I don't know thats why I am here.

This is my moms computer that I am trying to fix. It was infected by some kind of Trojan a few months ago and it ended up only be able to boot in safe mode. She took it some guy locally and he kind of fixed it but things have never been the same.

Last night my dad was on this computer and there was an alert for a trojan something or other possible infection. Scanned with antivirus and nothing.

I did the Run and Read me section but was unable to install SuperantiSpyware. I also got 2 errors from Hijackthis while running MGtools. And I was unable to download Combofix.

Here are the 3 logs that I have, thanks in advance!

 

Hello Quilombero.

Go to Add or Remove Programs and uninstall:

• ALOT Toolbar
• Java 2 Runtime Environment, SE v1.4.2_03
• Java(TM) 6 Update 3
• Viewpoint Media Player
  

You need to update your Java as stated in the READ ME. Updating Sun Java



Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger or Windows Live Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.



Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX Checked until you exit all browser sessions including the one you are reading in right now:

• O2 - BHO: (no name) - {1E4E31A4-6FA0-4549-878B-39C27A264D86} - (no file)
• O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
• O20 - AppInit_DLLs:
• O20 - Winlogon Notify: awvecm - C:\WINDOWS\Cursors\awvecm.dll (file missing)

After clicking Fix checked, exit HijackThis.



Also delete all files in the below bold folder except ones from the current date (Windows will not let you delete the files from the current day).

• C:\Documents and Settings\Administrator\Local Settings\temp <- delete everything in this folder.

Now run CCleaner and the restart the computer.



* Please uninstall your current version of SUPERAntiSpyware. <- This is important!
* Download and install the new version of SUPERAntiSpyware
* After installing the new version, it may tell you that you need to reboot to complete the installation. You must reboot at this time!
* After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get any available updates.
* Now run a new full scan of your system.
* Attach the log in your next reply.



Next run the C:\MGtools\GetLogs.bat file by double clicking on it. Attach the new C:\MGlogs.zip file that will be created.

 

Ok i did everything you said and here are the new logs.

When I tried to install SAS I got the same error as last time saying something about not having sufficeint blah blah to insatll in C:\Program files etc. etc.

So I got creative and just installed it in C drive and presto it installed and I was able to scan.

Thanks again for all your help!

 

Did you run the Disable/Remove Windows Messenger tool? I still see Windows Messenger.

Please run the ESET Online Scanner and attach the log. Using ESET's Online Scanner

 

Yeah I ran the Disable/Remove Windows Messenger and there were no files to delete on the desktop. Then after your last reply I remember it was already uninstalled. What you were seeing was Windows LIVE Messenger so I uninstalled that. That removal tool could not uninstall Windows Live Messenger.

I was wondering why I couldn't install SAS in C:\Program Files?

Here is the last log. This scan actually found a few things.

 

No. I wasn't referring to Windows Live Messenger and you did not need to uninstall it.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX Checked until you exit all browser sessions including the one you are reading in right now:

• O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] \"C:\Program Files\Messenger\msmsgs.exe\" /background (User \'SYSTEM\')
• O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] \"C:\Program Files\Messenger\msmsgs.exe\" /background (User \'Default user\')

After clicking Fix checked, exit HijackThis.

Now delete this folder. C:\Program Files\Messenger

This is a good question and I'm not sure why. I do know however that all software should be installed to it's default location. Especially security software.

Do you have a SUPERAntiSpyware folder in C:\Program Files? Have you tried deleting it before running the installer?

Also let me know how the computer is running now.

 

Oh... Well my mom didn't use it anyway! Haha!

It runs WAY better now and my mom is able to put whatever wallpaper on her desktop or set whatever screen saver.

She wanted me to thank you because she was ready to take it to another computer shop to try and fix it. You saved her some money for sure!

My dad thanks you too because you got my mom off his back! Haha!

Thanks!

 

Your welcome.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups.
3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
5. If running Vista, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Go to add/remove programs and uninstall HijackThis.
7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
8. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work through the below link:
   • How to Protect yourself from malware!