HelpAssistant Folder

dren · Dec 10, 2009

I recently noticed my hard drive space on C was disappearing despite not having added any programs or files to C. Also, my computer crashed once, and the system was stalling and acting very sluggish in general. When going through the folders in C, I noticed a folder titled "HelpAssistant" in my Documents and Settings.

I followed the instructions from here http://www.bleepingcomputer.com/forums/topic260464.html and the folder has not reappeared since then. However, I would appreciate it if someone could read my logs and tell me for sure that my system is clean.

I couldn't download Combofix.exe. I kept getting an error message stating "Cannot copy ComboFix: Access Denied."

Kestrel13! · Dec 12, 2009

1. Important Notice: A new version of SUPERAntiSpyware is available.

Please uninstall your current version (this is necessary).

Then download this SUPERAntiSpyware

Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.

After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.

Now run a new full scan of your system. And attach this log later.

2.

WinPcap 4.0 <--- if you did not knowingly install this software then please uninstall it from add/remove programs.

Spyware Doctor 3.2 <--- is this a free trial which is useless anyway or paid for software? If simply a trial then also uninstall.

3. Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)

After clicking Fix exit HJT.

4.

and the system was stalling and acting very sluggish in general.
Click to expand...

You could do with doubling the RAM on this machine.

5. What is this?

C:\Documents and Settings\Dren\Desktop\mmker.exe.lnk

6. Also delete all files in the below bold folders except ones from the current date (Windows will not let you delete the files from the current day).

C:\WINDOWS\Temp
C:\Documents and Settings\Dren\Local Settings\TEMP
Click to expand...

7. Use Windows EXplorer to find and delete the following bold file:

C:\Documents and Settings\Dren\Local Settings\TEMP\689211B7.TMP

8. Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from SUPERantispyware.

Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now!

dren · Dec 12, 2009

Thank you so much for your help. I still haven't seen the HelpAssistant folder, though hard drive space still seems to be disappearing. I'm sure I had over 4GB before this happened, and now it's 2.76GB. Before my first post here, it had dropped to a little over 1GB.

Another thing I noticed, is that now when I try to make a change in msconfig it tells me "Access denied error. Log on using Administrator Account." I never had this problem before, and I am under an Administrator Account.

5. What is this?
C:\Documents and Settings\Dren\Desktop\mmker.exe.lnk
Click to expand...

This is just Windows Movie Maker

I couldn't delete all of the files in C:\WINDOWS\Temp.

Thank you again for assisting me.

Kestrel13! · Dec 12, 2009

I still haven't seen the HelpAssistant folder, though hard drive space still seems to be disappearing. I'm sure I had over 4GB before this happened, and now it's 2.76GB. Before my first post here, it had dropped to a little over 1GB.
Click to expand...

Whatever the reason for this occurring I can tell you that there is no malware running riot on your machine now. So any remaining issues that you now have can be further discussed in the software forum if you wish

Another thing I noticed, is that now when I try to make a change in msconfig it tells me "Access denied error. Log on using Administrator Account." I never had this problem before, and I am under an Administrator Account.
Click to expand...

Again, this is also subject for the software forum.

Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we used Pocket Killbox during your cleanup, do the below

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Thank you so much for your help.
Click to expand...

you're very welcome, safe surfing!

Log in or Sign up

HelpAssistant Folder

dren Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 12-10-2009 - 05-39-36.log

mbam-log-2009-12-10 (16-09-45).txt

RRlog.txt

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

dren Private E-2

Attached Files:

MGlogs.zip

SUPERAntiSpyware Scan Log - 12-12-2009 - 20-26-11.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member