Need Help Removing Malaware, Kind of Stuck

ocanyc · Dec 4, 2008

I wish it was as easy as doing a search for a post similar to your issue but it seems for the most part everyones issue is different or how they've gone about handling it. Let me just start by saying that I'm kind of stuck at the moment and am at work. The issue is with my Dell laptop at home. I've been running McAfee AV/Firewall protection for a year or so and I guess that wasnt good enough. Here is what I think I've found and done so far.

1. Downloaded Adware 2008, cant update it as malaware wont let me. I ran it as is and found like 33 things, but removing all that didnt help.
2. Downloaded CCleaner, and cleaned things up. That didnt help. I disabled soem unrecognizable programs at startup. Doubt that worked.
3. I found that getmodule30.exe with ccleaner and disable this at startup. I think that worked not 100% sure.
4. I found the winweb security process and removed the program, and deleted the registry entry for it.
5. Tried to download malawarebytes anti-malaware and couldnt get it to run the install. Not sure how I finally got it to install from a usb stick and then it doesnt even run.
What ever malaware virus I have is really good.
6. I then read to try cureit, and then try to run the anti-malaware. I got cureit on my laptop and that doesnt want to run properly.

I know I fixed maybe one symptom, but others definitely remain as my firefox and ie browser keep getting redirected and just pop-ups keep coming. I got the blue screen of death a couple of times as well. I cant update any software says it cant connect, and some web addresses I try wont connect as well. This malaware has definitely taken over.

So as you guys can see, I'm not getting far. What basic steps should I take now so that you guys can guide me to a solution? Thanks in advance. Seems like a great forum and I plan to learn to not only help myself in the future but others as well.

ocanyc · Dec 5, 2008

BTW, I tried the READ & RUN me first but the furthest I got was uninstalling the java. I tried to install new version and said it wasnt a valid win32 application. I restarted my computer and it wont boot up all the way. I mean the desktop comes up but doesnt get all the icons on the bottom right on the taskbar like the network connections. Before I even uninstalled java yesterday I had to reboot it like 6 times until it finally booted up completely. I believe I tried to boot up in safe mode and that wouldnt boot up all the way. Any suggestions would be appreciated, thanks.

TimW · Dec 6, 2008

We need to get you up and running in order to help you with the malware, so try doing this:

Here is the link to the MS article How to recover from a corrupt registry.

ocanyc · Dec 8, 2008

Ok thanks for the reply. I got up and running before I heard a reply here. I disabled the tdsserv driver, and ran malaware bytes. Then I proceeded with the READ & RUN. I'm attaching my logs and I'll await further instructions

ocanyc · Dec 8, 2008

Please let me know if I'm missing any logs. Thanks, I tried to follow all instructions under READ&RUN precisely.

TimW · Dec 8, 2008

You are looking much better....just a few things to deal with:

Please disable all anti-virus and anti-spyware programs while we do the following ( be sure to re-enable when we are finished):

Run C:\MGtools\analyse.exe by double clicking on it. (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O20 - AppInit_DLLs: rpbryx.dll
Click to expand...

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

After clicking Fix, exit HJT.

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Click to expand...

Let me know if you get a success message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.

ocanyc · Dec 9, 2008

Hi TimW, thanks for your assistance. I'm attaching the updated MGlogs.zip file. Just a question, what did I fix by doing this last step. I understand I removed that rpbryx.dll file but what harm was this file doing? Thanks again

TimW · Dec 9, 2008

The file was left over from the infection. Your logs look good and clean now.

If you are not having any other malware issues, then:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection, but are effective as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

Log in or Sign up

Need Help Removing Malaware, Kind of Stuck

ocanyc Private E-2

ocanyc Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ocanyc Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 12-07-2008 - 22-57-29.log

mbam-log-2008-12-08 (00-07-15).txt

ComboFixLog.txt

ocanyc Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ocanyc Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member