Need Some advice

Discussion in 'Malware Help (A Specialist Will Reply)' started by Doctor93, Aug 25, 2008.

  1. Doctor93

    Doctor93 Private E-2

    :wave

    Yesterday I found that I had trojan-downloader-zlob. I found the post here on your site for Malware removal and followed Chaslang direction to do the neccessary clean up.

    I want to thank him for the post very much because after following the steps of house cleaning and setup, enabling viewing of hidden files, I began the cleaning procedure for my Windows XP.

    Now my question that I have that I need advice with.
    I used the first three programs recomended for clean up:

    SuperAntiSpyware
    SPYBOT
    Malwarebytes anti-malware

    All of them were successful and removed the Malware from the files.

    When I attempted to run combofix.exe I had an issue getting it to run for me. I believe because I missed some of the proper steps.

    So this morning I reran the SuperAntispyware and Skybot adn neither found any malware intrusions.

    Should I still go through the process of Combofiix.exe and using MG tools or do you believe that with the orginal three steps and the housecleaning I may have removed everything?

    I was not going to run the last two, if there was not a need.

    Thanks for listening and for your expert advice!:)
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    We cannot answer this without seeing the logs.

    Attach the logs from SUPERAntispyware and Malwarebytes. Skip ComboFix and attach the log from MGtools and we will decide from this is ComboFix needs to be run.
     
  3. Doctor93

    Doctor93 Private E-2

    Hi,

    I did run MGTools as requested. I have now attached the attached files and logs as you directed me to:

    The superantispyware log
    The Malwarebytes log
    and the MGlogs.zip

    The logs are the most current run now after the cleanup.

    Please review them and direct me what further actions that you recomend that I may take.

    Thank you very much for your help and assistance.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Uninstall the below old versions of Java as requested in step 1 of the READ & RUN ME:
    J2SE Runtime Environment 5.0 Update 6

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {0BD44AB1-76A7-4E05-92F4-4B065FE72BD6} - C:\Program Files\Applications\iebt.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O22 - SharedTaskScheduler: enorganic - {8dc71747-ace0-40c1-8947-54f107d0639b} - (no file)

    After clicking Fix, exit HJT.

    Now reboot your PC.

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Also delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\Dale Roberson\Local Settings\Temp

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below log:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  5. Doctor93

    Doctor93 Private E-2

    Ok...Here is the latest update....

    First while I awaited your last reply I began to protect myself further from malware attacks. So I updated windows. Then I renewed my McAfee internet security suite with firewall. Next I loaded the spyware blaster.

    The I adjusted my active x security settings. Then I installed Firefox.

    When I received your reply I completed all the steps that you requested.

    Attached is the current MGlogs.

    Please review and let me know if any further action you might see may be required.

    Thank you again for your help!
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Your logs are clean but you did not install the Sun Java update as requested (you will need Java on many websites) and you did not remove all the files from your Temp folders either.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\combofix folder from combofix (if it exists)
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds