contains alot of information useful for analysis.

5uper · May 16, 2011

Can you please tell me where this file is? I've searched and cannot locate it. I did run this tool though.

5uper · May 16, 2011

here it is...

Kestrel13! · May 17, 2011

SpeedingUpMyPC v2.2 <--- Uninstall this.

C:\Users\Austin\AppData\Roaming\RegistryKeys <--- What is inside of this folder?

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run

Please attach:

C:\Users\Austin\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\SUPERAntiSpyware Scan Log - 05-14-2011 - 23-39-12.log

C:\Users\Austin\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\SUPERAntiSpyware Scan Log - 05-15-2011 - 21-17-54.log

C:\Users\Austin\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2011-05-15 (09-40-57).txt

C:\Users\Austin\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2011-05-15 (19-37-06).txt

Tell me what malware problems remain.

5uper · May 18, 2011

Uninstalled SpeedUp... (this was an ad on majorgeeks, btw). Thought I was following the process until I hit the "pay for it" screen!

Inside the Registry Keys folder is a folder called "Exception". Inside the Exception folder is empty.

I ran TDSSKiller but it didn't find anything.

I've attached the logs as well. Will send one more reply with remaining attachments.

Today, when on a webpage, the computer screen went black and then a blue screen flashes and says something like - "You're in danger of losing data". Then it asks for how do you want to start up - In safe mode, normal, or safe mode pluse something else. If you don't select anything it starts up again by itself. My wife thinks this is the fabled "blue screen of death". This happens almost daily.

5uper · May 18, 2011

Here are the other 2 requested files...Oops! I guess I don't have any other files to give? When I try to send the file: C:\Users\Austin\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2011-05-15 (19-37-06).txt
The attachment manager says I've already sent this file and it doesn't let me attach it.

I'll need some guidance on where to find the TDSSKiller log. I searched on it and only the app comes up on the search.

Thanks for your help!

Kestrel13! · May 18, 2011

You can delete the
C:\Users\Austin\AppData\Roaming\RegistryKeys folder. Also if you check the instructions for running TDSSKiller they tell you where to find the log. If you cannot find it then you will have to do the below:

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

5uper · May 18, 2011

Here is the TDSSKiller log...

Kestrel13! · May 18, 2011

You forgot this part again:

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this

5uper · May 19, 2011

here you go...

Kestrel13! · May 19, 2011

Run Ccleaner.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

5uper · May 20, 2011

Thank you Kestrel13!

I hope this does the trick. I haven't experienced any propblems today. Hope it stays that way.

I appreciate the help.

One question I do have is about my external harddrive. I'm thinking of switching over to a Mac, and want to be sure I don't move a virus that has found it's way here onto a new machine. Is there anything I need to be worried about?

I did an Enable System Restore on both my C and F (external hd) and created a new restore point for both. Should I have done this?

Thanks again for the advice.

Kestrel13! · May 20, 2011

Yes you should be just fine.

For the external Hard Drive and a USB stick.

Insert your flash drive before we begin. Hold down the Shift key when inserting the flash drive until Windows detects it to bypass the autorun feature. This will keep the autorun.inf from executing automatically.

Please have all your removable storage devices ready for disinfection.

Download Flash Disinfector by sUBs and save it to your desktop.

Double-click Flash_Disinfector.exe to run it.

Your desktop and icons may disappear. This is normal.

It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.

Follow any prompts that may appear.

The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.

Wait until it has finished scanning and then exit the program.

There will be no GUI interface or log file produced.

Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection.

Log in or Sign up

Followed Chaslang Procedure

5uper Private E-2

Attached Files:

mbam-log-2011-05-15 (19-37-06).txt

combofixlog.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

5uper Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

Attached Files:

mbam-log-2011-05-15 (09-40-57).txt

SUPERAntiSpyware Scan Log - 05-14-2011 - 23-39-12.log

SUPERAntiSpyware Scan Log - 05-15-2011 - 21-17-54.log

5uper Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

Attached Files:

TDSSKiller.2.5.1.0_17.05.2011_21.21.29_log.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Followed Chaslang Procedure

5uper Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

5uper Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

Attached Files:

5uper Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

5uper Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches