Infection; review logs.

spin180 · Apr 17, 2011

Greetings,

I'm trying to help a friend with an infection on his notebook. It's a Dell Inspiron mini running 32-bit Windows 7 Starter. He brought it to me saying it had a "virus" and didn't describe problem in any detail, and I neglected to ask as well.

The computer initially only had a trial version of McAfee. I started cleaning things up and installed Malwarebytes and Avira AntiVir. During the initial scans with each program I found a number of instances of TR/Agent and HTML/Jscript.l.

I let the respective programs do their thing, quarantining and deleting the suspect files. I also ran Combofix and on the first scan it advised that the file "userinit.exe" was infected. I recall reading something about that infection being particularly difficult to fix so I stopped at that point and decided to seek assistance.

I've run through the posted malware guide and completed all required steps, except for RootRepeal. I could not get it to run on the machine. When I tried to launch the program I received the following error: "FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000e0)"

That issue aside, the final scans all seem to indicated the computer is clean. However, I'd really like for someone more experienced to review what I've done.

Please note, the ComboFix file includes three different scan logs. The first from the scan I mentioned previously. The second scan from working through the process in the guide, and the third just for good measure I guess. I sort of lost track of what I was doing briefly. The Malwarebytes file also contains two individual logs; the first from my initial attempt to fix and the second from me working through the guide.

I still have the each individual log saved separately and can provide them if needed.

Thanks!

TimW · Apr 17, 2011

Your logs are clean. The only item I see that I don't know about is this:
C:\ProgramData\nGi31001oAdHi31001

You can right click it and choose properties to see if you can figure out what it is. If you don't know, delete it.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Help Support MajorGeeks
Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

MajorGeeks on FaceBook

spin180 · Apr 17, 2011

TimW said: ↑

Your logs are clean. The only item I see that I don't know about is this:
C:\ProgramData\nGi31001oAdHi31001

You can right click it and choose properties to see if you can figure out what it is. If you don't know, delete it.
Click to expand...

Oh, that's the folder where the first trojan detected was located. It has been deleted.

I truly appreciate your help. Thanks again!

TimW · Apr 18, 2011

You are most welcome. Safe surfing.

Log in or Sign up

Infection; review logs.

spin180 Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 04-17-2011 - 01-44-39.log

combofix (all logs).txt

mbamlog combined.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

spin180 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member