Need Help with tough Virus

moviejava · May 24, 2009

This virus redirects my browser to other search results and blocks all downloads to virus updates. I followed the cleaning procedures. Your help and review of the logs is greatly appreciated. I'll try and post a hijack log following this post. thanks in advance!

moviejava · May 24, 2009

Here is the hijack log.

dr.moriarty · May 25, 2009

Welcome to MajorGeeks!

* On a quick look - McAfee Virus and Spyware Protection Service shows in your "Uninstall Programs list"... but you have in a span of 4 days apparently installed and un-installed:
AVG
Alwil Software
TrendMicro

** I caution you to not make any more changes while I review your logs - there are probably remnants leftover from these that are also giving you problems!

I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m

dr.moriarty · Jun 3, 2009

Hello, moviejava

The below fixes are specific to your problem and should only be used for issue(s) on this machine. Also, please do not install any other software while we are still working with you unless instructed. Once we have given you the all clean and final instructions you will be free to install what you want.

*You need run MSconfig and put your PC into normal startup mode as requested in step 1 of the READ & RUN ME.

Msconfig must be set for Normal Startup mode

*Note! It appears that you currently have NO Anti-Virus program installed on this machine, after all of the installs and uninstalls. Did you run this to cleanup after uninstalling AVG?
AVG Remover <--- If not - please run it > re-boot > then run it again.

* There appears there's nothing major to do after the scanners - let's do some tidying up:

Step 1:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
Click to expand...

After clicking Fix, exit HJT.

Step 2:
Open CCleaner - select "Cleaner" > "Run Cleaner" <---use this function ONLY!

Step 3:
Now go to this link MGTools and download the new version of MGtools....overwrite your previous MGtools.exe file with this one.

Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Step 4:
Please attach the below logs to your next reply:

C:\MGlogs.zip

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

dr.m

moviejava · Jun 4, 2009

Thanks for putting up with me. I'm generally a patient guy, but when it comes to these dang virus' messing up my computer it is certainly nerve racking.

I was able to run the avg remover as requested. Although I couldn't access that download site and was able to find the program through another server. Something on this computer is preventing me from downloading virus updates or virus removal related software from the internet. But, I was able to run avg remover.

The following did not show up in the hijack this scan:

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

Hate to admit it, but I probably removed them on my own at some point. I did remove a couple items using hijack this fix around the time of of my last email.

cccleaner ran fine.

finally, mglogs.zip was created fine after updating the mgtools.exe as requested.

Just want to mention that I appreciate your helping me. I'm done trying to fix this on my own. so from here on out. I'll wait patiently to see what you can suggest.

Thanks,
Kerry

moviejava · Jun 14, 2009

We can put this problem to rest. The IT guys in my office took a look at my computer and used an IE fix to correct the windows explorer issues and the problem has been resolved.

Thanks for all your help.,
Kerry

dr.moriarty · Jun 14, 2009

You're welcome!

Log in or Sign up

Need Help with tough Virus

moviejava Private E-2

Attached Files:

combofix_log_safemode.txt

mbam-log-2009-05-24 (11-24-21).txt

MGlogs.zip

SUPERAntiSpyware Scan Log - 05-24-2009 - 11-52-32.log

moviejava Private E-2

Attached Files:

hijackthis_5-24-09.log

dr.moriarty Malware Super Sleuth Staff Member

dr.moriarty Malware Super Sleuth Staff Member

moviejava Private E-2

Attached Files:

MGlogs.zip

moviejava Private E-2

dr.moriarty Malware Super Sleuth Staff Member