Rootkit ZeroAccess still present. Completed Steps 1 & 2

Discussion in 'Malware Help (A Specialist Will Reply)' started by johneangel, May 22, 2013.

  1. johneangel

    johneangel Private E-2

    Hi. Having a difficult time trying to start a new thread in "Windows XP Malware Removal/Cleaning Procedure" even after closing ZoneAlarm, allowing all cookies and popups, links don't work. Thus, posted here.

    Computer infected with "Rootkit ZeroAccess Inserted into tcp/ipstack" per many ComboFix scans for 6+/- months.

    No other malware found by quick & full scans by Malwarebytes , Superantispyware, ZoneAlarm Extreme Security. I've been using ComboFix scans to clean up for months, but computer continues to work fast but slows down, since Rootkit ZeroAccess still present. Perhaps ZeroAccess enters via Adobe Flash since I watch movies, tv shows on computer.

    May 13 Uninstalled all old Combofix with Revo Uninstaller using "Advanced", highest removal setting.

    May 16 Began downloading cleaners but made mistake and started MGlogstools by accident. Let it run and then forgot what I did, dysfuntional memory. Will post that log if necessary.

    May 19 Completed all MG scans in sequence. Computer working fast, but it'll slow down in 3 or 4 days and I'll have to run ComboFix.

    May 20 Ran ComboFix. ZeroAccess still present. Scanned 1 to 50 stages in 15 minutes, total 25 min. Computer speed varies since comcast 1.5 mps speed varies.

    Remaining Problems

    1. ZeroAccess still present.

    2. CAPTCHA and Security Check boxes are not showing, probably a IE8/google setting problem.

    3. May 21, day after completing all MG removal programs I got some popups for phony Flash programs that look like Adobe but aren't. Thus, I never okayed them.

    4. May 21 got 3 official? pop-up notices for installing IE8 indicating that even though I get notices about Microsoft Updates and install them, evidently my IE8 is not always recognized as present.

    I went to http://www.microsoft.com/en-us/download/internet-explorer-8-details.aspx and was told:

    "You already have this download installed. Click "Next" to download Internet Explorer 8 again or use the navigation above to continue searching for downloads." I didn't click the next of the official? pop-ups since I'm paranoid and per MG, don't install new programs until cleaning completed. Suggestions? IE8 reinstallation may solve CAPTCHA problem.

    Pop-Up:
    "Set Up Windows Internet Explorer 8
    Welcome to Internet Explorer 8
    Internet Explorer 8 helps you use the Internet even faster than before.
    Read the Internet Explorer Privacy Statement online"

    Tried my best. Thanks, john


    HELP.
     

    Attached Files:

    johneangel, May 22, 2013
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding any evidence of a ZeroAccess infection.

    Use windows explorer to find and delete:
    C:\Documents and Settings\johnt\Templates\2509137411
    C:\Documents and Settings\johnt\Templates\3367619789
    C:\Documents and Settings\johnt\Templates\3469191438
    C:\Documents and Settings\johnt\Templates\50vGiJ1FW7x2
    C:\Documents and Settings\johnt\Templates\58G3tyIDc
    C:\Documents and Settings\johnt\Templates\jrNYi6G

    Tell me what issues you are having still.
     
    TimW, May 23, 2013
    #2
  3. johneangel

    johneangel Private E-2

    Thanks for the quick response.

    Rootkit ZeroAccess still present.

    May 23, Per instructions, deleted the 6 files at:

    C:\Documents and Settings\johnt\Templates\2509137411
    C:\Documents and Settings\johnt\Templates\3367619789
    C:\Documents and Settings\johnt\Templates\3469191438
    C:\Documents and Settings\johnt\Templates\50vGiJ1FW7x2
    C:\Documents and Settings\johnt\Templates\58G3tyIDc
    C:\Documents and Settings\johnt\Templates\jrNYi6G

    Started using shift-delete on jrnyi6g and thought it would be better to use CyberScrub(US Dept of Defense 3 passes).

    Is shift delete sufficient or 3 passes better?

    After the above deletions I rebooted computer, ran Internet Options Browsing history delete-delete, CCleaner default with advanced overwrite 3 passes and Registry Mechanics Clear Windows History and Clear Browsing History. Usually I clean computer out monthly using CyberScrub Schneier's algorithm (7 passes) and every 3-6 mths using Gutmann's slow 35 passes to sanitize.

    I reboot again, repeated CCleaner and Registry Mechanics and then Auslogics Disk Defrag.

    Next, I ran ComboFix which indicates Rootkit ZeroAccess still present.
    The final "scanning of the 50 Stages" took 17 minutes, total time of 42 minutes for the updating, backing up, initial scanning and 2 reboots due to presence of ZeroAccess. With a clean computer the ComboFix "scanning of the 50 Stages" takes 6 to 9 minutes vs infected computer scanning of 15 minutes or more.

    Templates for system files are not the same as system files.
    Assume template has to do with form, access, use, location?? Too confusing.
    System Files also found and still at locations All, johnt and/or NetworkService

    A C:\Documents and Settings\All Users\Application Data
    j C:\Documents and Settings\johnt\Local Settings\Application Data
    N C:\Documents and Settings\NetworkService\Local Settings\App Data

    50vGiJ1FW7x2 at A,j,N Cre 4/14/10 1:16:40 PM Mod 4/14/10 2:12:05 PM
    GDIPFONTCACHEV1.DAT Cre 4/14/10 1:21:25 PM Mod 4/14/10 1:21:26 PM
    at john & WINDOWS\sys32\config\systemprofile\Local Settings\App Data
    2509137411 at j CRE 4/14/10 1:22:29 PM MOD 4/14/10 1:24:37 PM
    3469191438 at j CRE 4/14/10 1:23:03 PM MOD 4/14/10 1:25:15 PM
    jrNYi6G at A,j CRE 4/16/10 6:20:32 PM MOD 4/16/10 6:59:59 PM
    3367619789 at j CRE 4/16/10 6:28:28 PM MOD 4/16/10 6:28:35 PM
    58G3tyIDc at j CRE 4/17/10 10:04:02 PM MOD 4/1810 7:10:00 AM

    Perhaps some of the system files need to be deleted since I still have Rootkit ZeroAccess present and since MG deleted some of the above system files and/or their Templates on a 4/26/10 case. I googled "2509137411" and found the following 4/26/10 MG case of at: http://forums.majorgeeks.com/showthread.php?p=1488039#post1488039

    You can find the deletion files by searching the MG case 4/26/10 for "2509137411".

    Minor information: GDIPFONTCACHEV1.DAT appears to be a font cache that was created during the creation of the above files. There's some web discussion about it being risky.

    No other files on my computer have Created or Modified times within 10 minutes of the 7 files, but the files before and after the 7 files are Macromedia Flash files, except when one of the 7 were the last file of the day, the next day has a Macromedia Flash files within minutes of bootup. Flash files are suspicous!

    GDIPFONTCACHEV1.DAT was created in the middle of the first 5 files above and was modified right before the 5 files were modified. Somethings fishy.

    Perhaps some more with the 6 files?

    thanks, john
     
    johneangel, May 24, 2013
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Attach the log from running ComboFix.
     
    TimW, May 24, 2013
    #4
  5. johneangel

    johneangel Private E-2

    Hi. Thanks for fast response. Without CAPTCHA ability, I'm limited.
    I might be getting hacks since my combo logs are getting messed up or I'm messing them up. I'm attaching 2 logs, one from yesterday and from today.

    ComboFix took 24 minutes to do the May 24 final scan of stages 1 to 50, about the same as that of the May 23 scan. Lost the early scan from May 23. Will search for it and send if found.

    Senile with a dysfunctional memory.

    thanks

    Looks like I have to submit both this reply and the additional options
     

    Attached Files:

    johneangel, May 24, 2013
    #5
  6. johneangel

    johneangel Private E-2

    Hi.

    Have I violated the Malwre Removal Guide Important Notices?

    Reread instructions today, May 25 since I didn't print instructions (printer broke) nor save them in Wordpad. Specifically, "Once you start this cleaning process to remove your malware please do not do anything to your PC except what is requested in this procedure. Do not install anything on your own and do not run other scans."

    1. I assumed that deleting files and browsing histories with Internet Properties-Browsing History-delete, "CClean Windows" using default settings and Registry Mechanics 'Clear Your Windows and Browsing Histories' are not running scans since they delete specific files.

    2. And, since I don't have cable TV, I stream TV and movies on computer, NO downloading.

    Does streaming movies/TV and specific file deletion violate the MG instructions?

    I assume "--please do not do anything to your PC--" refers to any repair and downloading.

    Thanks, john
     
    johneangel, May 25, 2013
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    There is no Zero Access infection showing in those logs. Just what issues are you having?
     
    TimW, May 25, 2013
    #7
  8. johneangel

    johneangel Private E-2

    Thanks for all the help.

    You said: "There is no Zero Access infection showing in those logs."

    Thus, I have to conclude:

    1. That the ComboFix installed on my desktop, May 16 is corrupted and is giving a false negative alert of being infected with the Rootkit Zero Access during the scanning of my computer.

    If this is true, why the long actual stage 1 to 50 scanning time of 24 minutes with total time of about 50 minutes for the last two scans? Because ComboFix is corrupted ??????? Without infections, ComboFix scanning completes in 6 to 9 minutes.

    2. That the missing CAPTCHA and Security Check boxes on some web sites is a IE8 and/or google problem.

    3. That the official popups for installing IE8 are due to IE8 errors, corruption.

    Thus, I will ignore the above 3 items, wait until Sunday evening, May 26.

    If all is okay, I'll proceed to Step 4 of Malware Removal/Cleaning Procedure:

    1. Remove ComboFix with Revo Uninstaller using "Advanced", highest removal setting.
    2. Uninstall MG req'd programs excluding Malwarebytes & TDSSKILLER, used since 1998.
    3. Enable disk emulation software. cidaemon.exe and APSDaemon.exe in my system.
    4. Disable and Enable System Restore and create a system Restore Point.
    5. In a week, install a new ComboFix and run.

    Thanks for all your speedy help.
     
    johneangel, May 25, 2013
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Tim is correct about no signs of a real ZeroAccess infetcion but there are quite a few other issues.

    Please download OTM by Old Timer and save it to your Desktop.
    • Run it by double clicking on it (Note: if using Vista, Win7, or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
explorer.exe

:Services
DatamngrCoordinator

:Files
c:\documents and settings\johnt\Application Data\searchresultstb
c:\program files\Search Results Toolbar
c:\documents and settings\All Users\Application Data\Datamngr
c:\program files\Common Files\Java\Java Update\jusched .exe
C:\Documents and Settings\johnt\Local Settings\Application Data\Wajam
C:\Documents and Settings\johnt\Start Menu\Programs\BrowserProtect
C:\Documents and Settings\johnt\Templates\2509137411
C:\Documents and Settings\johnt\Templates\3367619789
C:\Documents and Settings\johnt\Templates\3469191438
C:\Documents and Settings\johnt\Templates\50vGiJ1FW7x2
C:\Documents and Settings\johnt\Templates\58G3tyIDc
C:\Program Files\Search Results Toolbar
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{1AC1A6B1-4A97-1E66-7281-6ED8C4DF2D7E}"
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}]
[-HKEY_USERS\S-1-5-21-1614895754-1004336348-725345543-1004\Software\InstalledBrowserExtensions\215 Apps]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Babylon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Prod.cap]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Datamngr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_USERS\S-1-5-21-1614895754-1004336348-725345543-1004\Software\Classes\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}]
[-HKEY_USERS\S-1-5-21-1614895754-1004336348-725345543-1004\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_USERS\S-1-5-21-1614895754-1004336348-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings]
[-HKEY_USERS\S-1-5-21-1614895754-1004336348-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}]
[-HKEY_USERS\S-1-5-21-1614895754-1004336348-725345543-1004\Software\Softonic]
[-HKEY_USERS\S-1-5-21-1614895754-1004336348-725345543-1004_Classes\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXTlog
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!​
     
    chaslang, May 25, 2013
    #9
  10. johneangel

    johneangel Private E-2

    Hi chaslang.

    Thanks for assistance. My problem explanation is not to clear: 'Computer's fast but slows down in a few days or more and I use ComboFix, CCleaner, "PC Tools Registry Mechanics" and Auslogics Disk Defrag to clean and speed up. Computer's 9 years old.

    Completed 3 programs - Logs attached.

    OTM Safe Mode with Networking.
    Could not link nor get "large button" in: "Now click the large http://forums.majorgeeks.com/chaslan...es/MoveIt!.png button." Nothing happened, there was no large button.

    Copied files, returned to OTM box, pasted files and clicked the small "CleanUp!" box. Program ran.

    Tried everything: Normal Mode and Safe Mode with Networking with and without ZoneAlarm Extreme Security and set Intnet Properties to "Accept All Cookies" and unchecked " \Turn on Pop-up Blocker", etc. Then checked Task Manager and found 2 program exe files in Processes that I could not "End Process" or "End Process Tree": one for ZoneAlarm and one for Superantispyware(free).

    Junkware Removal Tool Ran fine.
    Did not reset my homepage of "about:blank".

    C:\MGtools\GetLogs.bat Normal mode without protection software.
    Should I have ran this at Safe Mode with Networking without protection software?

    Important Question
    Registry Mechanic in one of the things removed in JRT.
    Is it possible that Registry Mechanic is not the same as "PC Tools Registry Mechanic"?

    The icon has changed but not all the programs for "PC Tools Registry Mechanic" have been removed, only some.
    Thus, I'm supposed to stop using it.
    Am I to remove all Registry Mechanic folders?
    I paid for it, it's on CNET and listed as an excellent reg cleaner.

    Suggest advising specifically running: Normal, Safe Mode or Safe Mode with Networking without or with protection software.

    Too tired to edit, it's been over 4 hours.

    thanks, john
     
    johneangel, May 27, 2013
    #10
  11. johneangel

    johneangel Private E-2

    editing
     
    Last edited: May 27, 2013
    johneangel, May 27, 2013
    #11
  12. johneangel

    johneangel Private E-2

    Chaslang:

    Had a display problem with Adobe Flash Player 11 ActiveX. Couldn't download online, no graphics on some links in Adobe.com and on some other websites - www.juancole.com videos work okay with some eratics.

    Used Safe Mode with Networking and default MSN home page to downloaded new Flash Player, working okay with some hesitations. Don't know what caused the display problem, possibly surfing the web.

    MAJOR PROBLEM
    When I link with "http://forums.majorgeeks.com/forumdisplay.php?f=35", once connected to MR, the web page starts recognizing my computer and beneath the: "Welcome, johneangel. You last visited: Today at 01:52" a white rectangular box popsup with a blue world sphere with "Internet Explorer c" which is the beginning of "Internet Explorer cannot connect to---".

    1. Rt click the blue sphere and rt or lf click properties, you get: res://ieframe.dll/noConnect.png <<----Chaslang, note the ".png" on the Left

    My ZoneAlarm Extreme Security default setting for Public and Trusted Zones is not to Allow Incoming & Outgoing pings(ICMP Echo).

    I'll adjust Zone settings to whatever is necessary to stop the blocking.
    I have "forums.majorgeeks.com" in"Trusted Zone".

    2. Rt click Welcome and rt or lf click properties: http://forums.majorgeeks.com/showthread.php?t=276812

    3. Rt click Explorer and rt or lf click properties: res://ieframe.dll/dnserrordiagoff.htm#http://www.facebook.com/plugins/lik...show_faces=true&extended_social_context=false

    Assume you'll want some new scans.

    After I do the scans you'll give me today, will it be time to toggle System Restore off and on since all of ComboFix was removed from my computer with the 3 programs ran yesterday, May 26?

    I just ran Internet Properties Delete Browsing history, CCleaner windows default, Auslogics Disk Defrag and saved a Restore Point.

    Watched: http://www.juancole.com/2013/05/humiliation-palestinians-documentary.html Fair, not too shabby.

    Would it be okay to do the following which normally speeds up my computer and does include scans. Or whatever you suggest.

    1. Run the scans/programs you give me today and include off and on of System Restore someplace below.

    2. Run: sfc /scannow Which includes placing Reinstallation CD in D: for the req'd sys files. I haven't yet loaded them permanently in my system.

    3. Do a few things: ck mail and read/watch videos at www.juancole.com and a tv show, Revolution. No scanning.

    4. Run Internet Properties Delete Browsing history, CCleaner windows default, Auslogics Disk Defrag.

    5. Reboot and type in Command Prompt: "chkdsk /r" Reboot.

    6. Do a few things, no scanning.

    7. Run Internet Properties Delete Browsing history, CCleaner windows default, Auslogics Disk Defrag.,

    8. Reboot, save another Restore Point.

    Enough for the day, john
     
    johneangel, May 27, 2013
    #12
  13. johneangel

    johneangel Private E-2

    Performance, Problems Update

    1. Movies, videos, Tv shows, email and some web surfing info working perfectly.

    2. On starting computer, within a few minutes got official Windows screen to install IE8. Will do once cleaning completed. This will probably resolve missing CAPTCHA and Security Check boxes on some web sites.

    3, Won't work on ping problem until cleaning is done.

    4. PC Tools Registry Mechanic--Basically, computer working fine without using PC Tools Registry Mechanic. I believe I caused corruption of it by not heeding all warnings from ZA, ZoneAlarm that "Unless you trust this site, avoid entering personal information or downloading anything from it." I've had this warning during web searching on healthy food such as stevia and only "link to additional info".

    john
     
    johneangel, May 27, 2013
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You should not be using ComboFix unless an expert asks you to do so and then gives exact instructions on what to do with it. It is not a general purpose scanner that you should be running at will. Registry cleaning is not recommended as it can frequently cause more harm then good. Registry Mechanic is not malware. We just don't recommend using it. Running programs like this on brand new freshly installed copies of Windows will show several hundred to thousands of problems/issues that are not issues at all. And blindly fixing what they call problems will result in some things not working. Even many times the reason why Windows Update stops working.

    Why are you trying to run this in safe mode? That was not requested in my instructions. Are you unable to boot in normal mode?

    You need to complete my last instructions and attach the logs I requested. I cannot continue until you do this.

    Also note, when you continue to do things that we do not request, it complicates our ability to help you. The READ & RUN ME FIRST instructions stated early on that once you start the cleaning process that you should not do anything except what is requested.
     
    Last edited: May 28, 2013
    chaslang, May 28, 2013
    #14
  15. johneangel

    johneangel Private E-2

    Hi.

    I thought I had attached the logs for the 3 programs to my reply to your post of 05-26-13, 23:59. Evidentlly I didn't. Instead of attaching the those old logs, I'll run the 3 programs tomorrow and attach the new logs.

    OTM program problem. I could not link nor get "large button" in: "Now click the large http://forums.majorgeeks.com/chaslan...es/MoveIt!.png button." Nothing happened, there was no large button.

    I copied the log files, returned to OTM box, pasted files and clicked the small "CleanUp!" box. Program ran. Is this okay? I'll try again.

    john
     
    johneangel, May 29, 2013
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Actually we really want to first logs. Running them a second time would not give the original info from the first time the fix was run. But see below because it appears that you really have not run the fix properly yet.

    No! The Cleanup button is not what I need you to run. That does not run a fix. The MoveIt! button to the left of the Cleanup! button is for fixing things. You need to make sure that all protection is disabled including your firewall before you run OTM.exe. If you still have problems in normal boot mode, then run OTM.exe ( and only OTM.exe ) in safe boot mode.
     
    chaslang, May 30, 2013
    #16
  17. johneangel

    johneangel Private E-2

    Chaslang,

    Attached today's OTM log and May 26 logs of Junkware Removal Tool and MGlog.zip.

    I'm a wee senile and forget things if I don't write them down. Apology for my confusion and mistakes.

    OTM's 3rd lind of log: "No active process named explorer.exe was found!" This is why I keep getting Microsoft's Install IE8 page. MS Updates keep loading.

    I didn't read your yesterday post until after I spent over 6 hours today reruning the original 5 programs in normal mode excluding MGTools. I forgot today that your last instructions pertained to the 3 programs, OTM, Junkware Removal Tool and the C:\MGtools\GetLogs.bat.

