MGtools problem

Discussion in 'Malware Help (A Specialist Will Reply)' started by agc2104, Dec 11, 2010.

  1. agc2104

    agc2104 Private E-2

    Hi,

    I am in the middle of the Malware Removal procedure [Read Me and Run] at the MGtools step. I have Windows XP. I have a problem similar to one posted on 3/14/10 by moomoocow.

    When I run MGtools.exe, what appears to be a command prompt window pops up and disappears almost instantaneously. Nothing else seems to happen.

    I saw that TimW gave moomoocow the following advice:
    " cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
    GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
    ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see."

    I ran that and I get the following error.
    ' .cfxxe; .COM; .EXE; BAT; .CMD; .VBS; .JS; .JSE; .WSF; .WSH' is not recognized as an internal or external command, operable program or batch file.

    Thanks so much for your help.
     
    agc2104, Dec 11, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Have you tried renaming it? Have you tried to run it in safe mode? Can you run the other requested scans?
     
    TimW, Dec 11, 2010
    #2
  3. agc2104

    agc2104 Private E-2

    Hi,

    Yes, I can (and have run) the other requisite scans. I had tried renaming it and that had not worked. I just ran it through safe mode's command prompt. For some reason, while in safe mode, I was not able to see any start menu. Perhaps explorer wasn't working?

    Thanks. I will now post all my log files in another thread.
     
    agc2104, Dec 11, 2010
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    NO!!! Post your logs in this thread!!!!
     
    TimW, Dec 11, 2010
    #4
  5. agc2104

    agc2104 Private E-2

    Hi,

    My mistake. I'll post it here instead. Anyway, I have gone through the steps of the Read and Run Me guide.

    My symptoms are as follows:
    1) Redirecting: About 50% of the time when I click on a search result, I am redirected to various other websites.

    2) Pop-ups: I repeatedly get IE pop-ups. Often times the display pre-searched results about random popups or redirecting.

    3) Deleted files: All the files under most sub-folders of the \My Documents\ directory have been deleted. I checked the full extension (C:\...\My Documents\...) and this is still the case.

    Notes - I have Windows XP, and I use Chrome as opposed to Firefox / IE.
     

    Attached Files:

    agc2104, Dec 11, 2010
    #5
  6. agc2104

    agc2104 Private E-2

    And here are the second set of logs.
     

    Attached Files:

    agc2104, Dec 11, 2010
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do you know what these are>
    c:\windows\system32\atlrgwiz.dll
    c:\windows\system32\printrgwiz.dll

    Please rename C:\MGTools.exe to C:\Magpie.com and see if it will run. ( I am not seeing where you downloaded it to your C: drive ).

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

Driver::
dnnkmwvy
jbqmzdqk
teokgfdd

File::
c:\windows\system32\drivers\vjlvacva.sys
c:\windows\system32\drivers\ptdqmcyv.sys
c:\windows\system32\drivers\teokgfdd.sys
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the previous file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now try running the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip
     
    TimW, Dec 11, 2010
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I thought you could not run MGTools, but I see you attached it as I was replying to you. Give me a few minutes to review the logs. I will get back with another set of instructions. Just wait for it.
     
    TimW, Dec 11, 2010
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    OK, now that we have got full logs, let's do this:

    First, is this what you renamed MGTools.exe --> C:\blahblah.exe ?

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

Driver::
dnnkmwvy
jbqmzdqk
teokgfdd

File::
c:\windows\system32\drivers\vjlvacva.sys
c:\windows\system32\drivers\ptdqmcyv.sys
c:\windows\system32\drivers\teokgfdd.sys
c:\windows\system32\atlrgwiz.dll
c:\windows\system32\printrgwiz.dll
C:\Documents and Settings\A run\Local Settings\temp\ATLRGWIZ
Folder::
C:\Documents and Settings\A run\Local Settings\temp\ATLRGWIZ
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the previous file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Dec 11, 2010
    #9
  10. agc2104

    agc2104 Private E-2

    Hi,

    Sorry for the slow response. I missed your second email and thought one had never come. Yes, I had renamed the file blahblah.exe, but anyway I changed it to Magpie.exe just to be clearer.

    I ran the procedure per your instructions.

    One caveat:
    I disabled all my anti-spyware stuff, avast 5.0 (my antivirus software), and my firewall. This version of avast is a little annoying to disable, but I followed the procedure that I found online. I followed an article "How Avast! 5.0 Antivirus can be Temporarily Disabled" on Imbacore's blogspot. Despite this, ComboFix thought that there was some component of Avast still running or enabled, Avast itself and Windows seemed to disagree. I have no explanation for this.

    How things are working now:
    I have tried a number of google searches and haven't had any problems yet with redirection and pop-ups, nor do I see copies of rundll32.exe floating around in the processes tab of the task manager. I guess these are all good signs, but I'm not ready to call the game just yet. Of course, I'll leave that to you, after you take a look at the logs.

    I have attached the logs that you asked for.

    Thanks for all of your help!
     

    Attached Files:

    agc2104, Dec 12, 2010
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looking much better, though we have just a couple of things to deal with.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

Driver::
aylnlfdx

File::
c:\windows\system32\drivers\phqghume.sys
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the previous file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Dec 12, 2010
    #11
  12. agc2104

    agc2104 Private E-2

    Ok. New files attached.

    Thanks.

    By the way, I have 2 partitions. Should I be repeating this on my D: drive?
     

    Attached Files:

    agc2104, Dec 12, 2010
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean.. What is your D: drive? Is it just a backup partition? You can run MBAM and have it do a deep scan and include that drive in the scan. Let me know what it finds and tell me what issues you are having, if any.
     
    TimW, Dec 13, 2010
    #13

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds