Help,malware removal

dodgetruck · Dec 28, 2012

hiya,I think I have the superfish virus on my computer.It runs windows xp professional,32 bit. SP3 Build 2006.It has American Megatrends processor 1470mhz and one gig of memory.I do not know a lot about computers but I have managed to read your forums and on your support page I have followed all the steps required to try to get rid of the malware.The page says if,after doing these steps,malware is detected to post a thread to yourselves.I have added the results of these scans for you to look at.Also among the steps was a MBR check.The result was SHAA38B874B7713D1B51CBC449F4EF809BODEC644A.I have no idea whatsoever what this means.If you can help me I would appreciate it.

chaslang · Dec 28, 2012

Welcome to Major Geeks!

You need to attach the requested logs from Malwarebytes and MGtools. The below is a repeat of the instructions

Step 3: Do You Still Have Problems

Yes, I’m still having problems

DO NOT run the READ ME again!!!! And DO NOT move on to Step 4 below!!! Please just attach your logs as given below and tell us what problems you are still having.

If you do not already have a thread started, start a new thread otherwise post the following in your original thread. Clearly describe in detail the problems you are having and how long ago they started. Think about what you were doing at the time.

Now you need to attach (See: HOW TO: Attach Items To Your Post ) ( Or View: How to Attach Items to Your Posts) the below logs created while running the above scans

RKreport[1].txt log from RogueKiller.

Malwarebytes Anti-Malware log

TDSSKiller log
[*]HitmanPro log
[*]MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.

Click to expand...

dodgetruck · Dec 30, 2012

Hiya,I hope Ive got it right this time.At the moment I dont seem to be having problems.I did have a tool bar at the bottom of my screen that continually suggested comparable websites and slowing internet explorer down so much it would eventualy stop.It only affected interet browsing.All the family use this computer and the virus appeared about two weeks ago,where from Ive no idea.Thank you for your help so far.

chaslang · Dec 30, 2012

Uninstall the below software:
Ask Toolbar
Inbox Toolbar
Yontoo Layers 1.10.01

Please download OTM by Old Timer and save it to your Desktop.

Right-click OTM.exe and select Run as administrator to run it.
Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
(or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
the code box

Code:

:Processes
explorer.exe

:Files
C:\Documents and Settings\chevy truck\Local Settings\Application Data\Avg2013
C:\Documents and Settings\chevy truck\Local Settings\Temp\*.*
C:\avg70free_300a419.exe
C:\Program Files\Ask.com
C:\Documents and Settings\chevy truck\Application Data\AskToolbar
C:\Documents and Settings\chevy truck\Local Settings\Application Data\AskToolbar
C:\Documents and Settings\Default User\Local Settings\Application Data\AskToolbar
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
C:\Documents and Settings\chevy truck\Application Data\OpenCandy
C:\Documents and Settings\Administrator\Local Settings\Application Data\AskToolbar
C:\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"ApnUpdater"=-
[HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\Software\Microsoft\Windows\CurrentVersion\run]
"MSMSGS"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A155D7BC-2771-42EB-82B6-A149E0036DC5}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks\{00000000-6E41-4FD3-8538-502F5495E5FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ApnUpdater]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Ask.com\Updater\Updater.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\YontooIEClient.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api]
[-HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9307081B-7444-494C-8CF6-2FA7C0E92BFB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{9D9785E5-3424-40B6-A287-BA143AD53109}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Components\{B6783DFA-B8C8-4CB6-AB9F-EF1A1F7F7AE8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Tarma Installer\Products\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}]
[-HKEY_USERS\.DEFAULT\Software\Ask.com]
[-HKEY_USERS\.DEFAULT\Software\AskToolbar]
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}]
[-HKEY_USERS\S-1-5-18\Software\Ask.com]
[-HKEY_USERS\S-1-5-18\Software\AskToolbar]
[-HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\Software\Ask.com]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\Software\AskToolbar]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\Software\DataMngr]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}]
[-HKEY_USERS\S-1-5-21-1004336348-1788223648-682003330-1003\Software\Softonic]
:Commands
[purity]
 
[EmptyTemp]
[start explorer]
[Reboot]

Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
) and choose Paste.
Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

the C:\_OTM\MovedFiles log
C:\MGlogs.zip

Make sure you tell me how things are working now!

dodgetruck · Jan 9, 2013

Hi again I have uninstalled software you told me to and I downloaded oldtimer.geekstogo but I cannot run as an administrator.I have tried but my computer keeps asking me for a password which I dont have as I bought the computer second hand privately in a private sale.However my computer seems to be working okay now but I am confused,I have done all these things and mixed myself up.Do I need to do anymore and is my computer still corrupted?Many thanks again.

chaslang · Jan 10, 2013

Just run OTM by double clicking on it. That should work since you are using XP. Yes you need to do this to fix all the junk shown in the fix.

Log in or Sign up

Help,malware removal

dodgetruck Private E-2

Attached Files:

RKreport[1]_S_12282012_02d2018.txt

MBRCheck_12.22.12_19.17.25.txt

HitmanPro_20121228_2134.log

TDSSKiller.2.8.15.0_28.12.2012_22.34.27_log.txt

TDSSKiller.2.8.15.0_28.12.2012_21.16.17_log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

dodgetruck Private E-2

Attached Files:

mbam-log-2012-12-28 (20-38-48).txt

desktop.txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

dodgetruck Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member