Multiple scans not working

Hello, gonff73.

We are currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m

 

Hello, gonff73


The below fixes are specific to your problem and should only be used for issue(s) on this machine. Also, please do not install any other software while we are still working with you unless instructed. Once we have given you the all clean and final instructions you will be free to install what you want.

Question:

• Is Rawr a program for comparing and exploring gear for games?

* You have installed an outdated SUPERAntiSpyware version. Uninstall your current version > run CCleaner > install and update the latest version.
SUPERAntiSpyware 4.25.1014 Final

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed

Step 2:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Step 3:
Now download The Avenger by Swandog469, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Step 4:
Run Ccleaner

Step 5:
Install the latest Sun Java Runtime Environment

Step 6:
Now try to install > update > and run:

• Spybot
• Malwarebytes' Anti-malware
• SUPERAntiSpyware
• ComboFix

Step 7:
Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).


Then attach the below logs to your next reply:

• Malwarebytes Anti-Malware log
  
• SUPERAntiSpyware log
• ComboFix.txt (normally C:\ComboFix.txt)
• C:\MGlogs.zip
• C:\avenger.txt

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!


dr.m

 

Please uninstall your AVG8 antivirus. It has an infection hooked into it
and it may also be getting in the way of us running various tools. Is saw the below hooked into AVG and many other running processes:

\globalroot\systemroot\system32\UACrqjrvkai.dll

After uninstalling it (and even if for some reason it does not uninstall) continue on with the below.

Now run this: Resetting Registry and File Permissions and make sure you reboot where it indicates.

In your first message you said you did not find the TDSSserv non-plug and play device. Please look again and also check for UACd If you find either of them, disable them only.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\user\Application Data\Macromedia\Common\f0f5e01c1.dll""
O4 - HKUS\S-1-5-19\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\f0f5e01c1.dll"" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\NetworkService\Application Data\Macromedia\Common\f0f5e01c1.dll"" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\f0f5e01c1.dll"" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\f0f5e01c1.dll"" (User 'Default user')

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now reboot into safe boot mode and do the below.

• Run avenger.exe (previously downloaded) by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner to remove temp files.

Now goto this link Using MGtools and download the new version of MGtools.exe from the black bold print link in the first sentence. Overwrite your previous MGtools.exe file with this one.


Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Hello again, gonff73

I strongly recommend that you clean up your Desktop immediately leaving only links. Do not store downloads, exe files, iso files....etc on your Desktop. First it is not a safe place to keep them (i.e., you may loose them due to malware, and a cluttered Desktop is an easy hiding place for malware), and last but not least it can have an effect on your PCs performance.

Step 1:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Step 2:
Run avenger.exe (previously downloaded) by double-clicking on it.

• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Step 3:
Run Ccleaner

Step 4:
Now install the latest Sun Java Runtime Environment

Step 5:
Run this: F-Secure Blacklight

• Save the tool as fsbl.exe to your C: directory
• Double-click fsbl.exe to run it
• SelectI agree to the license
• Choose Next, then Scan
• After the scan is completed, choose Next
• A logfile will have been created in the C:\ drive
• It will be named fsbl-xxxxxxxxxxxxxx.log where xxxxxxxxxxxxxxis the date and time of the scan
• Attach this log in your next reply

Step 6:
Now go to this link Using MGtools and download the new version of MGtools.exe from the black bold print link in the first sentence. Overwrite your previous MGtools.exe file with this one.

Step 7:
Now see if you can update and run Malwarebytes' Anti-Malware <--- renamed as MBAM.exe

Step 8:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Then attach the below logs to your next reply:

• MBAM log
• C:\MGlogs.zip
• C:\avenger.txt

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

dr.m

 

Hello, gonff73

Let's wrap this up....

An observation - Ad-Aware is becoming useless in detecting and removing malware...SAS & MBAM are far better tools.

*I don't see what you installed:
Sun Java Runtime Environment

*Delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp

*Run Ccleaner

----------------------------------------------------------------

Other than taking care of the above items - Your logs look good! If you are not having any other malware problems, it is time to do our final steps:

Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif

 

You're very welcome!

dr.m