Numerous malware & configuration changes.

Welcome to MajorGeeks, tadpole!

I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m

 

Hello, tadpole

Question: Are you working a malware thread on another forum? I see other scanning tools and logs - OTL.exe / C:\Rooter$ / C:\Program Files\dds.scr / etc.

Note: While we appreciate that you very likely posted at multiple forums in order to ensure a response, in the future please do not cross-post. Resources that help perform malware removal are very precious and very limited, and cross-posting only serves to tie up the time of multiple helpers who could be using that time to help someone else who also has problems. If you wish to work this here on Major Geeks, then please post messages at all other forums where you have posted asking them to close the threads so that you do not waste anymore resources on duplicate work.

In the future - choose one forum and stick with that one until they've resolved your problem.

I will wait for your reply while I am still going over your logs....

dr.m

 

Hello, tadpole


The below fixes are specific to your problem and should only be used for issue(s) on this machine. Also, please do not install any other software while we are still working with you unless instructed. Once we have given you the all clean and final instructions you will be free to install what you want.

Questions: Is your copy of Spyware Doctor a paid program or a free trial that does not fix anything? Did you knowingly install FriendFinder Messenger 4 Is it working properly?


Step 1:
You have a very old version of FireFox installed - Mozilla Firefox (2.0.0.13)
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Now we need to use ComboFix to tidy up some.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Make sure you have shut down all protection software (antivirus, antispyware, firewall...etc) programs so they do not interfere with the running of ComboFix. *Remember to re-start them before coming back online.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
  If it asks you to overide the previous file with the same name, click YES.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Step 3:
Open CCleaner - select "Cleaner" > "Run Cleaner" <---use this function ONLY!

Step 4:
Now install the latest Sun Java Runtime Environment

Step 5:
Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Step 6:
Please put a copy of the C:\Users\tadpole\AppData\Roaming\Microsoft\Installer\{56B29499-A2B7-44F4-834E-EC5C18C47311}\_69525f90.exe file into a ZIP file and attach it here for me to look at.
If you don't know how to ZIP a file, you can do the below.

• Go to start > Run and paste in the following:
  

Please attach the below logs to your next reply:

• C:\MGlogs.zip
• C:\combofix.txt
• C:\collect.zip

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

dr.m

 

:major

Thanks for the explanation of your present problem, tadpole. I'm off to work this morning and will work up a plan of action late tonight.

dr.m

 

Hello, tadpole

Your surfing habits of adult sites may have corrupted your operating system. Delete all of those "URL" from your Desktop and stop accessing sites like this. *They may be the cause of your current problems which may not be fixable other than by a reinstall.
I strongly recommend that you clean up your Desktop immediately leaving only links. Do not store downloads, exe files, iso files....etc on your Desktop. First it is not a safe place to keep them (i.e., you may loose them due to malware, and a cluttered Desktop is an easy hiding place for malware), and last but not least it can have an effect on your PCs performance.

Step 1:
Your system has also been messed up by installing too many conflicting security programs.
Please run the below special removers, re-boot, then run them again.

A. Norton Removal Tool
Norton Removal Tool (SymNRT) 2009.0.5.26

B. AVAST! Uninstaller -
avast uninstall utility

C. AVG Remover(32bit) and (64bit)
AVG Remover

D. Try using this for removing Spyware Doctor, Firefox, and the old Java files.
Your Uninstaller! 2008

Step 2:
Using Windows Explorer - navigate to and delete the following:
C:\Users\tadpole\AppData\Roaming\Microsoft\Installer\{56B29499-A2B7-44F4-834E-EC5C18C47311}\_69525f90.exe
C:\Users\tadpole\AppData\Roaming\Microsoft\Installer\{56B29499-A2B7-44F4-834E-EC5C18C47311}\_2cd672ae.exe
C:\Users\tadpole\AppData\Roaming\Microsoft\Installer\{56B29499-A2B7-44F4-834E-EC5C18C47311}\_16496df1.exe


Step 3:
Open CCleaner - select "Cleaner" > "Run Cleaner" <---use this function ONLY!


Step 4:
Please attach the inetpub logs where you suspect the presence of a hacker.(copy & paste them into a Notepad.txt or do a screencapture)

Step 5:
Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Please attach the below logs to your next reply:

• C:\MGlogs.zip
• inetpub logs

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

dr.m

 

Hello, tadpole

After conferring with our top malware expert - we cannot find anything in our logs to indicate any problems with a hacker. If you are currently experiencing problems, you must provide us with specifics.

The only items we see will be taken care of by doing the following. *Note: They have nothing to do this any problems you have mentioned.

Step 1:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.


Step 2:
Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Make sure you have shut down all protection software (antivirus, antispyware, firewall...etc) programs so they do not interfere with the running of ComboFix. *Remember to re-start them before coming back online.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
  If it asks you to overide the previous file with the same name, click YES.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Step 3:
Open CCleaner - select "Cleaner" > "Run Cleaner" <---use this function ONLY!

Step 4:
Go to the following link and install one antivirus and one firewall now from our recommended listings. How to Protect yourself from malware!

Step 5:
Now go to this link MGTools and download the new version of MGtools....overwrite your previous MGtools.exe file with this one.

Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Please attach the below logs to your next reply:

• C:\MGlogs.zip
• C:\combofix.txt

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

dr.m

 

Hello, tadpole

First: None of your logs show any malware present. Keep in mind that "Files and Folders" are now set by our tools to be no longer hidden...could that explain why you're now seeing things that were hidden before? If you think you see a problem in the logs - please Copy & Paste that exact information into your next reply. Also special login is what the Windows OS uses (like Network Services and System) and it is not a problem.

Secondly: Why are you installing and running applications from C:\Users\tadpole\Documents\MY DOWNLOADS\ rather than in C:\Program Files?

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Make sure you have shut down all protection software (antivirus, antispyware, firewall...etc) programs so they do not interfere with the running of ComboFix. *Remember to re-start them before coming back online.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
  If it asks you to overide the previous file with the same name, click YES.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Please attach the C:\combofix.txt and tell me if you have your privileges back. *Continue to describe any current problems.

dr.m

 

Morfeus is a scanner that looks for vulnerabilities in PHP based web sites. This is not really a malware problem. It is a possibly issue with vulnerabilities in software you use or a web server you have setup. These scans are still quite common. You need to make sure you have proper protection ( a good bidirectional firewall like you added from Comodo and it would be a great idea to have a hardware firewall like from a router if you do not have one already). Also make sure all software has been updated and you will need to look for issues in any of your website code. You can read lots of info on these scans and possible solutions in links like the below:

http://stateofsecurity.com/?p=467
Update on Morpheus Scanner
http://ekle.us/index.php/2007/01/weird_server_logs_find

Again this is not a malware issue. If someone is getting into your PC from outside, it means you have opened doors to allow them to get in and your protection or what you have setup on your PC is a problem. Who added the LogMeInRemoteUser account and gave it admin priviledges?

False detections since this is part of ComboFix and you are supposed to have protection disabled before trying to run ComboFix.

Again this would still not be considered malware. It is classified with scamming, fishing, spamming....etc. If some one has picked up your email address that you may have posted somewhere, you could get added to literally thousands of lists in a couple days. And if you respond to any of them, you are just confirming that your email address is still valid which mean it will get added to more lists and you will have more junk sent your way.

Comodofix, I was unable to run as per the message above. [/quote] You mean ComboFix and it cannot run if you still have protection enabled.

Manual delete files from the deepest level folder first and work your way back towards the top. This is also not a malware problem. You can work issues like this in the Software Forum.

dr.m will continue working with you to cleanup a few miscellaneous items and then give you final instructions which will work towards getting proper protection on your PC too.

 

But the account may still be there and there are drivers for it still on your PC. You need to go to Control Panel, User Accounts and delete this account if it shows up. If it does not show, just delete the folder for it under C:\Documents and Settings.

 

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

After clicking Fix, exit HJT.



Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\Windows\temp
C:\Users\tadpole\AppData\Local\temp

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

I still see the LogMeInRemoteUser user account in your logs. Are you sure you deleted it using Control Panel -> User Accounts

You can continue to work removing this in the Software Forum as this is not a malware issue.

Not sure what you are referring to.

Possibly this is correct and is just referring to the fact that you sill have the LogMeInRemoteUser account showing but there are no folders for it anymore.

These are items you should work in the Software Forum. But not sometimes to delete folders, you need to go all the way down to the deepest folder and delete all files. Then delete the folder. And then work your way back up to higher and higher levels.


Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

You're welcome. Surf safely!