Having trouble removing malware...help!!

Discussion in 'Malware Help (A Specialist Will Reply)' started by stoogest, Jun 24, 2009.

  1. stoogest

    stoogest Private E-2

    Hi all,

    I have gone through the process suggested in the READ ME.

    SuperAntiSpyware - could not get it to install
    MalwareBytes - got blue screen of death during install
    ComboFix - could not get it to run

    RootRepeal and MGTools worked ok. Here are the logs:

    Thanks in advance!
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Why am I not seeing any AV protection software on this system?

    Please double-click the RootRepeal.exe previously downloaded.

    When the scan is complete - highlight each of the following file(s) (one at a time if more then one is listed) by left clicking it. Then use right mouse click and select the Wipe File option only for each file.
    C:\Windows\System32\MSIVXcnoctskwaoraxuayywtvriwrumteuapo.dll
    C:\Windows\System32\MSIVXcount
    C:\Windows\System32\MSIVXpoloxmdyxkrfqxuthnldxbbrdcbqvrwo.dll
    C:\Windows\System32\drivers\MSIVXejscqmgtbidvttuosxbccepiebvwxhkq.sys
    After Wiping all files, immediately reboot your pc!

    After reboot, please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    Now download and install an AV program!

    Now see if you cant run the scans that you previously could not. Attach the logs if you can.

    Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  3. stoogest

    stoogest Private E-2

    Hi Tim,

    I had disabled my AV software prior to the scans.

    Thankyou so much for the help, everything appears to be working perfectly now!

    Here are the logs:
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Since you downloaded these:
    2009-06-26 08:50 c:\programdata\Avira
    2009-06-23 10:15 c:\programdata\avg8 <---- I suggest you delete this one.

    SAS removed this:
    D:\DOCUMENTS AND SETTINGS\ANDREW\MY DOCUMENTS\MY DOWNLOADS\MEDIA MONKEY\MEDIAMONKEY V2.5.5.998\MEDIAMONKEY V2.5.5.998\CRACK ALL\KEYGEN.EXE

    So you might want to read this:
    Warning about Porn, Keygens, Cracks, and other Illegal Software

    Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
  5. stoogest

    stoogest Private E-2

    Will do. Thanks again!
     
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are welcome...safe surfing.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds