Multiple Trojans, Did all Read & Run Me, Still Problems

Discussion in 'Malware Help (A Specialist Will Reply)' started by bizarredreams, Jun 29, 2008.

  1. bizarredreams

    bizarredreams Private E-2

    I am a soul lost in a sea of data and buttons. Please bear with my ignorance. I have followed the Read and Run Me directions as close as I am able and it seems to have rid my system of certain spyware, etc, but the results that seem to be occurring from malware are still happening.

    Let's Start at the beginning: Early this year Avira Anti-virus detected a few problems, which I quarantined and went along my business, thinking it had been dealt with. I am learning the hard way that I should have done much more. :) I read more details about them yesterday and noticed 2-3 were trojans. I deleted the quarantine list and my copy of the names has disappeared with it. I do have a couple. 1. TR/Dldr.WMA.Wimad.N A trojan located in http://www.fastmp3player.com. Yes, I was downloading illegal music and have also learned the hard way what I shouldn't do. 2. Virus or unwanted program 'HTML/Crypted.Gen [virus]' 06/04/08
    detected in file 'C:\Documents and Settings\Rebecca\Local Settings\Temporary Internet Files\Content.IE5\S6BTYQIH\a@Top1[1].htm.
    Action performed: Deny access.

    As the months moved on, weird things started to occur on my computer. Most notably, when I was online, every time an video type program such as an ad would try to start a pop-up would appear saying, "A Runtime Error has occurred. Do you wish to Debug? Line: any 4 numbers Error: object required" With a choice of clicking yes or no. I am not able to close it without clicking one or the other and sometimes it would pop up 30 times in a row. This slowly became worse. I thought there was something wrong with my computer programming, setup, whatever. I didn't understand that it was malware.

    Then, later every time I restarted the computer. Windows would not start and "Plug & Play Configuration Error" would appear. Control-Alt-Delete was the only way to get out and start windows.

    Eventually, the Plug & Play quit appearing and just a cursor would appear. The only way I could get around this was by clicking F2 quickly to enter setup and then escape after it reached setup 5 minutes later.


    I am now knee deep in fun and have done all of the steps for Read and Run Me. A few things have occurred. I tried to erase the multiple anti-spyware downloads, etc which I thought happened, but after restarting it said they were still running even though they were not listed on programs. In addition, any settings I reset for most programs would change when restarting.

    Also, the Runtime Error pop-ups seem to have disappeared though I haven't been online a lot. In addition, the Plug & Play Error has reappeared when restarting the computer.

    I know this is a long explanation, but I figure any info helps and it's better to give it now. Note: I only scanned the C drive, but have a removable hard drive? which I did not scan (wasn't sure). It is a backup drive that has mostly documents on it, but some programs. Someone set it up for me and copied early this year. I have it connected and running half/most of the time.

    I have attached the required items.


    Thank you for your help and patience.

    Rebecca
     
    Last edited: Jun 29, 2008
    bizarredreams, Jun 29, 2008
    #1
  2. Lev

    Lev MajorGeek

    Lev, Jun 29, 2008
    #2
  3. bizarredreams

    bizarredreams Private E-2

    MGlogs.zip
     

    Attached Files:

    bizarredreams, Jun 29, 2008
    #3
  4. bizarredreams

    bizarredreams Private E-2

    Weird, I thought I had them attached.
     

    Attached Files:

    bizarredreams, Jun 29, 2008
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    I'm going to give you a couple minor things to do further down but they have nothing to do with any problems you are mentioning. You do not have any remaining malware and nothing major was removed. I suggest that you post in the Hardware Forum since your Plug and Play error sounds like a BIOS setting has been changed.


    Uninstall the below software:
    Java 2 Runtime Environment Standard Edition v1.3.1_03
    Java(TM) SE Runtime Environment 6 Update 1
    Kazaa Media Desktop 2.1.1 <-- should have been uninstalled in step 1 of the READ ME

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - (no file)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O20 - AppInit_DLLs:
    O24 - Desktop Component 0: (no name) - http://images.picsearch.com/is?uBQRJC3V9VRx2LRDlp3PHg-bqVhWVU9rDDPhxz-a1Q0

    After clicking Fix, exit HJT.

    Now we need to cleanup from running the READ & RUN ME.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combo-fix" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    chaslang, Jun 30, 2008
    #5
  6. bizarredreams

    bizarredreams Private E-2

    Thank you very much for your help. I was called away out of town unexpectedly and do not have access to my computer for a few days, but will follow your steps as soon as I return. After reading your notes, my only concern is that I did delete Kazaa (I thought I did it correctly) as I was directed. I mentioned earlier that a number of programs which I deleted or changed were still there or returned when I restarted my computer. Is there a definite way to make sure Kazaa will be deleted?

    Thanks,

    Rebecca
     
    bizarredreams, Jun 30, 2008
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please clarify what you mean by "deleted". You should uninstall programs that you do not need and Kazaa should be uninstalled too. To us delete does not equal uninstall.
     
    Last edited: Jul 2, 2008
    chaslang, Jul 1, 2008
    #7
  8. bizarredreams

    bizarredreams Private E-2

    Sorry, that's what I meant, uninstall. I went to the Add/Remove programs in the control panel, found the program and uninstalled it. It went through the motions, then saying it was gone. It did the same thing with Comodo Firewall. I uninstalled it, the computer said it was gone, but the program was still there after restarting the computer. I will try to uninstall it again when I return and make sure to note the specific happenings and quotes the the computer responds with.
     
    Last edited: Jul 1, 2008
    bizarredreams, Jul 1, 2008
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay I'll be waiting for your response. Sometimes programs do have trouble uninstalling. This is not unusual and it is not always due to malware.
     
    chaslang, Jul 2, 2008
    #9
  10. bizarredreams

    bizarredreams Private E-2

    Hi,

    I made it back to my computer (if only for a few hours). I began the Java uninstall steps and it resulted in:

    1. When deleting Java 2 Runtime v1.3.1... it gave a checklist saying shared program files, standard program, folder items, program folders, program directories, and program registry entries were uninstalled. "Uninstall complete. Some elements could not be removed. You should manually remove items related to the application. I looked at the details and this was listed.

    "Unable to delete folder 'C:\Program Files\JavaSoft\JRE\1.3.1_03\lib\applet'.
    Unable to delete folder 'C:\Program Files\JavaSoft\JRE\1.3.1_03\lib'.
    Unable to delete folder 'C:\Program Files\JavaSoft\JRE\1.3.1_03'.
    Unable to delete folder 'C:\Program Files\JavaSoft\JRE'.
    Unable to delete folder 'C:\Program Files\JavaSoft'."

    2. It seemed to uninstall the Java (TM) SE Runtime Environment 6 Update 1 correctly b/c I did not receive any pop-ups or responses.

    3. Should I uninstall the Java (TM) 6 Update 5?

    4. When clicking on Kazaa Media Desktop 2.1.1 to "change/remove" a popup appeared with RUNDLL at the top and saying "Error loading C:\Windows\System32\cd_clint.dll. The specified module could not be found."

    5. I did not continue with the next steps b/c I figured I needed to finish these first.


    Thanks a lot for giving up your extra time to help me.
     
    bizarredreams, Jul 3, 2008
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Only if you wish to install the current version (6 update 10) from the link in the READ ME.


    Just do the below which should get rid of remaining entries for Kazaa and old Java.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.
    Then delete the below folders if they exist:
    C:\Program Files\JavaSoft
    C:\Program Files\Java\\jre1.6.0_01
     
    chaslang, Jul 4, 2008
    #11
  12. bizarredreams

    bizarredreams Private E-2

    Okayyyy, I think we have a winner! I have followed your steps and


    1. Registry Editor

    “Information in C:\Documents and Settings\Rebecca\Desktop\fixme.reg has been successfully entered into the registry.”

    The folders did not exist which you said to delete if they were there. (Java Soft, etc)

    I added the Java 6 Update 10 from Read Me and deleted version 5, the program erased off the list, but there was no success message.

    2. I fixed the specific 03, 09, 020, 024 from HJT.

    3. The 2nd fixme.reg was successfully entered into the registry.

    4. Question- Is there any reason to not erase the programs downloaded from Run and Read Me (combofix, mgtools, HJT, etc)? That is my next and final step.

    5. I got the other problems fixed from Dell. Yes, it was the BIOS. As explained to me the processor was getting stuck at the printer before hitting the hard drive so made it start with the hard drive. Yeah!
     
    bizarredreams, Jul 7, 2008
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    As stated in my final instructions in message # 5, you need to clean all of this up. You should not keep them since they change all the time and you really always need to be sure that you have the current versions to run. In fact, after a month or so, ComboFix will even tell you it has expired and will self-uninstall it you attempt to run it once expired.
     
    chaslang, Jul 8, 2008
    #13

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds