Highjacker?

Discussion in 'Malware Help (A Specialist Will Reply)' started by lilshorty, Mar 2, 2007.

  1. lilshorty

    lilshorty Private E-2

    Hi

    I have done all the steps in the read and run me thread.

    My computer has been really slow lately and a friend told me to come here.

    Spybot found nothing

    Avg as found 5 things I think

    bitdefender found nothing

    and Panda found 5 things some that sound pretty bad.

    I will attach all logs requested thank you for helping me.
     

    Attached Files:

    lilshorty, Mar 2, 2007
    #1
  2. lilshorty

    lilshorty Private E-2

    Other logs.
     

    Attached Files:

    lilshorty, Mar 2, 2007
    #2
  3. lilshorty

    lilshorty Private E-2

    I ran trojan scan here is the log.
     

    Attached Files:

    lilshorty, Mar 3, 2007
    #3
  4. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Download
    - Pocket Killbox

    The installed version of Acrobat Reader on this compter is out-dated. Install the current version of Adobe Acrobat Reader from: Adobe Acrobat Reader Download

    Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*).
    Close Notepad.

    Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

    Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:
    Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

    Now run Pocket Killbox:

    Choose Tools -> Delete Temp Files and click Delete Selected Temp Files
    Then after it deletes the files click the Exit (Save Settings) button.

    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

    Select:
    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
    If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

    Reboot

    Post the following logs:
    ShowNew
    GetRunKey
    HijackThis
     
    Shadow_Puter_Dude, Mar 3, 2007
    #4
  5. lilshorty

    lilshorty Private E-2

    Hi Shadow,

    First of all thank you so much for helping me.

    I did all of the steps you gave me with no erors. Here are the logs.
     

    Attached Files:

    lilshorty, Mar 4, 2007
    #5
  6. lilshorty

    lilshorty Private E-2

    Hi

    I don't mean to bump but I am just wondering if my computer is clean now? Shadow Puter Dude was helping me and I did the steps he told me to. He hasn't gotten back to me since, so does that mean that the malware is gone? Please let me know.

    Thank you

    shorty
     
    lilshorty, Mar 5, 2007
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes your logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    8. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    chaslang, Mar 5, 2007
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds