Requested logs from new Member (Post 1)

Welcome to MajorGeeks, rengaw

I'm looking over your logs and will work up a fix.
dr.m

 

You're welcome.

*I will caution you against complicating our removal steps and final cleaning by not following our instructions in the READ ME guide -

- MGtools.exe is where it should be, but the other programs are not found. Please re-download RogueKiller to your desktop... we will need to use it soon.

We recommend an absolute MINIMUM of 2 GB for Windows XP

Please look in Add/Remove Programs (Programs and Features if using Vista or Windows 7) for the following and uninstall thes outdated software versions. If you get any errors just make a note and continue on.

NOTE: Mozilla Firefox 16.0.2 (x86 en-US) <--- outdated and needs updating

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Now double-click RogueKiller.exe to run it. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button, then select the Registry tab and then select any of the below that exist and then click the Delete button.

• 
  ¤¤¤ Registry Entries : 4 ¤¤¤
  [RUN][SUSP PATH] HKCU\[...]\Run : EPSON WorkForce 840 Series (C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIGMA.EXE/FU"C:\WINDOWS\TEMP\E_S532.tmp" /EF "HKCU") -> FOUND
  [RUN][SUSP PATH] HKUS\S-1-5-21-73586283-1682526488-839522115-1003[...]\Run : EPSON WorkForce 840 Series (C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIGMA.EXE /FU "C:\WINDOWS\TEMP\E_S532.tmp" /EF "HKCU") -> FOUND

When it is finished there will be a log on your desktop called RKreport[2].txt, attach it to your next reply.
Then immediately reboot your PC.

After reboot, run a new scan with both RogueKiller and attach that new log to your next reply.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

After clicking Fix, exit HJT.

Please download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe and select Run as administrator to run it.
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of the code box

Code:

:Processes
killallprocesses

:Files
C:\Documents and Settings\All Users\Application Data\blekko toolbars
C:\WINDOWS\system32\urqpp.dll
C:\WINDOWS\system32\xxwxx.dll
C:\WINDOWS\system32\iifdb.dll 
C:\Program Files\AskBarDis
ipconfig /flushdns /c
ipconfig /release /c
ipconfig /renew /c

:Reg
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A348B64-62FC-4668-B76E-27C3A5060EF0}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2106345C-2237-4D2C-B5A6-9267B53BA3DF}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{221E3DFC-5379-4C0C-A278-28D1E25F5FD1}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23E43271-42B5-4D4E-9943-4C87C4749E15}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{24B616C1-EEB7-42AE-BFC1-33E5A2D9D1C3}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3085001E-1BB1-4DD6-86CC-141CCCBF47F7}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41E48C00-BF1A-485C-908C-711A277F8D7A}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B4CD9D6-F63E-4D10-88C3-69169BF8D1B9}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{542718A0-7646-4E09-9255-0BDD70F07ABB}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5B82AEEB-7B56-42BE-8AAF-10E67BE289BF}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{610A441F-92C2-4709-BB79-81675CD976D9}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{642A7BB3-57C4-431C-94A3-83E4AF6B675A}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E38CB93-91AC-4E74-9A65-C05BF40CCA5C}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77278183-8d10-4ba6-ab99-373e2983c982}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC901AEA-FACF-43D1-AC76-FD005D3F51A0}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ae189308-cf92-4e52-831e-3813099b9e90}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B24712D9-AFBC-40F9-BFFF-F8CA9EDCF7A6}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B7408DB9-1E29-4BCD-AC1E-144FCE00CF04}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8D247A1-E922-4E1D-8C4D-16BF9A9EDD7C}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BE78B5B7-8EDA-4DC3-80DA-0F2AB8E0835B}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C4F9F4E1-546D-426C-95B4-C8B64E0B2ABE}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C79D7703-E180-457D-8DD5-2C9DD5620D6A}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0388469-80A8-4FB1-BA07-15355B8042E6}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DA73BE73-E75A-439D-A2F1-5124EC1E1F99}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF176785-8632-49EF-A58B-D1F103C9D944}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF5A45A4-5EFA-45A3-9A96-80BD0C330129}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DFF2DABD-4AB1-4FB0-BB7D-4D6F799CFCA6}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E306ECA7-A595-46A9-B461-0620BA2B3B04}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E3744D8F-857A-4D5C-909B-40D810F3721D}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC818AE3-ED5C-434F-9BC2-53649C6BD022}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD2817E3-2AE8-4E0F-885F-4610A53EABCA}]

:Commands
[purity]
[EMPTYFLASH]
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow barand choose Paste.
• Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt%21.png button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach the JRT.txt to your next message.

Now install the latest Sun Java Runtime Environment

Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Windows 7, use right click and select Run As Administrator).

Please attach the below logs to your next reply:

• C:\MGlogs.zip
• JRT.txt
• C:\_OTM\MovedFileslog
• updated RKlog.txt

* Make sure you tell me if you had any problems running this procedure; and answer this - "What malware problems are you still experiencing?"

dr.m

 

No internet yet due to

and firewall broken because:

 

Hello, rengaw

Since you need to update your service pack level anyway, please download this file Microsoft Windows XP Service Pack 3 Final and save it to your "Downloads" folder.
After disabling your protection software, double-click the file then after the installation has completed - re-start your pc.
Then re-enable your protection and test for internet access.

Now give me a new MGLogs.zip ---> run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Windows 7, use right click and select Run As Administrator).

 

Note:

In your case of no internet access, download and transfer the file via flashdrive or CD/DVD.

dr.m