In need of some help: Adware.roguesuspect to start

ALCC · Jun 12, 2007

Hi,

4 days ago my AVG detected Adware.roguesuspect after a lot of searching i found major geeks. I have performed all of the steps in the "NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting" and stopped after safe mode AVG scanning because i didn't find anything.

Adware.roguesuspect is back and so is an new one called Trackingcookie.bridgetrack

my computer is running Vista (to be avoided if possible)

oddly enough my thunderbird has stopped recieving mail as well.

i would appreciate any assistance as I have just started a new company and this computer issue is not making my life easy right now...

TimW · Jun 12, 2007

Welcome to Majorgeeks!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis
Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy

AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

ALCC · Jun 12, 2007

Thanks for your reply - the process took quite some time and things seem to be getting worse - the computer is extremely slow right now.

As I said I am running Vista and the malware process laid out does not seem to agree with it.

Here's how things went (safemode used):

Ccleaner - nothing found log attached

Spybot - nothing found log attached

AVG - nothing found in safemode - no option to print log

Bitdefender - this was odd. at the end of the scan ( I cant tell if it reached its conclusion I stepped away from the computer both attempts) the browser had shut down and there was nothing that i could see left. - thus no log

Panda - not supported for Vista

Getrunkey - not supported by Vista - numerous authorization issues - i do have a number of logs but not the one requested by the malware steps...

Show new - not supported...

HiJackThis - name changed - nothing found log attached...

TimW · Jun 13, 2007

Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
Click to expand...

Use windows explorer to find and tell me:
C:\Windows\system32\NOTEPAD.EXE ----> date and size?

I will check with Chaslang as to any issues running GetRun and ShowNew under Vista.

ALCC · Jun 13, 2007

Quote:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = CLICKED FIX ONCE BROWSERS CLOSED
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = CLICKED FIX ONCE BROWSERS CLOSED

Use windows explorer to find and tell me:
C:\Windows\system32\NOTEPAD.EXE ----> date and size?

DATE: 2/11/2006 5:46 AM
SIZE: 148KB

Please see above...

TimW · Jun 14, 2007

We have done some research with Vista and inorder to run both the ShowNew and GetRUn scans, you will need to turn off UAC, reboot and run the scans, then turn it back on and reboot.

Log in or Sign up

In need of some help: Adware.roguesuspect to start

ALCC Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ALCC Private E-2

Attached Files:

cchistory.txt

hijackthis.log

SpybotSD.Report.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ALCC Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member