MBR virus - HelpAssistant

CKL · Mar 9, 2010

I have previously (before finding these forums) run SuperAntiSpyware and Malwarebytes. The second one had found different problems and supposedly fixed but I continued to have problems although further scans didn't show the same trojans. I found these forums with similar problems and have followed the directions to the best of my ability.
Running WinXPhome - don't have a user "Help Assistant" listed in user accounts in Control Panel, but have the folder in Documents and Settings and it is replicating "my name" folder. After running above programs and supposedly fixing, I deleted the folder. However it still reappears when booting up the computer. I have followed all the instructions in the "Read Me First" to the best of my ability and am attaching the logs. I had been using another computer to download and transfer the other programs to the "sick" computer until I needed to download the recovery console. I then reconnected the sick computer to the internet to finish up the required steps.
When running MGtools, I got an error that was not exactly as shown in the "possible problems". It seemed to continue to run however, and I just clicked on "ignore". I am also included the jpeg of that error.

Besides taking up very limited hard drive space, the biggest problem is that it first caused worry because I got "sign-in" screens at banking sites asking for all my information - which I knew was not correct. I could get past these screens. This first alerted me to a possible infection.

TIA for any insite you can give me. I realize I will probably have to run the fix for the MBR but wanted to get further info here first.
CKL

CKL · Mar 9, 2010

Attaching the remaining log here, but couldn't find the jpg of the error I enountered. May have goofed up that save.
Please Help Me! and THX!
CKL

TimW · Mar 10, 2010

Please download HelpAsst_mebroot_fix.exe by noahdfear and save it to your Desktop.

Double click HelpAsst_mebroot_fix.exe to run the tool.

When the tool completes it will inform you HelpAssistant was successfully removed, or it may require a reboot. DO NOT reboot at this point if it tells you this. Do the below first.

With Windows Explorer, navigate to the C:\MGtools folder and double click on mbrfix.bat ( If not sure how to use Windows Explorer, you can optionally click Start > Run and enter C:\MGtools\mbrfix.bat into the run box and click OK. ) This will run quickly flashing a black screen in front of you too fast to read.

NOW REBOOT!

After reboot run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the new C:\MGlogs.zip file

Make sure you tell me how things are working now!

CKL · Mar 10, 2010

So far...... so good! Maybe time will tell for sure? May be more to clear up? I have a program that alerts me when something tries to put itself in the start-up and I was leary about things that came up. They were "quarantined" for now while I investigate if I had actually installed a program that "logs keystrokes". I actually may have when I was was going to automate some things I did repeatedly, but never got around to finishing the project. It may have showed up now because of running config.sys in normal mode.

Thanks for all your help so far! Attached is the new zipped file that was requested

TimW · Mar 11, 2010

The infected files are still showing, so please download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\WINDOWS\Temp\$$$dq3e
C:\WINDOWS\Temp\$67we.$
C:\WINDOWS\Temp\xsw2
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

CKL · Mar 11, 2010

Thanks again Tim!
Yes - I saw those files also - (and in another thread) but figured you would direct me exactly how to delete/clean them.
I am attaching the logs as directed.
however - and please don't be upset with me if we have to do some things over. I am running Anvir Task manager - and although I used msconfig (not config.sys ) to run in normal (not selective) startup, I don't think I disabled Anvir - so not sure if everything showed up like it should?
It IS running great - and "just looking" in things like system event viewer, I saw that there were NO HelpAssistant or Anonymous log-ons today.

TimW · Mar 11, 2010

Very good!!

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

CKL · Mar 11, 2010

Thanks again Tim! This site is GREAT - as are you.
Still nervous about what damage may have been done with someone else apparently able to access my computer, but I will try to be on my toes.
After 25+ years with a computer, this is the worse thing that has happened.
It used to be "fun"

Bye for now - and hopefully won't need your help again!
:wave

TimW · Mar 12, 2010

You are most welcome. Safe surfing.

Log in or Sign up

MBR virus - HelpAssistant

CKL Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 03-09-2010 - 19-04-13.log

mbam-log-2010-03-09 (21-08-20).txt

ComboFix.txt

RRreport2.txt

CKL Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

CKL Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

CKL Private E-2

Attached Files:

avenger.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

CKL Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member