Recovering from Malware...uncertain of next steps

Phlegmbot · Jul 20, 2012

Hi, Major Geeks!

Got a virus (obvs), uncertain how this time 'round (I think it was connected to an old version of FF I DL'd). That said, I'd called a techie friend WHILE the virus was overtaking my computer (it had shut down my Internet, turned off Avira, took over my taskbar's notification area, and I kept getting a pop-up telling me to buy some kind of AV software).

I read him the messages I was getting and what the friend found was that if I could run the Maleware Bytes Chameleon folder from my desktop, that should fix it.

Did that and it seems to have partially worked.

I went to some OTHER "geek" site (I know...shame on me), and it said to run something called OTL.

Which I did. But they seem to be uncertain what I should do next (as my posting has had lots of views but no replies). So I'm hoping someone here can help. My computer is how I make my living, so I've been pretty stuck all week.

Below I have attached:

1. The OTL log.
2. The most-recent MBAM Log.
3: And these images:
- A warning window which popped up while OTL ran.
- A warning I receive when I started Windows normally (prior to running OTL) -- it looks like it's Trojan-related, but I don't know what to delete to make that stop. It seems I'm still infected (see "Finally" below)

ALSO: Windows Updates & Windows Defender are NOT running (although Peerblocker is). Checked them manually, and I get a message for the Updates which reads: "the service is not running, you may have to restart"
And for the other, I get: "The specified service does not exist as an installed service. (Error Code 0x80070424)" I've restarted...but no change.

FINALLY: the Malwarebytes trial software is occasionally telling me it has blocked svchost.exe

I'm uncertain if I should NOW go and follow the Major Geeks cleaning steps from the start or start them in the middle or do something else altogether.

THANK YOU, THANK YOU!

.

Phlegmbot · Jul 20, 2012

Ooops, forgot to mention, the reason I think folks at the other site are uncertain what I should do next is that it's been several days and that's not the norm there (just as it's very unusual for that to happen here in my experience).

Kestrel13! · Jul 20, 2012

Tell them you are now recieving assistance from another forum.

Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

Phlegmbot · Jul 20, 2012

Hey, Kestrel! Thanks so much for a fast reply!

I just want to be certain though: Although I've already run OTL and Malewarebytes, you definitely want me to start at the verty beginning of the Major Geeks Malware removal process, yes?

Because I'm going to do that now...but will check back.

Kestrel13! · Jul 20, 2012

Yea. I want you to run what you have not run already and provide me with the logs.

Phlegmbot · Jul 20, 2012

Hey there, Kestrel.

OK. So I've followed everything...

Attached are also the logs.

The instructions said to restart before running MGTools, when I did, I received a new RunDLL error to add the previous Widrad one mentioned earlier. Will post in another reply.

Phlegmbot · Jul 20, 2012

Image of new rundll error.

I've not re-booted yet since running MG Tools. Was uncertain if it'd matter.

Thanks for the help, Kestrel!

Phlegmbot · Jul 20, 2012

P.S. It just occurred to me: You'll see something called SANSA in some of those logs. That's an MP3 player of mine which has a syncing module on my computer. It's nothing to be concerned with (several years ago when I had my last virus, someone who helped on a forum was concerned about it).

Kestrel13! · Jul 21, 2012

http://img827.imageshack.us/img827/1263/frst.gif For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

Phlegmbot · Jul 21, 2012

OK, Kestrel, attached is the log.

:cool

Kestrel13! · Jul 22, 2012

StartNow Toolbar <--- Uninstall this garbage.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

________________________________________-

Run FRST like you did in post # 10 and attach that log too please.

How are things running?

Phlegmbot · Jul 22, 2012

Hey, Kestrel!

No more RunDLL errors.

After running the fix, I did another scan w/FRST64.

I've attached both files.

Please let me know if I've a clean bill of health! And thanks so much!

-Pbot

Kestrel13! · Jul 22, 2012

Looks good to me.

Uninstall the below:

StartNow Toolbar
[*]Viewpoint Media Player

Delete this folder:
C:\ProgramData\225932DF00081DF202918AE2F875F002

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Phlegmbot · Jul 23, 2012

Hey, Kestrel.

Looks like all's working fine...save for one, minor thing -- see the image.

My Taskbar is showing that I've NO connection. This image was screen-cap'd while on the WIRELESS. It stays that way even when I plug in the cable.

Any ideas?

Kestrel13! · Jul 23, 2012

Please ask about that in the software forum. Thanks.

Phlegmbot · Jul 26, 2012

Hey, Kestrel!

I don't think I'm completely clean -- I've been getting an OCCASIONAL redirect in my FF browser.

Sometimes (but not always), when I do a Google search, this link comes up:

http://click.get-answers-fast.com/ads-clicktrack/click/jump1.do?sid=Cy0c2IjgsyuopItU6e8El4pFXphqiGaWr8jGf7rAK18j5YN5IdCUmw%3D%3D&affiliate=46573&subid=11415-107-32091&rc=0&terms=comic%20exmachina"

Luckily Ad-Blocker Plus doesn't even let the page open.

I saw in another thread (that you were helping someone else in) that this is part of a virus. I've been noticing it since a day or so before you helped me, but the two times it's happened previously, I had thought I mistyped or mis-clicked something.

Let me know if I should start a new thread or what. THANKS!

Kestrel13! · Jul 27, 2012

First of all please try uninstalling Firefox. But do not uninstall it the usual way, let's use a third party uninstaller. (see below, but do not uninstall until you have backed up your bookmarks etc, read further down)!!

We are going to be uninstalling your old version of FireFox and installing the new version. So do the below to save bookmarks:

Run FireFox and click Bookmarks.

Then select Organize Bootmarks.

Then on the next window click File and then select Export. Save the bookmarks.html file to your Desktop for later use in importing.

Now download and save the installer for the current version of FireFox but DO NOT install it yet. Get it here: Mozilla FireFox

You will need exit FireFox now and use Internet Explorer to continue with the below until we reinstall FireFox.

Try Revo Uninstaller. http://majorgeeks.com/Revo_Uninstaller_d5706.html
Choose the option on the bottom of the list (#4). Be very careful while deleting the bolded registry items ONLY!! This software will create a system restore point for you as well prior to uninstalling a software program.

Start by uninstalling FireFox and then reboot. Do not skip the reboot.
After reboot, delete the below folders:

C:\Program Files\Mozilla Firefox

C:\users\UserAccount\AppData\Roaming\Mozilla\Firefox

where UserAccount is the actual user account name being used.

Now reinstall FireFox from the file previously downloaded.
Import your bookmarks file. (similar process to exporting).

Still getting redirects or not?

Phlegmbot · Jul 29, 2012

That seems to have done it!

Thx again!

Kestrel13! · Jul 29, 2012

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Recovering from Malware...uncertain of next steps

Phlegmbot Private First Class

Attached Files:

Phlegmbot Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Phlegmbot Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Phlegmbot Private First Class

Attached Files:

Phlegmbot Private First Class

Attached Files:

Phlegmbot Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Phlegmbot Private First Class

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

Phlegmbot Private First Class

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Phlegmbot Private First Class

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Phlegmbot Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Phlegmbot Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member