many problems

Hi there and welcome. I am currently reviewing your logs and will get back to you with a set of instructions in the next post I make to you.

 

1. Please go to Add/Remove programs and uninstall the following software:

• YouTubeMP3Downloader 2.0 <--- we will see how things go after uninstallation.
• IObit Security 360 <--- uninstall this as it is currently on a list of rogue software
• WinPcap 4.1.1 <--- if you did not knowingly install this yourself then please also remove.

2. Before we continue I would like for you to ensure that MGTools.exe is indeed directly on your C Drive and not in any other location, such as below:

3. Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix exit HJT.

4. Please go to Jotti's malware scan

(If more than one file needs scanned they must be done separately and logs posted for each one)

• Copy the file path in the below Code box:
  
  Code:

  c:\windows\system32\GSService.exe

• At the upload site, click once inside the window next to Browse.
• Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
• Next click Submit file
• Your file will possibly be entered into a queue which normally takes less than a minute to clear.
• This will perform a scan across multiple different virus scanning engines.
• Important: Wait for all of the scanning engines to complete.
• Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.

Then do the same for the below files and also let me know the results:

Code:

c:\windows\system32\SpOrder.dll
c:\windows\system32\VistaInfo32.dll

5. Could you please get this: GSService.exe into a zipped file and attach it for me in your next post? To do this, see the below:

Please go to start > Run and paste in the following from the quote box:

log retrievable @ C:\collect.zip

6. Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

Code:

KILLALL::

File::
c:\windows\winstart.bat
c:\windows\S84A2036F.tmp
c:\users\Becky\EMPTIES.BAT
C:\Windows\system32\empty.ico

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
  
  
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

7. Go to TDSSKiller and Download TDSSKiller.zip to your Desktop

• Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
• Click Start > Run and copy/paste the following bold command into Run box and hit Enter.

"%userprofile%\Desktop\TDSSKiller.exe" -v

• Follow the instructions to type in "delete" when it asks you what to do when if finds something.
• When done, a log file should be created on your C: drive named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply.

8. Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Combofix.

9. Let us know of any problems you may have encountered with the above instructions

10. Also let me know how things are running now!

 

Slowness/sluggishness is not always because of malware.

Does your homepage still get set to googlebreak.com or after we used HJT have you no longer been having that problem?

Is it's icon still missing today? Combofix did nothing to hurt MSSE. Reboot the machine and open up it's program. Does all appear to run okay now? I don't see it in your start up list in the hijack this log and it should be loading at start up as this is your protection software.

I am not seeing any malware in your logs. You can use Windows Explorer to locate and delete the below bold file 0 bytes in size (let me know if successful)

I am curious to know why your C Drive is crammed with various files, although I do not think this is topic for the malware forum. Hang in there, I'm trying to find information.

 

Good.

Just coincidence. Here are a couple of things you can try besides reinstalling it which would be a little drastic until we have at least tried other methods.

1. check in services, make sure it's service set to automatic.

2. See this link for how to add a program to your start up.

I think something is still lurking...

What problem are you referring to? Does firefox persist in crashing?

Not a problem. Let's do this for now because I suspect you may have an MBR infection:

I suspect a Master Boot Record infection. We will need to boot to the Recovery Console to remove this infection.

Now boot to the Recovery Console and run the fixmbr to clear a Master Boot Record infection that you have.

You can read the below to help you do this:

http://support.microsoft.com/kb/307654


After running the fixmbr command and boot back to normal mode, continue with the below.


Run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

How is the machine behaving now?

 

My suspicions about the MBR infection were wrong. In answer to your question, yes, I do see some files on the C Drive that do look suspicious, however you or I must not take any actions to delete anything until I have spoken to Chaslang. It may NOT be malware related but I very much think it is possible.

Thanks for your patience.

 

Please be patient. I have to speak to Chaslang regarding this. We do NOT want to make any sudden moves as already stated. You said yourself that last time you deleted some of these files you had to reinstall windows...so patience...

 

Hello there. I have spoken to Chaslang who thinks we are best to do the below now:

I see you already uninstalled YouTube MP3 software so let's now do this:

Back up your firefox bookmarks > uninstall Firefox > reboot the machine > remove any leftover firefox folders such as

Then reinstall Firefox.

See how things are running after that.

 

What is extremely slow? Your PC or FireFox?

 

1. Could you please get this: C:\regedit.exe into a zipped file and attach it for me in your next post? To do this, see the below:

Please go to start > Run and paste in the following:

log retrievable @ C:\collect.zip

2. Please go to Jotti's malware scan

(If more than one file needs scanned they must be done separately and logs posted for each one)

• Copy the file path in the below Code box:
  
  Code:

  C:\regedit.exe

• At the upload site, click once inside the window next to Browse.
• Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
• Next click Submit file
• Your file will possibly be entered into a queue which normally takes less than a minute to clear.
• This will perform a scan across multiple different virus scanning engines.
• Important: Wait for all of the scanning engines to complete.
• Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.

3. Now I want you to put a shortcut to notepad and wordpad in your Send To folder so you can right click and use Send To notepad or wordpad.

Then navigate to the following file C:\$IJE9MQ7.ini > right click it > choose to open with wordpad > then go to edit > select all, save the file somewhere handy and attach it here.

4. Also right click the file > check properties and let me know what you find.

 

You appear to be extracting thousands of files to the root folder of drive C. You seem to be extracting from archives (like ZIPs or RARs) and may be putting all the file for installers there. Perhaps you are even downloading and saving all files there. This is a VERY VERY BAD idea and may even be why your PC is running slow. You MUST stop doing this immediately.

This is really not a malware problem; however we will attempt to help you with it. Care needs to be taken in deleting all these files. You cannot just highlight and delete all files there because some valid system files are also located there and must not be deleted.

I will try to post a starting fix for you later which will be a batch file that will be used to begin the cleanup.

 

You don't need to do what Kestrel13! requested in message #17. Just do the below.

Download and save the below to your PC (save it anywhere you can find it. The Desktop is fine). Then double click on it to run it.

ClnRoot.bat

If you get any error messages, let me know exactly what they are.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).



Then attach the below logs:

• C:\MGlogs.zip

 

You better check your programs like 7-Zip or similar before using them again. Some one who uses this PC is putting the files there. Perhaps unknowingly but that would be due to not looking at the settings of the programs being used to take notice of where things are being saved. Also perhaps a backup program of some sort we used and it saved them here or restored them here due to being improperly setup.

Let's continue!


Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You will have to be a lot more specific. You need to tell me exactly what you are referring to. Also you could run GetLogs.bat again and attach a new log so I can see if anything new showed up at C:\

Temp files are always being created by Windows and other programs in system TEMP folders which may be what CCleaner removed. Also cookies are being created while you surf and CCleaner will remove them too.

As stated previously, your problems were not due to malware and really are not a topic for this forum. You can see for youself what happen after removing all those non-malware files that were saved where they should not be saved.

Until I know exactly what files you are referring to and where they are, I cannot comment. Are you using any kind of backup software and if so, where is it saving files to? When you download files, where do you save them to? When you extract files from ZIPs, RARs,....etc , where do you extract them to?

 

Your logs are fine. Nothing new showed up in the root folder of drive C

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!