Malware removal help, part I

First off, I have followed all your advice on the READ & RUN ME FIRST page.. The major problem I had was with being re-directed during google searches, which seems to have been resolved. I noticed I still have some infections and was wondering if there is anything further I should do to eliminate these. So.. I will go ahead and attach all the logs I saved. Thanks so much!

 

Malware Removal help, Part II

This is a continuation of my first post, with the other 3 attached logs. I hope I am posting this continuation correctly. Once again, I have followed all advice on the READ & RUN ME FIRST thread.

 

CORRECTION to ORIGINAL THREAD - I mentioned it appeared that my problem was resolved after taking the action steps you require, but it IS NOT. I am still being re-directed to random sites when searching with ANY engine (not just google).

 

Post a HijackThis log.

Don't start multiple threads for the same problem. Your threads have been merged.

 

Here's the HJT log..

 

Download
- Pocket Killbox

Using Add or Remove Programs in the Control Panel; uninstall the following:

Visit www.adobe.com and install the latest version of Acrobat Reader.

Install Java Runtime Environment (JRE) 6 available from Sun Microsystems.

Windows Messeger is running in the background on this computer, and represents a security risk. Remove Windows Messenger by running Uninstall Messenger. If you are using this as your IM client then replace it with MSN Messenger.

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*).

Close Notepad.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click Delete Selected Temp Files
Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following:

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Follow the directions for teh following:
WareOut Removal
Virtumonde aka Trojan Vundo Removal

Post the following logs:
1. FixWareout
2. FixVundo
3. ShowNew
4. GetRunKey
5. HijackThis

 

A couple things..
1. c:\program files\aws\weatherbug was not deleted because I could not find it.
2. There is no Vundo log because nothing was found during the scan.

The rest of the requested logs are attached

 

HJT log

 

Ewido Anti-Malware is out-dated and no longer supported, as Ewido was purchased by Grisoft. AVG Anti-Spyware is the replacement for Ewido.

Download FindAWF.exe by Noahdfear to your Desktop from >here<

Double-click FindAWF.exe to run it

A command window will open (OK any warnings by your security software)

Press any key to continue

When finished, a Notepad window will open and the output file called awf.txt
Save this to your Desktop and attach the file to your reply.

 

awf.txt

 

The awf.txt is clean.

How is your computer running?

 

It appears to be working fine now.. I had a question about preventative measures.. I have an expired version of Norton/Symantec Internet Security running on my computer. Would you suggest I download and run that AVG AntiSpyware program you mentioned and get rid of the Norton all together (I do not wish to pay to renew the subscription)? I also want to be sure I'm not running more than one Anti-virus/spyware/etc.. or firewall program at once, but I'm not sure exactly what all is currently active.

Thanks so much for all your help!!

 

You can run both an Anti-Virus and Anti-Spyware program concurrently. They normally don't interfere with each other. I really like the AVG line of products.

If you are not having any other malware problems, it is time to do our final steps:

• If we used Pocket Killbox during your cleanup, do the below
  • Run Pocket Killbox and select File, Cleanup, Delete All Backups
• If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
• If we used SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
• If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
• If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
• If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
• You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
• If you are running Windows XP or Windows ME, do the below:
  • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
  • Then reboot and Enable System Restore to create a new clean Restore Point.
• After doing the above, you should work thru the below link:
  • How to Protect yourself from malware!

 

I guess I'm all clean! Again, thanks so much for all your assistance!!

 

You're Welcome