Ran through all 6 steps.. Antivirus is still finding problems

Discussion in 'Malware Help (A Specialist Will Reply)' started by marcia2525, Jan 25, 2010.

  1. marcia2525

    marcia2525 Private E-2

    I am working on my husband's computer. I'll just say it now to get it out of the way.. sometimes he looks at porn and I think that is how he gets infected! :) He is also a very fast clicker and very slow reader. He usually just clicks through pop up windows until they go away!

    I think I got involved in his issues around 6/2009 (I got this date by looking at MalwareBytes logs). At that time his desktop picture changed to a very threatening all uppercase, bold red text notice stating that his boss, wife, kids and God were all going to find out that he was looking at porn if he didn't buy some kind of software RIGHT NOW!! I installed MalwareBytes and Spybot at that time. The scans found some issues (Rogue.Multiple.H, Trojan.Agent, Rogue.SystemSecurity) and cleaned them up nicely.

    - Everything looked fine until 1/19/2010. Avira found this:
    The file 'C:\WINDOWS\apptune1020.exe'
    contained a virus or unwanted program 'TR/Dldr.Murlo.drj' [trojan]
    - Then on 1/21/2010:
    Virus or unwanted program 'TR/Crypt.ZPACK.Gen [trojan]'
    detected in file 'C:\WINDOWS\system32\spool\prtprocs\w32x86\000047ee.tmp.
    - That same day I started to notice that google searches were being redirected. I would type "test" in at google.com, select a link and I would be redirected to another page. I hit the back button and selected the same link, and it would take me to the page I wanted.

    Then on 1/22/2010 fortune smiled upon me and I found your website. You guys rock!

    I believe that I completed all of the steps. I hope I did because I don't want to waste your time! Unfortunately I had to do it all over a period of a few days because my access to the computer is limited. When I started the steps Combofix was in and I ran it. Now it is out! I'll attach the log anyways.

    .
    .
    .
    SUPERAntiSpyware and Malwarebytes ran to completion. I've attached the logs.

    Combofix ran and detected Rootkit activity. I had to restart the computer. After that it ran to completion.

    RootRepeal had some problems.
    1) The first error read something like:
    Attempt to read error:
    RP2401
    or something along those lines. I apologize for not getting the exact error.
    2) I clicked OK and then saw:
    Error-on-disk corruption detected-run chkdsk!
    3)There was also a window on the bottom right corner that said:
    Windows - delayed write failed "Windows was unable to save all the data for the file F:/$mft.
    4) That's when I realized this problem was related to my external Seagate FreeAgent backup drive. I looked over at it and noticed that it had shut itself off. I went ahead and unplugged it and and am planning on completely reformatting it and starting over with the backups later once this problem is solved unless you have some other suggestions. I don't want to get reinfected later so let me know if this is a problem!
    5) After I shut the F drive off, I reran RootRepeal on the C Drive... no problems
    6) BUT! Roxio Media Manager is now popping up constantly trying to install or configure. I try to cancel out of it but it keeps popping up. It gets stuck on a screen that says:
    Roxio Media Manager
    The feature you are trying to use is on a network resource that is unavailable. Click OK to try again, or enter an alternate path to a folder containing the installation package 'Roxio Media Manager.msi' in the box below.

    When I cancel out of that I get this window:
    Please wait while Windows configures Roxio Media Manager.

    I've tried restarting the computer to no avail. It keeps on trying to configure or install Roxio!

    MGtools ran to completion.
    .
    .
    .

    The redirecting of google searches has stopped after I completed all of the steps. Yay! I figured that I was done and didn't need to contact you, but Avira has found a few problems during the scan last night and the scan that I forced today. (TR/Drop.Agent.blby, TR/Trash.Gen, TR/Patched.Gen) I've attached the Avira log through 1/18. Interesting, I just noticed that TR/Drop.Agent.blby is on the C:/MGtools.exe file so maybe this isn't a problem afer all! Not sure what the other two detections are.

    Something I noticed that isn't in your steps... you don't ask us to make sure all of our Windows Updates are complete! I tried to update his computer, but it has problems with this update:

    Microsoft .NET Framework 1.1 Service Pack 1 Security Update for Windows 2000, Windows XP, Windwos Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 (K..) and unfortunately I can't read the rest. More information can be found at http://go.microsoft.com/fwlink/?LinkID=127769

    It doesn't really give me much information about why it can't be installed!

    All right, I think that is all I have got. Work your voodoo Major Geek!

    Muah!
    Marcia
     
    marcia2525, Jan 25, 2010
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi and welcome :)

    Please attach all of the requested logs from the R&R.
     
    Kestrel13!, Jan 26, 2010
    #2
  3. marcia2525

    marcia2525 Private E-2

    Sorry I didn't do post the rest last night. My thread wasn't showing up in my CP and I had to go to bed!
     

    Attached Files:

    marcia2525, Jan 26, 2010
    #3
  4. marcia2525

    marcia2525 Private E-2

    It doesn't look like these were attached to my first post so I am resending.
     

    Attached Files:

    marcia2525, Jan 26, 2010
    #4
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Ok that's great. I will make a start on reviewing your logs as soon as I can but I have to start getting ready for work now. I'll more than likely post back tonight now :)
     
    Kestrel13!, Jan 26, 2010
    #5
  6. marcia2525

    marcia2525 Private E-2

    Ok thank you for your help!!
     
    marcia2525, Jan 26, 2010
    #6
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    1. I want you to download a fresh copy of combofix to your desktop just so that we are sure it is a stable version considering the recent bug, but do not run it until I instruct.

    2. Download a new copy of MGTools.exe considering avira quarantined it.

    Go to this MGTools and download the new version of MGtools.exe. Overwrite your previous MGtools.exe file with this one.

    3. Also delete all files in the below folder except ones from the current date (Windows will not let you delete the files from the current day).

    4. Now run combofix by double clicking it's icon on your dektop. Attach the C:\combofix.txt log that it produces into your next reply.

    5. Run the new MGTools, ensuring that you do so from your C Drive and not anywhere else.

    6. Attach the C:\Mglogs.zip file that it creates.
     
    Kestrel13!, Jan 26, 2010
    #7
  8. marcia2525

    marcia2525 Private E-2

    Kestrel13! thank you so much for your help!

    I've downloaded new copies of ComboFix and MGTools and attached the requested logs. Sorry for the delay.

    Marcia
     

    Attached Files:

    marcia2525, Jan 26, 2010
    #8
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi Marcia. Not seeing much to do here now.

    1. Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix exit HJT.

    2. Use Windows Explorer to locate the below bold file:

    C:\WINDOWS\system32\8A9C1B <--- rename to .old (C:\WINDOWS\system32\8A9C1B.old)

    3. Delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    4. I want you to let me know how the PC is behaving. Is Avira finding any further threats?
     
    Kestrel13!, Jan 27, 2010
    #9
  10. marcia2525

    marcia2525 Private E-2

    Sorry for the delay. I have limited access to this computer.

    I completed steps 1 -3. Avira runs a scan every night and has not discovered any other problems. My webpages are no longer being redirected. Everything looks good!

    I am going to start implementing the "How to protect yourself from malware" sticky now.

    Thank you so much for your help!! You - :major - are awesome!
    Marcia
     
    marcia2525, Jan 30, 2010
    #10
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You're welcome! Safe surfing! :)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    Kestrel13!, Jan 31, 2010
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds