Please Help

Discussion in 'Malware Help (A Specialist Will Reply)' started by glwatson, Feb 27, 2007.

  1. glwatson

    glwatson Private E-2

    I was having problems with popups and my computer screen would just go blue and the computer would restart. I came here and ran all of the steps on the "Read & Run Me First" post. I am attaching all of the logs. Please advise.

    Thanks in advance
     

    Attached Files:

  2. glwatson

    glwatson Private E-2

    Here are the Bitdefender, getrunkey, and shownew logs
     

    Attached Files:

  3. glwatson

    glwatson Private E-2

    Here is the Hijackthis log
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Continue by downloading a tool we will need - Pocket KillBox

    Save it to its own folder somewhere that you will be able to locate it later.

    Please use add/remove programs to uninstall:
    Java 2 Runtime Environment, SE v1.4.0_03
    Viewpoint Media Player

    Reboot and install:
    Java Runtime 6

    Use windows explorer to delete these:
    C:\Program Files\Common Files\{D0E7521C-0AE7-1033-0813-030304080001}
    C:\Documents and Settings\Valerie\Application Data\ICROSO~1
    C:\Documents and Settings\Valerie\Application Data\TSKS~1
    C:\Documents and Settings\Valerie\Application Data\VIEWPO~1
    C:\Documents and Settings\Valerie\Application Data\WNSXS~1
    C:\Documents and Settings\Valerie\Application Data\MANTEC~1
    C:\Documents and Settings\Valerie\Application Data\SSEMBL~1

    If you are unable to delete these:
    Run Pocket Killbox by doubleclicking on killbox.exe
    Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    Then after it deletes the files click the Exit (Save Settings) button.
    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

    Select:

    * Delete on Reboot
    * then Click on the All Files button.*(or on the folders option)*
    * Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\Program Files\Common Files\{D0E7521C-0AE7-1033-0813-030304080001}
    C:\Documents and Settings\Valerie\Application Data\ICROSO~1
    C:\Documents and Settings\Valerie\Application Data\TSKS~1
    C:\Documents and Settings\Valerie\Application Data\VIEWPO~1
    C:\Documents and Settings\Valerie\Application Data\WNSXS~1
    C:\Documents and Settings\Valerie\Application Data\MANTEC~1
    C:\Documents and Settings\Valerie\Application Data\SSEMBL~1

    * Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    * Click the red-and-white Delete File button. Click the box to unregister .dll's. Click Yes at the Delete on Reboot prompt.

    If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

    If Killbox does not reboot just reboot your PC yourself.

    Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
    O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{30E75~1\Bar888.dll (file missing)
    O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{30E75~1\Bar888.dll (file missing)
    After clicking Fix, exit HJT.

    Now attach new logs for:

    * GetRunKey
    * ShowNew
    * HJT
     
  5. glwatson

    glwatson Private E-2

    Ok I did all that you said and had no problems. Here are the new logs.
     

    Attached Files:

  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs shows that you did not uninstall Viewpoint Media Player. That is a major cause of problems. Please uninstall it now.
    Youi also did not install HJT properly. Please uninstall it, re-download and install it to its own folder such as:
    C:\HJT\analyse.exe
    Then post a new log for:
    ShowNew
    HJT
     
  7. glwatson

    glwatson Private E-2

    Sorry, I must have overlooked that Viewpoint Media Player in your instructions. I removed it with add/remove programs. I uninstalled and installed HJT according to the instructions in the "how to install and run Hijack This" post. Attached is the new HJT and newfiles. Thanks
     

    Attached Files:

  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds