Malware Removal for the Incredibly Stupid

Discussion in 'Malware Help (A Specialist Will Reply)' started by Lieutenant Cobra, Jun 3, 2007.

  1. Lieutenant Cobra

    Lieutenant Cobra Private E-2

    I'm guessing that the only thing more pathetic than a rookie Geek is a really, really stupid rookie Geek. I've spent the last day and a half doing and re-doing the "Read and Run Me First" 8-Step Malware Removal Plan, and now I'm ready for a 12-Step Plan of a different kind.

    The first three housecleaning steps went well. Downloading the tools in step 4 was a challenge. I already had Spybot loaded, but updating it locked up my computer and I had to reboot. Counterspy loaded OK, but took a long time, even with my high-speed cable. Step 5 was a nightmare. In Safe Mode, there was no "Default Scan" on Ccleaner, only "Analyze" and "Scan." Counterspy had no option to quarantine anything--I could only "Ignore" or "Remove." I chose "Remove," for which I will probably burn in purgatory someday. I did seem to get rid of some malware using these steps--Win32.MT.Rs, TrojanSPM/LX, Hoax.Win32.Agentb, Trojan.Fakealert, and Trojan-Downloader.Zlob.Media-Codec. I understand that there's alot of fake trojans around which try to get you to buy their "fix-it" software. I may be criminally stupid, but I hope not to be gullible.

    In Step 6A, I had to reboot back into normal mode to get Sun Java loaded. Then, back in Safe Mode, neither Bitdefender or Panda Activescan would work. So, back into normal mode, and they both worked--don't know if this affects the validity of the scans.

    Step 6B--Hurrah! No problems.

    Step 6C--Request help. It took me 15 minutes to figure out how to get here, and I have a substantial wager with my wife as to whether I'm going to get through this without screwing something up. A lot of personal pleasure rides on the outcome.

    I performed the HijackThis steps as specified. From all of the above, I still have some malware imbedded, and would like to crush it like a bug. I'm attaching three of the requested logs. The rest are coming in a separate posting. I hope my computer is not beyond hope.

    Lieutenant Cobra
     

    Attached Files:

    Lieutenant Cobra, Jun 3, 2007
    #1
  2. Lieutenant Cobra

    Lieutenant Cobra Private E-2

    I have no idea if my first post made it--I got a message saying I specified an invalid thread. This seems to be par for the course. Well, I'll try to send the other logs. Here goes.
     

    Attached Files:

    Lieutenant Cobra, Jun 3, 2007
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download FixWareout by LonnyRJones from one of the two below links and save it to your desktop.

    http://downloads.subratam.org/Fixwareout.exe

    http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

    * Run Fixwareout.
    * Click Next,
    * then Install,
    * make sure Run fixit is checked
    * and click Finish.
    * The fix will begin; follow the prompts.
    * You will be asked to reboot your computer; please do so.
    * Your system may take longer than usual to load; this is normal.

    When you run fixwareout, just follow the prompts, you will need to restart when prompted.

    After rebooting (restart) back into normal boot mode, make sure you have all web browsers closed.

    * Go into Control Panel -->Network Connections.
    * Right click on your connection
    * and click Properties.
    * On the Properties page, highlight Internet Protocol(TCP/IP)
    * Click Properties. This will bring up another page.
    * Select Obtain DNS Server Automatically.
    * Click the ok button. The page will close.
    * Press ok on the page in front of you.
    * Restart the computer.
    * Reconnect to the Internet using Internet Explorer.
    * Now come back here and attach the log from fixwareout. It is located at c:\fixwareout\report.txt

    Also attach a new log for:
    HJT
    GetRun
    ShowNew
     
    TimW, Jun 4, 2007
    #3
  4. Lieutenant Cobra

    Lieutenant Cobra Private E-2

    Sorry to take so long to reply--I've been either out of town or drunk (or both). Here are three of the four logs you requested. The fourth will come shortly. Am I making any progress?

    Cobra
     

    Attached Files:

    Lieutenant Cobra, Jul 6, 2007
    #4
  5. Lieutenant Cobra

    Lieutenant Cobra Private E-2

    Here's the fourth log file.
     

    Attached Files:

    Lieutenant Cobra, Jul 6, 2007
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please use add/remove programs to uninstall:
    Viewpoint Media Player
    and then uninstall one of the following (you should not be running two AV programs!)
    BitDefender 8 Free Edition
    Norton AntiVirus


    Your logs look clean. You may uninstall any programs we had you download (including Counterspy).

    If you are not having any other malware problems, it is time to do our final steps:

    1. If we used Pocket Killbox during your cleanup, do the below
    * Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    8. If you are running Windows XP or Windows ME, do the below:
    * go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
    * How to Protect yourself from malware!
     
    TimW, Jul 7, 2007
    #6

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds