remnants of xp antivirus 08 and possibly a worm

SomeCrazyStuff · Sep 15, 2008

ok im working on recleaning my dads laptop.. obviously last time i tried i didnt get it all.. it would seem that whatever i left on it is still going out and downloading trojan downloaders as in the past 2 weeks dad has gotten 51 in one week and 8 in the next(as marked by zonealarm)..

i ran the read and run first..

i must appologize before i go any further because instead of making notes i decided to try to remember the errors and such.. and now i cant remember them after the 3hours of scans... so.. sorry... will do better in that area in the future..

a couple of notes:
was unable to defrag.. both by the windows defrag and i tried diskkeeper... neither worked..

superantispyware free edition ran just fine.. but on shutdown it hung and i had to force shutdown(i waited about 15 minutes while staring at a black screen for it to shutdown)...
it rebooted just fine though..

everything else ran fine except mgtools.. it gave me an error that i still didnt write down.. but this error was different from the ones listed in the guide to running mgtool in read and run first.. again sorry for my idiot decision to not write the error down... but it gave me the option to hit ok to terminate or cancel to debug.. i hit ok to terminate and mgtools seemed to go on and finish...

ok heres the logs.. i hope there isnt anthing i missed in the read and run first as i uninstalled almost everything dad had on the computer that didnt come preinstalled.. if i did miss something let me know so ill know to look for it in the future..

thx in advance for any help xD

SomeCrazyStuff · Sep 15, 2008

and the combofix log..

again thx for help

TimW · Sep 15, 2008

I assume you will be installing an AV program and Java Runtime 6

Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Use windows explorer to find and delete:
C:\WINDOWS\system32\14.tmp
C:\Program Files\WildTangent
C:\Documents and Settings\All Users\Application Data\WildTangent

Run C:\MGtools\analyse.exe by double clicking on it. (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
Click to expand...

After clicking Fix, exit HJT.

Now tell me what problems you are still having.

SomeCrazyStuff · Sep 15, 2008

oook.. now... i ran HJT and had it fix that line... but i couldnt get the java or windowsmessenger remover downloads due to a http 403 forbidden error..

is that from one of the scans or somthing else..

all other webpages seem to load fine.. just downloads give me the 403 error

what you think?

TimW · Sep 15, 2008

Possibly a problem with the forum........try again later.

SomeCrazyStuff · Sep 15, 2008

nope i dont think so.. on my laptop which i have sitting right next to me i can download the files.. but not on here.. i relize i could just get the files from my laptop.. but if this is going to cause a headache for all downloads i would like to address that now as well...

TimW · Sep 16, 2008

Strange indeed.....run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.

SomeCrazyStuff · Sep 16, 2008

iight here you go.. sory im just now gettin back to you.. bloody school and work too.. i wanna break.. lol xD

odd that this is saying it cant find the specified files and listing all the system services..

ok i got a processDll.exe - common language runtime debugging services error

the exact text of the error is:

application has generated an exception that could not be handled.

process id=0x970 (2416), thread id= 0xdc0 (3520).

click ok to terminat the application
click cancel to debug the application

...i hit ok...

crap im typing this on the wrong computer.. will post the mgtools.zip from the laptop we are dealing with in just a second...

SomeCrazyStuff · Sep 16, 2008

ok slightly longer than one second.. but here it is..

and i think i typed mgtool.zip earlier.. i meant mglogs.zip...my bad.. been a long day..

TimW · Sep 16, 2008

I am not seeing any malware in your logs....you could try going to start / run / type "sfc /scannow" without qoutes.....have you xp cd handy and note the space between the sfc and the /scannow.

Run it at least twice.....then I may have to send you to software to continue with your issues.

SomeCrazyStuff · Sep 16, 2008

hmm.. trying now.. yes i have an xp pro oem cd.. but not the full fledged version... dont remember if this computer was xp pro or not... too many of them.. >.<

ok its asking for xp pro service pack 3 cd.. the one i have is sp2.. any ideas there?

TimW · Sep 16, 2008

Right click my computer / properties

SomeCrazyStuff · Sep 16, 2008

check edit.. i thought i got it before you posted again.. sry

TimW · Sep 17, 2008

You need to post in the software section regarding slipstreaming SP3 into your xp disc....they may also help with the other issues.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.

If we used Pocket Killbox during your cleanup, do the below

* Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combo-fix folder from combofix.

If we had you run Avenger, you can delete all files related to Avenger now.

If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

SomeCrazyStuff · Sep 17, 2008

ight will do.. and thx for all the help.. xD

Log in or Sign up

remnants of xp antivirus 08 and possibly a worm

SomeCrazyStuff Private E-2

Attached Files:

MGlogs.zip

mbam-log-2008-09-15 (00-22-40).txt

SUPERAntiSpyware Scan Log - 09-14-2008 - 23-35-00.log

SomeCrazyStuff Private E-2

Attached Files:

combofix log.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SomeCrazyStuff Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SomeCrazyStuff Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SomeCrazyStuff Private E-2

SomeCrazyStuff Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SomeCrazyStuff Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SomeCrazyStuff Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SomeCrazyStuff Private E-2