Read and run again :\

BReed · Aug 26, 2009

Hello

I have previously ran all the steps of the thread and had chaslang read my logs and help me through it. I have stumbled upon some malware again and also ran the steps in "Read and run" again. The only difference was, I could not run combofix and rootrepeal. They both caused windows to pop-up various windows stating that I didnt have permision to use certain files. I can find out which files if you need, it will just take some time. Please let me know if you need the names.

Thank you
Brandon

BReed · Aug 27, 2009

P.S. My computer has restarted on its own twice in the last week also.... Dont know if that helps at all. Thanks again

TimW · Aug 30, 2009

Let's start with this:

Download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\-1670173419
C:\32788R22FWJFW
C:\32788R22FWJFW.0.tmp
C:\32788R22FWJFW.1.tmp
C:\32788R22FWJFW.2.tmp
C:\32788R22FWJFW.3.tmp
C:\djos.exe
C:\lcbckjms.exe
C:\sdlb.exe
C:\Documents and Settings\Greg\Local Settings\temp\AZU2481386639268003461.tmp
C:\Documents and Settings\Greg\Local Settings\temp\azupnpav_0.2.21.zip
C:\Documents and Settings\Greg\Local Settings\temp\e4j2E.tmp_dir16369"
C:\Documents and Settings\Greg\Local Settings\temp\e4j9C9.tmp_dir11379
C:\Documents and Settings\Greg\Local Settings\temp\i4jdel0.exe
C:\Documents and Settings\Greg\Local Settings\temp\MAR1.tmp
C:\Documents and Settings\Greg\Local Settings\temp\MAR2.tmp
C:\Documents and Settings\Greg\Local Settings\temp\MAR3.tmp
C:\Documents and Settings\Greg\Local Settings\temp\STS5.tmp
C:\Documents and Settings\Greg\Local Settings\temp\STS6.tmp
C:\Documents and Settings\Greg\Local Settings\temp\STS7.tmp
C:\Documents and Settings\Greg\Local Settings\temp\swt-gdip-win32-3448.dll
C:\Documents and Settings\Greg\Local Settings\temp\swt-win32-3448.dll

Folders to delete:
C:\-1670173419
C:\32788R22FWJFW
C:\Documents and Settings\Greg\Local Settings\temp\azupnpav_0.2.21.zip
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
-
Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

Read and run again :\

BReed Private E-2

Attached Files:

MGlogs.zip

mbam-log-2009-08-26 (04-41-55).txt

SUPERAntiSpyware Scan Log - 08-26-2009 - 04-20-29.log

BReed Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member