Pop Ups aaaaaach finished Read Me First

elhoo · Nov 30, 2008

We've had crazy popups and home page redirects and lots of "Windows" security links to download from since the cousins were playing on the computer during Thanksgiving dinner. Now I have a 10 page paper to write and I can't do any research on the internet and the paper is due Monday!!! I read through and followed the Read Me First post -- hopefully I did everything correctly -- and now I'm posting my logs (using 2 posts per directions). I apologize if this is done wrong, I'm not too good at this. Thanks in advance for the help.

elhoo · Nov 30, 2008

Here are the rest of the logs -- again, thank you for helping me!

dr.moriarty · Dec 1, 2008

Hello, elhoo

While I'm looking over your logs, please be sure to follow the READ AND RUN ME FIRST guide and all instructions exactly --- you didn't shutdown your AV before running ComboFix.

Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
Click to expand...

Thanks!
dr.m

elhoo · Dec 4, 2008

Hi Dr. M,
Sorry about waiting so long to reply -- couple of questions which will clearly prove I'm way beyond my depth here!
1)do I need to run the whole Read Me First again or just the Combofix part?
2)I thought I turned off all the AV stuff, can you tell which ones didn't turn off? Is there a way to find out how/where to turn these off?

Thanks!
Ellie

dr.moriarty · Dec 5, 2008

Welcome to Major Geeks, elhoo

No need at this point to re-run any of the scanners - let's get started.

If you have not already done so, please disable the Guest account in User accounts.

First, please disable any antivirus and/or antispyware programs you have installed so they will not block this fix. (Remember to enable them again when this steps are completed.) Print out these instructions or save them to a text file so as All Browser Windows must be CLOSED. *The fixes are specific to your problem and should only be used for issue(s) on this machine.

HOW TO DISABLE McAfee SecurityCenter
* Right-click on the McAfee SecurityCenter system tray icon > VirusScan > Select "Disable"

OR
* Double-click the taskbar icon to open the Security Center
* Click Advanced Menu (lower left)
* Click Configure (left)
* Click Computer & Files (upper left)
* VirusScan can be disabled on the right.
Click to expand...

CAUTION! You seem to have multiple "real-time" anti-malware blockers & scanners installed.

McAfee Security Center is supposed to include antispyware protection too.

AOL Spyware Protecion

CA Pest Patrol

Spy Subtract

* Refer to the How to Protect yourself from malware!

Realtime blocking tools - ONLY USE 1 BLOCKER
Click to expand...

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed

Viewpoint Media Player
Spybot - Search & Destroy 1.4
Click to expand...

Step 2:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O20 - AppInit_DLLs: uhdeoo.dll bzlele.dll
Click to expand...

After clicking Fix, exit HJT.

Step 3:
Now we need to use ComboFix to remove some malware files.

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. *Remember to re-start them before coming back online.

Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
Code:
KILLALL::

File::
C:\WINDOWS\system32\uhdeoo.dll bzlele.dll

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=uhdeoo.dll bzlele.dll
Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Follow the prompts.

When it finishes, a log will be produced named c:\\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Step 4:
Run Ccleaner

Step 5:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Then attach the below logs to your next reply:

C:\MGlogs.zip

C:\combofix.txt

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

Thanks!

elhoo · Dec 9, 2008

Hi Dr.,
I followed your directions. First I tried to disable McAfee Virus Scan but it said that it was already disabled. I also turned off AOL spyware protection. I disabled CA Pest Patrol and removed Spy Subtract with add/remove programs. I also paid for and downloaded the real-time SUperAnti Spyware after I was done with everything (and before I came back on-line). I could not find Viewpoint Media Player in the add/remove programs, but I did remove Spybot-Search and destroy, which caused my computer to automatically restart (I'm such a newbie, I'm not sure if that was normal or not). Then I ran the MGTools and fixed the 04 and 20 entries that you listed. Next I ran the combofix according to your directions. I left the room while it was running and when I came back (about 20 minutes later) my computer had rebooted and I signed on again. combofix just sort of sat there on the desktop until everything had rebooted, then finished its work. I then ran Ccleaner, then finally I ran MGTools get logs. I will attach the logs.
I wanted to tell you that earlier today, my computer was soooo slow that I checked task manager and found 3 or 4 spoolsv.exe entries and one of them was running at 98%. I probably did the wrong thing and deleted the process through task manager. Sorry if that was wrong. Thanks for being patient with me -- it takes me so long to get back to these posts because I am never home long enough to do these fixes!

elhoo · Dec 9, 2008

Hi Dr. again,
I totally forgot to tell you that I started getting copies of my printer -- like when I go to print something I have to click the pull-down menu to find which copy I need to use (copy 1 copy 2). This started about the same time all the other weird stuff was happening. Now there is no printer listed at all. I was afraid to go through the tutorial in case it was something to do with the problems on the computer.

dr.moriarty · Dec 10, 2008

elhoo

Your logs are clean! The issue with your printer is something that you should post about in a new thread, in our Software Forum<click here> .

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (=This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

If we had you run Avenger, you can delete all files related to Avenger now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware

Click to expand...

Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif

elhoo · Dec 10, 2008

Hi Dr., thanks for all your help! I think I screwed up. I followed the finishing part of the instructions (deleted the programs and toggled the restore points), but then my computer (CPU I think its called) started running and running and running. I did a scan with Super Antispyware and it found 5 "rogue" things, which I had them fix and quarantined. I did the task manager and on it found spoolsv.exe running at 98%, and 12 entries for svchost.exe 3 of them were listed as local service, 7 of them were listed as system and 2 of them were listed as network service. Some of them were together and some were scattered all over the list. Is that normal? I'm guessing I should have run the scan first before I toggled the system restore? I also went online and had a problem with pages loading or no response to my mouse clicks either in comcast or aol. Sorry I'm taking so much time with this issue!

dr.moriarty · Dec 10, 2008

elhoo

* I want your pc cleaned, too ---- so "No Problem".

Please attach newly updated SAS/MBAM/MGLogs.zip.

Thanks!
dr.m

Log in or Sign up

Pop Ups aaaaaach finished Read Me First

elhoo Private E-2

Attached Files:

sas113008log.txt

SpybotSD.Report113008.txt

mbam-log-2008-11-30 (13-44-37).txt

elhoo Private E-2

Attached Files:

combofixlog113008.txt

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

elhoo Private E-2

dr.moriarty Malware Super Sleuth Staff Member

elhoo Private E-2

Attached Files:

MGlogs.zip

ComboFix.txt

elhoo Private E-2

dr.moriarty Malware Super Sleuth Staff Member

elhoo Private E-2

dr.moriarty Malware Super Sleuth Staff Member