Help - Redirects from Searches

You need to attach the requested log from running MGtools which is C:\MGlogs.zip

Also you need to attach the log from SUPERAntiSpyware

You also need to remove ComboFix from here: c:\program files\ComboFix.exe
And put it on your Desktop as was requested or any further instructions will not work.

 

It will all be cleaned up when we get finished.

I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing.

Also you are saving things to the C:\Program Files folder as mentioned in my last message. You must not do this either. You need to remove all of the below NON-malware items from your Desktop and from the C:\Program Files folder:

Code:

"C:\Documents and Settings\David & Vanessa\Desktop\"
279day~1.pdf  Apr 27 2009      543337  "279days[1].pdf"
avg_fr~1.exe  Jul 23 2009      847768  "avg_free_stb_all_8_30_cnet.exe"
ccsetu~1.exe  Oct 19 2008     2922072  "ccsetup210.exe"
ccsetu~2.exe  Jul 22 2009     3252640  "ccsetup221.exe"
cleani~1.txt  Jul 24 2009        7665  "CleaningXPinstructions.txt"
combofix.txt  Jul 24 2009       15670  "Combofix.txt"
combof~1.txt  Jul 24 2009       30135  "Combofix7.24.09log.txt"
firefo~1.exe  Dec 16 2008     7518240  "Firefox Setup 3.0.5.exe"
firefo~2.exe  Apr  4 2009     7518920  "Firefox Setup 3.0.8.exe"
flash.mdi     Nov 17 2008      175614  "Flash.mdi"
foxitr~1.exe  Apr  6 2009     6806784  "Foxit Reader.exe"
foxitr~1.ini  Jul 23 2009        5992  "FoxitReader_Preferences.ini"
hijack~1.lnk  Jul 22 2009        1743  "HijackThis.lnk"
hjtins~1.exe  Jul 22 2009      812344  "HJTInstall.exe"
ice-25.pdf    May 31 2009      198783  "ice-25.pdf"
instal~1.exe  Feb 20 2009     1851544  "install_flash_player.exe"
mamdoc.txt    Jul 24 2009        1845  "MAMdoc.txt"
mbam-l~1.txt  Jul 24 2009        1191  "mbam-log-2009-07-24 (22-15-18).txt"
mediam~1.exe  Jul 19 2009     7572600  "MediaMonkey_3.1.0.1256.exe"
mgtool~1.txt  Jul 24 2009       13369  "MGToolsdoc.txt"
procdll.txt   Jul 24 2009       57943  "procdll.txt"
rootre~1.txt  Jul 24 2009        1980  "rootrepealdoc.txt"
rootre~2.txt  Jul 24 2009        6400  "RootRepeal report 07-24-09 (23-31-13).txt"
spend5~1.pdf  Jun  8 2009       24106  "spend50rebate.pdf"
spybot~1.exe  Jul 22 2009    16409960  "spybotsd162.exe"
supers~1.txt  Jul 24 2009        5491  "SuperScanDOC.txt"
utorrent.exe  Jun  6 2007      177152  "utorrent.exe"
winrar.lnk    Apr  5 2009         701  "WinRAR.lnk"
wrar380.exe   Apr  5 2009     1234120  "wrar380.exe"

 
C:\Program Files\
combofix.exe  Jul 24 2009     3150579  "ComboFix.exe"
mbam-s~1.exe  Jul 24 2009     3775176  "mbam-setup.exe"
mgtools.exe   Jul 24 2009     1343372  "MGtools.exe"
rootre~1.exe  Jul 12 2009      469504  "RootRepeal.exe"
settings.dat  Jul 24 2009           0  "settings.dat"
supera~1.exe  Jul 24 2009     6568480  "SUPERAntiSpyware.exe"

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9

You must disable Spybot's Teatimer as requested in the READ & RUN ME. See this: How to disable Spybot's TeaTimer

You have left overs from Symantec wasting system resoureces. Please run the below then reboot. After reboot run it one more time.

Norton Removal Tool (SymNRT)


Now after the last reboot, install the current version of Sun Java from: Sun Java Runtime Environment

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You forgot to install the new version of Sun Java. Other than that, things are fine.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Just download ComboFix.exe again and save it to your Desktop. Then run the uninstall procedure and finish the rest of my instructions too.