Mouse seems to be controlled by someone else

Discussion in 'Malware Help (A Specialist Will Reply)' started by cinderedna, Jan 29, 2009.

  1. cinderedna

    cinderedna Private E-2

    I scanned and will post logs---I just got a scan report from my Zone Alarm fire alarm that said my computer has win32.backdoor.bifrost
     
  2. cinderedna

    cinderedna Private E-2

    Another log attached plus Spybot showed:

    FunWeb
    Smitfraud-C.gp
    FunWebProducts
    MyWay.MyWebSearch
    Smitfraud-C.
     
  3. cinderedna

    cinderedna Private E-2

    MGLogs attached
     
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  5. cinderedna

    cinderedna Private E-2

    OK I'll try again.
     
  6. cinderedna

    cinderedna Private E-2

    It is saying they are already attached again. Can you see them now?
     
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You failed to mention that you had attached the logs in this thread:
    Lose control of Mouse, and icons disappear after booting up

    Please use add/remove programs to uninstall:
    J2SE Runtime Environment 5.0 Update 6

    I strongly advise you to cleanup your Desktop. Remove everything but links to run programs. Do not download and save programs here and definitely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing.

    I also suggest that you don't have two users with Admin. privileges.

    Now let's use ComboFix to remove a bunch of malware files.

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    o If it is not on your Desktop, the below will not work.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::
    
    Drivers::
    MEMSWEEP2
    
    File::
    c:\windows\system32\21.tmp
    
    Registry::
    [-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
    
    
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Combo to this thread.
     
    Last edited: Jan 30, 2009
  8. cinderedna

    cinderedna Private E-2

    Hi thanks Tim.

    OK I deleted the thing from Add/Remove and I cleaned up my desktop.

    How do I change the Administrators?

    and where is the Notepad I need to open to copy and paste the notes into?
     
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You go to the control panel and click on Users....click on the user account you want to change and and choose change account type.

    Note pad can be assessed by going to start / accessories and scroll down to notepad.

    Of you can find it here:
    C:\WINDOWS\notepad.exe
     
  10. cinderedna

    cinderedna Private E-2

    Hi Tim,

    OK I did it. Did they attach?
     

    Attached Files:

  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean.......as to your mouse problem, I am assuming that it is not wireless.
    If it is, then you need to check that no other mice are on the same frequency. ( like a neighbor or other computer user). This is something to pursue in the software section.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
  12. cinderedna

    cinderedna Private E-2

    Hi Tim,

    OK I just uninstalled Combofix per your instructions. I don't have Vista so should I still unintstall MGtools?

    Also I noticed when I was running the programs and shut off my Avast and Zone Alarm that it said I also had Avira Antivir on but I got rid of that a long time ago. How can I find the remnants to delete?

    Also I have a few things on my desktop that I don't know what they are. Do you?

    1. 337228_ENU_i386_zip.exe I just double-clicked on it and it says: "This publisher could not be verified. Are you sure you want to run this software?"

    2. zapSetup_en.exe by CheckPoint Software Technologies

    3. install_flash_player.exe by Adobe
     
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    There is nothing in your logs to indicate you do or once had Avira. So ignore that.

    337228_ENU_i386_zip.exe ----> was this the file you put there to drop on Combo to install the recovery console? You can right click that and choose delete.

    zapSetup_en.exe by CheckPoint Software Technologies ---> something you downloaded (Zone Alarm set up file) ...again right click and delete.

    install_flash_player.exe by Adobe --> click and install it.
     
  14. cinderedna

    cinderedna Private E-2

    OK thanks for all your help, Tim. You're the best!
     
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    No problem.....safe surfing. :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds