Infection possibly blocking spybot?

Moses · Jul 25, 2010

Hello, cool people. My father's desktop was apparently infected with some spyware. I went through the posted cleaning procedures and fixed some stuff but am uncertain if everything's cleared up and wasn't sure if I should do the whole toggle-system-restore bit yet.

Initial Symptoms:

This part's tricky. This isn't my computer, so I don't know exactly when or how it was infected. Eight or so months ago my dad reported problems accessing his email through his MSN browser (which I'm trying to get him to stop using in favor of Firefox anyway). I didn't think it was a malware issue but he recently mentioned he was still having problems so I tried to check it out and discovered I couldn't open Spybot. The status bar that appears when Spybot's starting up would load fully but Spybot would never open up in either Normal or Safe Mode. So that's when I decided to come here.

Problems during scanning:

I found that I couldn't open RootRepeal in Normal Mode: the "Initializing" message comes up but then the computer would restart itself shortly thereafter. I found I could run it in Safe Mode though and in order to avoid having to restart between scans unnecessarily I ran RootRepeal first then rebooted into Normal to do everything else. Since I'm not sure if this is a malware interference issue or not I'm reluctant to try to open it again after having done all the other scans and fixes until I heard from you folks (since I haven't toggled system restore yet).

Symptoms after scanning:

The only thing I can tell is still wrong is that Spybot still won't open. However, I'm uncertain if this is a malware issue or if it's just because Spybot's really big resources-wise and this computer is operating with way less memory than it should (128 megs of RAM for Windows SP 2...).

So please have a look at my logs if you can and let me know if there's anything wonky still happening. I plan to have a long talk with my dad about safe surfing after all this...

Moses · Jul 25, 2010

Last log. Remember when the maximum number of uploaded files was only 3 but the cleaning procedures asked for 4 logs? Can't catch a break, we can't.

dr.moriarty · Jul 26, 2010

Hello, Moses

I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m

dr.moriarty · Jul 26, 2010

Moses

Moses said: ↑

However, I'm uncertain if this is a malware issue or if it's just because Spybot's really big resources-wise and this computer is operating with way less memory than it should (128 megs of RAM for Windows SP 2...).
Click to expand...

That is exactly the problem:

Processor x86 Family 6 Model 4 Stepping 2 AuthenticAMD ~901 Mhz
Total Physical Memory -------- 128.00 MB
Available Physical Memory ---- 30.34 MB
Click to expand...

Please update SpywareBlaster v3.5.1 to the current version SpywareBlaster 4.3

*EDIT: SAS version is outdated!

*You are out of date with your version of SUPERAntiSpyware.

Please uninstall your current version (this is necessary).

Then download this SUPERAntiSpyware

Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.

After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.

Now run a new "Complete scan" of your system.

Please attach the log if anything is found other than tracking cookies.

-------------------------------------------------------
If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and re-enable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif

Moses · Jul 26, 2010

Hello, dr.,

I did all you asked. Seems like I'm in the clear. I'll be heading out sometime this week to get my dad some more memory.

Thanks very much!

As always,

you rock

chaslang · Jul 26, 2010

Moses said: ↑

I did all you asked. Seems like I'm in the clear. I'll be heading out sometime this week to get my dad some more memory.
Click to expand...

I'm not positive what this PC can handle, but based on it being an old 900 Mhz PC, you may not be able to put in too much memory. If may have a 384 MB or 512 MB limit. If that is actually the case, don't waste your money on the memory because the PC is too old and too slow to have too much more life especially if you continue to update Windows XP and other applications like protection software.

Moses · Jul 27, 2010

Oh dear. I'll have to look into that. Thanks, chaslang.

dr.moriarty · Jul 27, 2010

You're very welcome, Moses.

Log in or Sign up

Infection possibly blocking spybot?

Moses Private E-2

Attached Files:

RRtimber.txt

SUPERAntiSpyware Scan Log - 07-22-2010 - 20-10-29.log

mbam-log-2010-07-23 (00-16-49).txt

combofixlog.txt

Moses Private E-2

Attached Files:

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

dr.moriarty Malware Super Sleuth Staff Member

Moses Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Moses Private E-2

dr.moriarty Malware Super Sleuth Staff Member