please check logs

Discussion in 'Malware Help (A Specialist Will Reply)' started by dena, Aug 26, 2008.

  1. dena

    dena Private E-2

    this morning, my computer became infected with something that changed my desktop, blocked certain sites (including major geeks), modified google searches, etc. after running the steps in the read me thread, most of these problems have been cleared but whatever my computer was infected with also made a fake avg icon in my tray that says that it is running scans when it actually isn't. the real avg icon is still there but this fake one won't go away and i can't close it (i'm sorry if i'm not making sense). i've attached my logs... superantispyware gave me the bluescreen twice so i've only attached malwarebyes, combofix, and mgtools. thanks in advance...
     

    Attached Files:

    dena, Aug 26, 2008
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to re-run MalwareBytes and have it fix everything it finds! There is no point in running it without fixing the malware.

    Then run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file as well as the MWB's log.
     
    TimW, Aug 27, 2008
    #2
  3. dena

    dena Private E-2

    i think the log i uploaded was saved before my computer was restarted because the log that was automatically saved says that everything was quarantined and deleted. i've attached the right log.
     
    dena, Aug 27, 2008
    #3
  4. dena

    dena Private E-2

    here is the log
     

    Attached Files:

    dena, Aug 27, 2008
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Sweet.......scans got most all of it. Let's just do this:

    Please disable the Guest account in User accounts.

    Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Please use add/remove programs to uninstall:
    Java 2 Runtime Environment, SE v1.4.2_03

    Open notepad and copy and paste the following text in the quote box into the window:
    Save this as fix.bat
    Choose to save as all files.
    Doubleclick fix.bat and let the program run.
    A small black dos window will flash, this is normal.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.


    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Tell me if you are having any other malware issues. :)
     
    TimW, Aug 27, 2008
    #5
  6. dena

    dena Private E-2

    awesome! thank you so much! i finished all of the steps and received a success message. it looks like all of the problems that i was having before have been eliminated.

    i have another question: i had zonealarm installed up to a few weeks ago. i removed it because it was causing my computer to start up really slowly (took up to 10 minutes sometimes) and hogged a lot of memory. while i had it installed, i never had any problems with malware. do you think i should reinstall it and if so, is there a way that it can run without using up so much of my resources? is there another firewall that you would recommend?

    thanks again!
     
    dena, Aug 27, 2008
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to hear! I would suggest you check the Top Freeware Picks on the main page and try PCTools firewall....lite and not a hog.

    If you are not having any other malware problems, it is time to do our final steps:
     
    TimW, Aug 27, 2008
    #7
  8. dena

    dena Private E-2

    i've gone through all of the steps listed but avg ran a scheduled scan this morning and removed combofix. the files that were removed are:

    Infections
    File;"Infection";"Result"
    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP0\A0000011.dll;"Trojan horse BackDoor.Generic10.DQK";"Moved to Virus Vault"

    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000042.old;"Virus found BackDoor.Hupigon";"Moved to Virus Vault"


    Spyware
    File;"Infection";"Result"

    C:\Documents and Settings\Dena\Desktop\ComboFix.exe;"Potentially harmful program HideExec.EV";"Moved to Virus Vault"

    C:\Documents and Settings\Dena\Desktop\ComboFix.exe:\327882R2FWJFW\hidec.exe;"Potentially harmful program HideExec.EV";"Moved to Virus Vault"

    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000111.exe;"Potentially harmful program HideExec.EV";"Moved to Virus Vault"

    C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000111.exe:\327882R2FWJFW\hidec.exe;"Potentially harmful program HideExec.EV";"Moved to Virus Vault"


    are there any other files that i should delete manually?

    thanks so much for all of your help
     
    dena, Aug 29, 2008
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The files in your system restore folder as well as the false positive about ComboFix would all be removed had you done the cleanup steps. :)
     
    TimW, Aug 29, 2008
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds