re: read me first

hoondog · Aug 9, 2008

told to post these here not quite sure if this is right:confused

TimW · Aug 9, 2008

If you are having malware issues, you need to tell us what is happening and also attach the other requested logs:
MalwareBytes
MGLogs.zip --> form running the MGTools.exe

hoondog · Aug 10, 2008

yeh sorry was a little excited about getting rid of those pesky problems. first my auto updates for windows turned itself off and wouldn't let me turn it back on even through services.msc, then when i uninstalled a program that i was not using any more me lap top crashed, it seem to start up OK. went to a trusted website today and when i finished did a Sb scan and got 4 hits straight up
-fastclick
-mediaplex
-stat counter and 1 that i had before MUNGA BUNGA
need help please
also tried downloading mg tools.exe and got a php file unsure what to do

TimW · Aug 10, 2008

I'm sorry, what did you mean " tried downloading mg tools.exe and got a php file"?

In the mean time....

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DSS"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
Click to expand...

Now use windows explorer to find and delete:
C:\WINDOWS\winocxdos32.exe

hoondog · Aug 12, 2008

finally down loaded mgtools, i use free download manager and it wanted to download /forums.mg.com/attachment.php?attachmentid=94255 and that's where my confusion was. so i canceled that and found Firefox download box which had mgtools.exe and finally her is the last log file, also thanks for the last reply installed to registry and deleted winocxdos32.exe

TimW · Aug 12, 2008

Your MGLog was empty of the needed logs. Did you agree to the HJT license when it popped up? Did you let it run until it told you it was finished?

Please run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.

hoondog · Aug 13, 2008

hey thanks for being patient, what i did wrong was downloaded MGtools to the wrong registry D: not C: which is where it should have gone. ( dumb me didn't read it properly) anyways got it to C: drive and run the program agreed to the HJT license, as it was running i got a message
"precess dll.exe common language runtime debugging service"
application has generated an exception that it could not handle
"process id=0x918(2584) thread id=0xe48(3656)
click ok to terminate the application
click cancel to debug the application
was unsure what to do so ok'd it

TimW · Aug 13, 2008

From this page: http://forums.majorgeeks.com/showthread.php?t=137630

Error Message Type 4

If you receive a message similar to any of the below. It just means that you do not have the Microsoft .NET Framework software installed from Microsoft Update. You should install this as many .NET type applications require it. The processdll.exe program which is part of MGtools will not run without this software being installed. You don't have to install it but the output from processdll.exe can sometimes be critical in getting your malware removed.
Quote:
The application failed to initialize properly (0xc000007b). Click on OK to terminate the application.

Process DLL.EXE - Application Error The application failed to initialize properly (0xc0000135) Click on any key to terminate.

Also if you see a message like the below, it is again due to missing the Microsoft .Net Framework software. USERNAME will be the user account presently being used.

could Not Find c:\Documents and Settings\USERNAME\Desktop\procdll.txt

You can install the .NET Framework software from Microsoft by clicking the Download button in the below link and then running the dotnetfx.exe file once it is downloaded.

http://www.microsoft.com/Downloads/details.aspx?FamilyId=262D25E3-F589-4842-8157-034D1E7CF3A3&displaylang=en
Click to expand...

hoondog · Aug 14, 2008

after downloading .net framework still get same message, but found new zip file maybe after putting mgtools in the right directory. hopefully this is right!

TimW · Aug 14, 2008

It ran......and the logs are clean. Are you having any issues?

hoondog · Aug 14, 2008

all good, thanks very much for all your help

TimW · Aug 15, 2008

You are most welcome ..If you are not having any other malware problems, it is time to do our final steps:

You can uninstall SUPERAntiSpyware now.

We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combo-fix folder from combofix.

If we had you run Avenger, you can delete all files related to Avenger now.

If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

Log in or Sign up

re: read me first

hoondog Private E-2

Attached Files:

saslog.txt

ComboFix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hoondog Private E-2

Attached Files:

mbam-log-8-9-2008 (12-30-08).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hoondog Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hoondog Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hoondog Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hoondog Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member