Problem with Malware

Discussion in 'Malware Help (A Specialist Will Reply)' started by Kinggreggles, Jul 14, 2008.

  1. Kinggreggles

    Kinggreggles Private E-2

    Hi,

    I'm having some problems removing this very annoying malware my friend seemed to have contracted on the computer I lent him.

    While trying to run the Read and run me first programs (Off a cd I burned from my laptop), when I try to install and run superantispyware nothing happens... Every other program I try to run, runs fine.

    I believe it may be the trojan (vundo I believe) on the computer that is stopping me... because I cannot log on certain anti-malware websites on the computer..

    Any advice to kick start this removal would be appreciated.
     
    Kinggreggles, Jul 14, 2008
    #1
  2. Lev

    Lev MajorGeek

    Post up all the other logs requested in the Read & Run Me First thread, and an Authorized Malware Fighter will be along to assist you shortly.
     
    Lev, Jul 14, 2008
    #2
  3. Kinggreggles

    Kinggreggles Private E-2

    Okay, here's the three logs I could get after sequentially running the steps in the read me.

    I couldn't open SAS as I stated at the beginning. I was hoping after doing everything my problems might go away, but unfortunately not five seconds after opening my IE browser a popup came up for some virus protection.

    Like I said, my friend was using this computer (He isn't very computer savvy), and I know he downloaded ringtone creators (Oh my).

    That's all that I can think of.

    A couple of other notes:

    There were two logs from Malwarebytes, one from before and after the deletions of the problems it found.. I posted the after document like the instructions said, but I have both.

    Okay hope you guys can help me.. This is quite annoying, I've never had one of these things.
     

    Attached Files:

    Kinggreggles, Jul 14, 2008
    #3
  4. Kinggreggles

    Kinggreggles Private E-2

    Okay.. I just posted a reply but it didn't show up, so I'm hoping for no double post.

    I'll post the three logs that I did after sequentially following the steps in the guide. After finishing everything I still had antivirus popups (And some other random spam ones as well).

    I let my friend use this computer, and the only thing I could find was ringtone creators (Which I'm sure is probably it), as well as divx movie attachments... In any case here are the files.. Hopefully this can be fixed.
     

    Attached Files:

    Kinggreggles, Jul 14, 2008
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!



    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R3 - URLSearchHook: (no name) - {8e41e543-e069-4197-8608-e8b4c2f75747} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O20 - AppInit_DLLs: C:\WINDOWS\System32\dmstyle32.dll
    O20 - Winlogon Notify: 2445b935368 - C:\WINDOWS\System32\dmstyle32.dll

    NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.
    After clicking Fix, exit HJT.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 15, 2008
    #5
  6. Kinggreggles

    Kinggreggles Private E-2

    Okay, I did everything and I'll post the logs now.. I ran most of the instructions from my laptop so my browser on my PC wasn't open except when I copied the quoted info.

    I haven't ran IE yet, but I'll let you know what happens.. here are the logs.


    Thanks so much for the help.


    Edit:

    I'm scared to say, but I think it all might be gone.. No more annoying popups while on IE. Is there a way to know for certain? Should I run more scans? Because of this I followed your protection tips on my laptop and got SAS, Comodo, Outpost, CC, S&D as suggested. Should I do this on my PC now?
     

    Attached Files:

    Kinggreggles, Jul 16, 2008
    #6
  7. Kinggreggles

    Kinggreggles Private E-2

    One other thing, sorry for double posting...

    Should I ever run the CCleaner registry clear on this computer? Or will it try to remove the things we added to the registry that are stopping the malware... Or anything of the sort?

    In any case I really appreciate the help... I reviewed a lot of these threads and to do all this for free is a really admirable thing.



    Edit:

    After the fix it seems I can run Nero and Superantispyware... What a coincidence!
     
    Kinggreggles, Jul 16, 2008
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    CCleaner is not a malware scanning or removal tool. It is mainly a driver cleaner and also a registry cleaner and has a few other misc tools. We don't recommend registry cleaning in the malware forum as a regular practice. We only recommend that when it seems necessary to us for specific reasons. Basically, if it ain't broke, don't fix it.

    Your logs are clean. But you do need to get your PC properly protected. You have no antivirus, no antispyware protections and you are relying on the Windows firewall which is not very good.


    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combo-fix" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    chaslang, Jul 17, 2008
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds