Logs for cleaning machine

vkinetic · Jan 20, 2009

Logs attached. Spybot could not fix Fakealert.cc, even after rescanning upon reboot.

Remaining logs to follow

Thanks

vkinetic · Jan 20, 2009

Remaining logs

Thanks

TimW · Jan 20, 2009

Please do this procedure first:
Yoog Removal

Then use windows explorer to find and delete:
c:\windows\system32\15.tmp
c:\windows\okio15350.exe
c:\windows\ddcew84660.exe
c:\windows\wuhre2447.exe
c:\windows\system32\vnjolqbkmmljck.exe

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.

vkinetic · Jan 20, 2009

Thank you.

The Yoog procedure was carried out. Yoog was found in the Mozilla 3.0.3 list, but I could not for the life of me see the button to manage the add-ons as described in the procedure. I uninstalled Mozilla and carried out the rest of the procedure for IE7. Note that neither of the globaladsolution add-ons were in the list of enabled add-ons.

All the other files listed were found and deleted.

The new MGtools logs are attached.

There is one other anomily with this system that may or may not be malware related, but I advise in case it is relevant - every second boot or so the system reports finding a new PCI device (its the system bus and a dialup modem PCI card that are affected), but the drivers etc can't be found. Upon reboot however no such messsages are reported and all the devices are correctly listed.

Thanks for your help.

TimW · Jan 21, 2009

Looks good.

Have you opened device manager and looked for those items which may have a ! or X or ? next to them. If you have no dial-up modem installed, but it shows in device manager with the X or ?..just uninstall it.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

vkinetic · Jan 23, 2009

Thanks for your assistance.

Still occasionally getting the 'Found new hardware' message, which goes away upon reboot (sometimes two reboots). Chkdsk shows no errors. As a final system check I ran HJT and notice an entry that is strange:

O20 - AppInit_DLLs: C:\WINDOWS\System32\HAL32.dll

I've never seen an entry like that in a HJT log. Would it be safe to remove this, and could this have anything to do with the 'Found new hardware' message we are getting?

Otherwise the system appears to be working fine.

Thanks

TimW · Jan 23, 2009

That is a legit file.....but I have not seen it before as an O20 - AppInit_DLLs.

Let me research this and get back to you.

vkinetic · Jan 24, 2009

Thanks TimW. I fixed that line in HJT (since it has a backup of the changes made) and it made no difference anyway. I removed the dial-up card since the user didn't use it anymore anyway and all is well.

Thanks very much to Major Geeks for helping out once again.

Best regards

TimW · Jan 24, 2009

Good.....it needed to be removed. But interesting that it made no change. Perhaps just a leftover.

Let me know if you have any continuing issues. You are most welcome.

Log in or Sign up

Logs for cleaning machine

vkinetic Private First Class

Attached Files:

SASlog.txt

mbam-log-2009-01-20 (18-54-08).txt

ComboFix.txt

vkinetic Private First Class

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

vkinetic Private First Class

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

vkinetic Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

vkinetic Private First Class

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member