Hijacklog and other

Re: Virus, Help Please...

HI :wave

We need you to upload to us the 4 requested logs from running the tools outlined in the "Read and Run me First" procedures. Those being the below:

• SUPERantispyware
• MalwareBytes
• Combofix
• MGlogs.zip

So upon your next visit to the forum you could do that, we can continue on and see what's needed to be done with your machine.

Thanks
Kes13!

 

Re: Virus, Help Please...

HI there

Did you give this a read thru? a guide on HOW TO: Attach Items To Your Post

Please make sure you are not posting inline logs.
Thanks
Kes13!

 

Re: Virus, Help Please...

No problem, have located your other thread and will work through your logs, please be patient and I will get back to you soon as I can.

Thanks
Kes13!

 

Hi, I shall take on your logs and get back to you as soon as I have worked out an appropriate fix.

Thanks for your patience
Kestrel13!

 

Hi dking

The Koolnoody items detected by CA Antispyware were false positives. Those items were put into the registry (by Spybot or similar)

1) I can see from your logs that you are currently running 2 different Anti Virus softwares: AVG7.5 and CA Anti Virus This is not wise because they will each be attempting to access system files and system processes simultaneously and this will be the cause of much inner conflict on your computer. I suggest you uninstall one of the above before we continue on.

2) I can also see from your logs that the PC is not in normal startup mode. Please now put your PC into normal startup mode as requested in step 1 of the READ & RUN ME

3) Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this

Thanks
Kes13!

 

Hi not much left to do now:

1) If you haven't already, please disable the Guest account in User accounts.

2) Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.


3) Please go to Add and Remove Programs and uninstall the following software

• J2SE Runtime Environment 5.0 Update 9
• Java 2 Runtime Environment, SE v1.4.2_05
• Viewpoint Media Player

4) Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

5) use windows explorer to find and delete avg leftovers if found

6) Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix exit HJT.

7) Reboot your machine and then install the most current and up to date version below:

Java Runtime 6




8) Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

* Double-click ATF-Cleaner.exe to run the program.
* Under Main choose: Select All
* Click the Empty Selected button.

If you use Firefox browser

* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

* Click Opera at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combofix folder from combofix (if it exists)
3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
5. Go to add/remove programs and uninstall HijackThis.
6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
7. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
   • Delete the fixME.reg file from your desktop
8. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!