    I reran OTM with ZoneAlarm shut down and tried normal mode. It worked and I did exactly what you instructed. But when the "command prompt type" black screen said something about rebooting, I may have accidently hit a key that caused it to reboot. Anyway I attached the OTM file. But have not done anything else untill I hear from you.

    My desktop is getting crowded. So and I put two new folders to c: and made them hidden and read only. Is this safe until cleaning done?

    What's next?

    Kitchen sinks needs repairing and I'm tired.

    Thanks, john
     

    Attached Files:

    johneangel, Jun 1, 2013
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No! You should only be doing what we ask you to do and nothing else. Anything you else you do will server to hinder the removal process and/or final cleanup when we finish. The folder I see with too many files in it that should not be there is the C:\Documents and Settings\johnt folder. You should not be saving all those files there. That is what your My Documents folder is for. You should not save anything at the johnt level. Only he system should put files there.

    You also need to stop moving the log files from MGtools into your root folder. Or you need to stop extracting them from the MGlogs.zip file into your root folder. However you are causing them to be there, because they do not belong there and will not get cleaned up automatically when we finish because the program does not expext them to be there. I will remove them with the below fix but please stop doing this.


    Make sure that you shutdown your ZoneAlarm protection before doing the below and follow the instructions as written. Do not run anything twice!!!!

    [*]Run OTM.EXE by double clicking on it
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
explorer.exe
:Services
DatamngrCoordinator
gupdate
gupdatem
 
:Files
C:\Program Files\Search Results Toolbar\Datamngr
C:\Program Files\Search Results Toolbar
C:\browserinf.txt
C:\combofix.txt
C:\ffdata.txt
C:\filelog.txt
C:\GetUnKey.txt
C:\hijackthis.txt
C:\JavaRa.log
C:\may 13.exe
C:\MGtools.exe
C:\miscinfo.txt
C:\miscinfo2.txt
C:\msrvlog.txt
C:\msrvstate.txt
C:\netinfo.txt
C:\netinflong.txt
C:\newfiles.txt
C:\nwktst.txt
C:\procdll.txt
C:\resetlog.txt
C:\runkeys.txt
C:\srven.txt
C:\sysinfo.txt
C:\UserInfo.txt
C:\winfiles.txt
C:\winsock.txt
C:\zafind.txt

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Privacy Suite RiskMonitor"=-
[HKEY_USERS\S-1-5-21-1614895754-1004336348-725345543-1004\Software\Microsoft\Windows\CurrentVersion\run]
"Privacy Suite RiskMonitor"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\APSDaemon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RegistryMechanic]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jun 1, 2013
    #18
  19. johneangel

    johneangel Private E-2

    Chaslang,

    Computer is working slow. Bootup takes 5m 30secs, normally 2.5 to 3.5 min.
    Movies, tv shows, videos on http://www.juancole.com/ are playing, but some movies loading slow and sometimes with pauses. Email, Outlook Express working but not as fast. I may have caused the slowness due to my mistakes, repeated scan of the 5 programs and not closing down ZoneAlarm.

    Moved most folders and files in "C:\Documents and Settings\johnt" that were not system programs installed, system updates and others to My Computer. But did not move .dat, .db, .reg, .ini, .log files to default location: C:\Documents and Settings\johnt\My Documents. This move helped computer work a little faster, but still slow.

    Was going to move programs, scans and logs of RogueKiller, TDSSKiller and Hitman back to desktop as original saved, but didn't since you said not to do anything and that they would be removed. MGtools was downloaded to C:\ per directions.

    A copy of the MGlogs.zip was installed on the desktop and also in C:\ by the C:\MGtools\GetLogs.bat program. I'll leave in both places unless instructed otherwise.

    I'll attach a quick reply tomorrow after using computer at least 3 times.

    thanks, john
     

    Attached Files:

    johneangel, Jun 2, 2013
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay this is not due to malware though. Your logs are clean. More like due to Zonealarm startup, SUPERAntiSpyware startup, and PC Tools Registry Mechanic 11.0 startmanager. Also have if you have run Registry Mechanic to perform and registry cleaning, it would not be the first time a PC starts to show problems due to registry cleaning which we do not recommend.

    You could try uninstalling ZoneAlarm to see how that impacts things. Just a test to see how much impact it is having. Then also try uninstall SUPERAntiSpyware too.

    Okay but that is not what my comment was really about. It was about the fact that you must have load MGlogs.zip into a ZIP type program and had extracted all the contents to C:\. You don't even need to look at the MGlogs.zip file ( unless we asked ) . Everything it in the C:\MGtools folder in uncompressed form it you want to see the logs.
     
    chaslang, Jun 2, 2013
    #20
  21. johneangel

    johneangel Private E-2

    Chaslang,

    Thanks for your continued thorough, patient service and for putting up with my mistakes.

    The end is here. Time to remove programs, files and to re-enable CD Emulation programs if I have them. Don't really know. The fact that I was never asked to reboot may be a false negative since I may have run DeFogger with my ZoneAlarm active. Do the clean scans indicate I have no Emulation programs? Or I need to rerun it?

    Time to remove the MajorGeeks' scan programs and files. I'd also like to remove the "old programs and files" of ComboFix, HiJackThis, SystemLook, Checkup and of others. What are the best and safest way to remove them?

    The .exe files without removal options can be dragged and dropped into Revo Uninstaller's Hunter Mode box. Other files/folders into CyberScrub window using B.Schneier' algorithm 7 passes or more. Or will you provide a desktop garbage can for disposal?

    My 7-zip program evidently automatically extracted the log files from MGlogs.zip file into my root folder. I'll read its instructions and correct the settings.

    Prior to running MG's scan programs, I unchecked all auto functions and disabled all protection of SuperAntiSpyware free edition, disabled "all SpywareBaster protection" and returned Malwarebytes' settings to default. For ZoneAlarm Extreme Security, one must select "exit" and click "yes" "BEFORE YOU CONNECT TO MAJORGEEKS, NOT AFTER".

    Computer is still slow. But, always after removing malware I RUN: sfc /scannow, bootup a couple times and then load Command Prompt screen and type in: "chkdsk /r" which makes computer faster, if not the fastest. Can't wait to do this.

    I will continue using PC Tools Registry Mechanic. But I will only use the default settings and only in Safe Mode and never when online, infected or have signs of infection. I will totally remove it and start anew after using 35 passes, "Erase Beyond Recovery" to clean previously deleted files beyond forensic recovery, I think.

    I've been using PC Tools, ZoneAlarm, Malwarebytes, SuperAntiSpyware and SpywareBlaster since 1998. This was a moderate infection and only got worst because of my mistakes. You did a great clean.

    john
     
    johneangel, Jun 3, 2013
    #21
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    I'm not quite following what you are saying here. If you did not have any disk emulation software running, you did not need to run DeFogger and there also would not be anything to renable. Clean scans having nothing to do with emulation programs? They are not malware so I don't know what you mean.

    I wouldn't. It would be on my list of things to uninstall. ;) But this is something you need to decide.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    3. Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    7. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    8. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    chaslang, Jun 4, 2013
    #22
  23. johneangel

    johneangel Private E-2

    Chaslang,

    Started final cleanup but confusion and desktop too crowded to get all copies of MG programs and others onto it. Don't know if the MGclean.bat file will clean, delete itself such that I won't be able to clean two or more times. Or does it seached my whole computer, not the just desktop? How should I remove old copies of same and other cleaning programs that include .exe file?

    Confusion with steps:

    4. ""If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry."" It doesn't say what to do if your running XP. I assumed it's directions are similar to Step 5?

    So being tired, I single clicked and nothing happened, then double clicked C:\MGtools\enableUAC.reg, was asked "Are you sure you want to add the information in C:\MGtools\EnableUAC.reg to the registry?" and said no.

    Then read Step 5 and assumed that Step 4 has to be completed before running Step 5. So I double clicked in Step 4 and clicked yes.

    Have not done Step 5 until I hear from you.

    thanks, john
     
    johneangel, Jun 6, 2013
    #23
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You should only be doing what is in my instructions. They did not ask you to copy anything to your Desktop. Just run the instructions step by step.

    Step 4 begins with "If running Vista or Win 7" which means it only applies to those versions of Windows. There is no UAC registry key in Windows XP. You should be skipping step 4 and continuing with step 5
     
    chaslang, Jun 7, 2013
    #24

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds