Malwayre Popup scanner, is it fixed??

km1a · Aug 22, 2010

I was surfing the net and all of a sudden a pop up started scanning my machine saying I had an infected machine. A little green icon came up in the toolbar too. It stopped me from going back on the internet, updating mcafee, or my other scanners, etc. Even brought a pop up that said someone was attacking my on some port and asked me if I wanted to block that port. I restarted several times, no good.

I was able to update and run malwayrebytes in safe mode and it found these:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\isejbphs (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\isejbphs (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kirk Mango\Local Settings\Application Data\aavdlnfcy\emkkxtrshdw.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\a.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.

This stopped the popup on restart but no internet connection on IE, Firefox, or update of Mcafee. However, some other programs did connect (outlook email, etc.).

I then used Microsoftfixit50195 which brought my internet connection back completely - firefox, IE, Mcafee, etc.

I proceeded to your site and went through all the "Read Me First" & Windows XP Cleaning instructions all the way down to "Yes, I am still having problems" or "No, I am not having problems." I ran everything as told with the exception of mixing up the running of MGtools and Rootrepeal" (which I ran MGtools right before Rootrepeal, I mixed these two up but ran both).

I have connection and no problems (that I know of) presently) and was wondering if you might have a moment to check the logs and see if I have cleaned this properly and am safe presently. I know that you guys are very busy with all you do and would appreciate any help you could give.

Let me know if you need anything else or anything re-run.

All my best

km

PS - I will upload MGtool scans in reply to this thread.

km1a · Aug 22, 2010

Ok, MGTools zip file attached here. I am hoping I did everything correctly.

Again, thanks for any assistance.

chaslang · Aug 23, 2010

Welcome to Major Geeks!

Based on your logs, you are in pretty good shape now. Just one minor fix to do and then final instructions.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -

After clicking Fix, exit HJT.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

km1a · Aug 23, 2010

Thanks!!! Great Job. I bet you wish all where that easy !!!

Hey you guys here at Major Geeks are awesome. Someday I will find a way to donate money to you guys. You do need or accept donations, yes???

Three years from retirement so not really in the best position to do so yet, but someday I hope to be. It is the least I can do for all the FREE and superb help you guys do for everyone.

All my best

Kirk

chaslang · Aug 25, 2010

You're welcome. Surf safely.

km1a said: ↑

You do need or accept donations, yes???
Click to expand...

Support MajorGeeks with Geek Wear!

Log in or Sign up

Malwayre Popup scanner, is it fixed??

km1a Private E-2

Attached Files:

log.txt

mbam-log-2010-08-22 (20-18-12).txt

rootrepeallog.txt

SUPERAntiSpyware Scan Log - 08-22-2010 - 18-32-56.log

km1a Private E-2

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

km1a Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member