Malware Logs... Thanks for the help!

Discussion in 'Malware Help (A Specialist Will Reply)' started by jc87, Jul 14, 2008.

  1. jc87

    jc87 Private E-2

    This is my brothers computer so im not sure exactly what was going on when it was infected. What I do know is that the desktop wall paper was changed to a blue screen with a text message in the center instructing you to install antivirus software. A program called "Antivirus XP 2008" was also installed.

    I finished all the steps in the readme, and here are the logs. Thanks in advance.
     

    Attached Files:

  2. jc87

    jc87 Private E-2

    (Logs Cont.)
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well it looks like your malware is removed. We have a minor fix with HijackThis to do. However the big problem I see is that this PC has no protections software installed. Why is that?


    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - Startup: PowerReg Scheduler V3.exe

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  4. jc87

    jc87 Private E-2

    I haven't installed any protection because this is not my computer... If I where to install some protection, what program would you recommend. I have yet to find a program that doesn't either eat up all of my system resources or try to run my computer for me.

    All instructions complete and here is the log you requested. Thanks again!
     

    Attached Files:

  5. jc87

    jc87 Private E-2

    Oh... Everything seems to be working fine. The Shortcuts to the antivirus program that was installed are now missing icons, and the wallpaper is now just a blue screen (no spyware text). I have yet to see any popups/redirects. So yeah, everything seems to be in tip top shape.
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Recommendations are in the link in the last step of my final instructions given below. All protection sotware is going to require use of system resources. Some are just worse than others. This is necessary condition. This PC has 4 GB of RAM so it should not be an issue. Running a browser uses resources too. ;) The downside of not adding protection is that a PC will always be getting infected and some infections my make a PC totally unbootable.


    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combo-fix" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds