Help with Infected Registry Files

Can anyone tell me what to remove, I ran a majority of programs including Norton, Regis Doctor even programs on here from the stickied thread

I remember deleting values before in the Registry Editor, can someone give me a hand

hijack log is attached

 

http://www.majorgeeks.com/images/grenade.gifWelcome to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

Read & RUN ME FIRST Before Asking for Support

 

no d/r but that has been done that's the only reason I posted this thread.

 

If you have completed the steps then please attach the requested logs, MGTools.zip.

 

sorry about that man,

here are 3 logs

 

I need the MGLogs.zip file created by running the MGTools from post 2.

 

here u go

 

You didn't attach anything?

 

attached

 

Again, I need the MGLogs.zip file created by running the MGTools from post 2.

 

this should be it here

 

Before we continue, click Start > Run > type msconfig and press ENTER.

Now check the box next to "Normal Startup" and click Apply then OK. After you complete this reboot and then follow the below to attach new logs.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

 

getunkey.txt file is 2 big for upload
Your file of 281.2 KB bytes exceeds the forum's limit of 250.0 KB for this filetype

 

2 here from ag

 

upping

 

Must not have seen this?

Don't Bump! It Only Hurts You!!!

 

no I haven't seen that. The "uppin" was not out of arrogance or impatience what so ever. I understand there are thousands of malware online. I also understand there and plenty of people coming to you all for help and greatly appreciate the hell of a effort given free no cost at that.

So if I came across like a dick for upping the thread, don't get the misconception that I can not wait, put on pants 1 leg at a time like everyone else I'll wait like everyone else.

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 4:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 5: Begin here after rebooting from Step 4!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 6:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Step 7:
Finally, I would like you to install the current version of Sun Java: Sun Java Runtime Environment

Step 8:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1000140.exe 61A847B5BBF72813329B385776F901F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

those 2 were not in Hijack this log & everything else. I'm guessing because I uninstalled spybot s&d in step 1

This might sound crazy but when replying, the attachment link and everything above me and to the right of me including the smiley's I can not add, I'm clicking on everything and it's not allowing me to add it. It's doing nothing, not even the smiley's. I can copy and paste it like it's text but not bring it down where I'm typing this. I can show you from avenger but you still want that zip, I'm in firefox I'll try IE So with that being sad I'll do this

Edit by bjgarrick: Inline log attached!

 

works with IE, but not firefox even when re started
zip should be attached

 

works fine but unsure if files are still infected or not

 

I apologize for the delayed response, I've been really busy the past two weeks, with the holidays and work it's been crazy trying to keep things caught up.

Let's get some fresh logs, run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.