Read & Run not working out

Discussion in 'Malware Help (A Specialist Will Reply)' started by snipethewolf, Jul 17, 2008.

  1. snipethewolf

    snipethewolf Private E-2

    I am helping a friend with his laptop computer and have tried following the Read and Run me guide with no success..... I can get SUPERAntiSpyware to install but it will not run. The same happens with Spy Bot S&D.

    I did follow the steps leading to there and am lost on what to do or try next. The program that keeps popping up is running the process winivstr.exe It seems to also make the beep.sys file crash when I get any advance on getting the thing fixed....


    Any help would be great! Thanks!
     
    snipethewolf, Jul 17, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Just keep on going thru all remaining steps. If something does not run, write down the info to explain to us later but keep on going. Do not assume that because one step does not work that they all will not.

    When you finish running all remaining steps, go back and rename the C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe file to SAS.exe and then double click it to see it it will run. Let me know what happens.
     
    chaslang, Jul 17, 2008
    #2
  3. snipethewolf

    snipethewolf Private E-2

    I forgot to say in my last post im not sure if it matters or not. So here it is anyway, Malwarebytes' installed fine and i'm about to run it. Also the Anti-Virus that I am using to do a instiall scan is NOD32 by Eset. So far it has found and removed several things. Renaming SUPERAntiSpyware also enabled it to open I have yet to run it.
     
    snipethewolf, Jul 18, 2008
    #3
  4. snipethewolf

    snipethewolf Private E-2

    I have just finished running all the programs in the Read and Run Section. All but spybot ran fine. Well im not sure if its an issue but the malewarebytes' had me reboot and I did not run the network fix thing. Attached are the log files. I'm still getting a missing DLL issue when windows logs in but its possible my friend has had the issue for some time. The file name is DLCFtime.dll (I have a feeling it was a file the anti virus removed and never removed the reg entry for, it was in "%\system32\spool\DRIVERS\W32X86\3\")If this does not mean anything I will remove the reg issues and fix the error. If this is a possible sign of something else that might still be on the computer, help would be greatly appreciated!!
     

    Attached Files:

    snipethewolf, Jul 18, 2008
    #4
  5. snipethewolf

    snipethewolf Private E-2

    And here is the MG log.
     

    Attached Files:

    snipethewolf, Jul 18, 2008
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This is a DLL file for his Dell printer. I below it reports on the status of the printer cartridge. The error message can be removed by either reinstalling the software for the printer or removing the registry startup entry that trys to load it. It can be seen in the HijackThis log like this:

    O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,RunDLLEntry

    You can even add this to the below fix if your friend feels his printer is working fine and does not care about knowing his print cartridge status.

    If your security is important to you then you should not cheat by using illegal copies of security software like you are doing with NOD32. You cannot trust applications like this to properly protect you. Yu should uninstall this and use legal software.

    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Uninstall Viewpoint Media Player as requested in step 1 of the READ & RUN ME

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ads.bannerstyle.biz/bc/123kah.php
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)

    After clicking Fix, exit HJT.


    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.


    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 18, 2008
    #6
  7. snipethewolf

    snipethewolf Private E-2

    The dell printer was no longer in use so I fixed the dll issue but thanks for the info. Found it right after I posted the log files. As for the nod32 I'm not sure how a 30 day trial is illegal but ok! The fixes given for combofix I did by hand as the same with the reg editing. Want to get more hands on then the rest of the fix. Everything seems to be working great! Thanks for the help!
     
    snipethewolf, Jul 18, 2008
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    A 30 day trial from Eset is fine but the below was installed.

    NOD32 v3.0.642 FiX1.2 by TemDono (31 days remaining forever up

    This is not from Eset and it is not legal.


    This is not always a good idea and will not always work since some malware will block you from doing the fixes while Windows is running. While you may have gotten everything this time (and you should check after a reboot that all did get removed) for some infections, manual fixing will fail. For example, if this had been a Vundo infection, you would not have been able to delete files and fix the registry keys.

    I recommend that you attach a new MGlogs.zip file.
     
    chaslang, Jul 19, 2008
    #8
  9. snipethewolf

    snipethewolf Private E-2

    I was not aware that a reg crack had been used on there computer. I will let my friend know your recommendation. As for the fixes they have not come back. It was done via a live linux distro so windows was not running or accessing the reg or files while I removed them. The laptop is no longer around so I can not post the latest log. Sorry about no log, and I had no clue he had run some reg patch.
     
    snipethewolf, Jul 19, 2008
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No problem! ;) What tool did you run from Linux to edit the Windows registry?
     
    chaslang, Jul 19, 2008
    #10
  11. snipethewolf

    snipethewolf Private E-2

    I had made a complete reg backup and had windows load it when I rebooted. It might not have fixed all the errors but seemed to work fine. I pick and parted what I needed to make a reg file windows would load before windows was done booting. (found some scripts on IRC that where designed to do bad things and gave them a new life) So not really editing the live reg of the system. The tools I used to do it where hanging around the KnoppixSTD CD I had when I was testing my home wireless network setup. As far as if I was going to edit the registry I would have emulated regedit to see if I could get what I wanted that way, similar to SAM file editing/reading
     
    snipethewolf, Jul 19, 2008
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! I just wanted to se what tools you were playing with. If you like Knoppix, you should also add the below tools to your collection. They are two of my favorites.

    UBCD4Win

    SystemRescueCD
     
    chaslang, Jul 19, 2008
    #12
  13. snipethewolf

    snipethewolf Private E-2

    I had tried the Ultamatie Boot CD 4 Win and had not much luck. I didn't spend the time to really do much with it at the time. I will check out the SystemRescueCD. I have yet to try it. Thanks for the recommendations new tools are always fun and interesting to play with. Glanced at the SystemRescueCD site, the USB install sounds like it could be a nice thing to have with.

    The tools I honestly don't remember the names off the top of my head. To do the Reg file edit it was just the included txt editor. The other one's I will have to boot the CD to find them, if I have time in the next few days I will post the names of the tools.
     
    snipethewolf, Jul 19, 2008
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It has a lot of great features. You should really check it it out in more detail. It is great for simplifying procedures like the below when Windows will not boot:

    How to recover from a corrupted registry that prevents Windows XP from starting

    You don't need to Recovery Console at all and can eliminate many steps using UBCD4Win.

    Yes has nice features. You can mount the NTFS Windows partition and then use Midnight Commander (a Norton Commander like clone) for copy, moving, deleting, etc files. Many other useful features too.
     
    chaslang, Jul 19, 2008
    #14

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds