Someone help! combofix wont :(

Discussion in 'Malware Help (A Specialist Will Reply)' started by callthecops, Apr 26, 2010.

  1. callthecops

    callthecops Private E-2

    Problem: There were a few trojans in my reg files that i've been trying to get rid of. Things like malwarebyes and spybot would detect these trojans, and removed some of them. Others seemed to come back from the dead, or were just unable to be removed. Mainly Trojan.Banker is the one I see the most. (logs will tell all)

    These were discovered when I ran MB because of some amateur adware that was easily removed, but now I have this problem. So naturally I moved on to combofix, and ran into another problem. Combofix will not complete, if it even gets to start up at all. Its really random, which is frustrating. Most of the time the blue dos box will come up, but only sometimes will it get to the actual stages in autoscan. If combofix starts completing stages, it usually stops around stage 8(I've waited for up to a half hour without it moving). Usually I will get an error while Combofix is running(i.e. PEV.exe Error: this application failed to initialize properly and tells me to hit "ok" to terminate{this wont actually terminate it though, just stops it from progressing}). -a friend suggested that PEV.exe was a trojan preventing combofix from functioning properly

    Ive updated combofix, downloaded new fresh installs for it countless times in case of the application being compromised. I've spent alot of time in safemode with better luck, but still haven't gotten it to complete.

    So now I've followed the guide for malware removal, saved all the logs and will be posting them.

    Thanks to anyone who can help!
     

    Attached Files:

    callthecops, Apr 26, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Why am I not seeing any AV program installed on this system? You need to install one now and run it!!

    Now download The Avenger by Swandog469, and save it to your Desktop.

    * Extract+ avenger.exe from the Zip file and save it to your desktop

    In the meantime, run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    * Run avenger.exe by double-clicking on it.
    * -Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\Avenger.txt
    * C:\MGlogs.zip
     
    TimW, Apr 27, 2010
    #2
  3. callthecops

    callthecops Private E-2

    Followed your steps with success, here are the log files.


    The reason why I don't have an AV is because none of them will install. Kaspersky says I already have mcafee AV and it cant install until i remove it, but I don't have mcafee and it won't delete when kaspersky attempts to uninstall it. AVG gives me a registry type error about being unable to create a file. Things like that.. figured whatever I have wont let me install any AV.
     

    Attached Files:

    callthecops, Apr 27, 2010
    #3
  4. callthecops

    callthecops Private E-2

    Everything seems to be in order now.. thanks a lot, really! Combofix is running and completing with logs like normal. I was able to reinstall kaspersky AV without errors, although my trial is still expired lol.
     
    callthecops, Apr 28, 2010
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Two things left that you can just use windows explorer to find and delete:
    F:\Documents and Settings\NetworkService\Local Settings\Application Data\p63586CeJQo2
    F:\WINDOWS\system32\cock

    Run CCleaner and make sure you remove everything ( excluding from this date ) from this folder:
    F:\Documents and Settings\Nightarin\Local Settings\temp\

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    TimW, Apr 28, 2010
    #5

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds