Logs attached Re: Malware removal

muchwork · May 12, 2010

I have run the Malware removal and cleaning procedure and have attached the logs. Honestly, I don't know if I am having problems but felt I should at least have someone look at the logs. I ran the cleaning procedure because my son was using MS paint and the computer was being unusually slow and then it cleared my desktop background when he closed paint and all I had was a tan desktop background with my icons. The tan background reminded me of the last time I did the cleaning procedure and I got that result after I ran combofix.

I only had two issues when running the programs:
Root Repeal:
It seemed to scan fine but when I clicked save report it said, "could not create file". I had the window for saving it but the window with the name of the file was blank. I entered the name manually and that is what you will see attached.

MGTools:
When it was all finished I had the following message:
"Scanning complete. YOur log file is c:\MGlogs.zip
Hitting any key will close this command prompt window. Press any key to continue. "
I pressed a key and it closed the program. This was not a problem but it did not mention that I would get this message in the directions so I wanted to make sure all was OK.

Thanks in advance for your time and assistance!

muchwork · May 12, 2010

Log attached Re: Malware removal

I hope I am doing this right. I sent the first four logs in a previous thread and am now attaching the MGTools report.

Kestrel13! · May 12, 2010

Threads merged.

Kestrel13! · May 12, 2010

Go to add/remove programs and uninstall the out of date java:

Java(TM) 6 Update 18

Now we need to use ComboFix

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

If ComboFix tells you it needs to update to a new version, make sure you allow it to update.

Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
Code:
KILLALL::

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=-
"DisableTaskMgr"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\load]
"h_alilumba.in"=-
"h_arkanum.in"=-
"forwas"=-
"h_arkavnuimt.in"=-
"h_u4medatafast.net.in"=-
Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

Run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this

How is the machine running now?

muchwork · May 17, 2010

Please find attached the two logs that were created after I followed the instructions you gave me.

One thing unusual happened while running combofix:
After it had completed running and said it was going to reboot the computer I got a window that said:
"The rebooting of windows 'something' failed to initialize...."
The word 'something' means I don't remember what it said and the window disappeared before I could copy everything down.
The computer then rebooted and a combo fix window came up and said it was preparing the log report. All went fine after that.

OK so now something else just happened. When I went to attach the logs to this email I decided to activate my firewall and avg anti-virus. Firewall did fine but the computer froze when I tried to activate the anti-virus. I couldn't soft boot and had to flip the switch on the back of the computer. When I restarted I opened AVG and it showed as activated. I then opened up firefox to get back to the majorgeeks website and the browser opened straight to this window. So, now I will attach the logs.

I only had one MGlogs.zip file and am hoping it just updated. Is that the case?

Thanks for all your help!

Kestrel13! · May 17, 2010

Those logs look good to me now.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

muchwork · May 19, 2010

I went through and did all that was instructed in your last post. I also uninstalled AVG free antivirus and installed PC Tools antivirus instead. When I first downloaded the PC Tools antivirus file and attempted to install it I got a message that said the file was corrupt. (I used the authors website). I deleted that then went back and downloaded the PC Tools file from the majorgeeks website. When I was attempting to install that it asked me to uninstall the PC Tools Firewall first. I did that and then installed the antivirus. Then I reinstalled the PC Tools firewall.
I am now getting alot of notices from the firewall. Yesterday, it was "mcci+mcci...?(can't remember the last word). It asked me four times about it. I allowed it once and then blocked it 3 times. My computer then froze and I turned it off at the back and restarted it. It seemed to be doing OK after that. Today, the firewall is saying "Services and Controller app is attempting to load driver (DSproct). I tried to block it but the message just keeps returning. Should I accept it. I did some online searching to learn more but I didn't get any answers that made me sure it was OK to allow it. Should I allow this and if not, how do I keep the firewall from asking me repeatedly? Also, what is the mcci+mcci thing? I know I should have known that before I allowed it but my research on that one was also a bit hard to understand and determine whether it was safe or not.
I have noticed today that my computer is opening Firefox and my email application a whole lot faster than it has in years. Don't know if that means anything but thought I should mention it.
Thanks for your help. )

Kestrel13! · May 19, 2010

Any issues you now have centering round your firewall will have to be discusses in the software forum as it is not topic for the malware forum.

You're welcome, and safe surfing!

Log in or Sign up

Logs attached Re: Malware removal

muchwork Private E-2

Attached Files:

saslog.txt

mbam-log-2010-05-11 (22-22-54).txt

combofixlog.txt

RRlog.txt

muchwork Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

muchwork Private E-2

Attached Files:

ComboFix.txt

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

muchwork Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member