Something fishy maybe going on?!

Discussion in 'Malware Help (A Specialist Will Reply)' started by kotton, Sep 5, 2006.

  1. kotton

    kotton Private E-2

    Allright so I read through your read first section and no im not a noob, I run the usual, spybot, adaware, and ewido as well as having norton antivirus running. but I think I might have picked up something sneaky or just well hidden cause my scans come up clean other than a few weak(usual) tracking cookies. I will post my hijackthis log as an attachment and if someone could scan it for me and see if they notice anything out of the ordinary that would be great, and yes I do like porn so it is partially my fault:rolleyes:
     

    Attached Files:

  2. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    HijackThis is not a Malware Removal tool. It is simply a scanner that looks at registry keys commonly used by malware. A clean HijackThis log is not an indicator of a clean system.

    Welcome to MajorGeeks.com!

    Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

    - Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis:

    Downloading, Installing, and Running HijackThis

    Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

    When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
    • runkeys.txt - the log from GetRunKey.bat
    • newfiles.txt - the log from ShowNew.bat
    • CounterSpy - ONLY IF you were not able to run Windows Defender
    • Bitdefender - from step 6
    • Panda Scan - from step 6
    • HijackThis
     
  3. kotton

    kotton Private E-2

    I am not getting anything from scans on any of the software I use, but everyonce in a while i have been getting redirect links aka when I click on a link I get a not so expected page, it may be that they are just not so trustworthy webpages, but I thought that someone might be able to scan my logfile and see if there is anything hiding in there that I dont recognize. thanks for your time
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes you do have problems, but as SPD already told you a HijackThis log alone is not good enough especially when it is not renamed properly. You need to follow all the steps he gave you and all of the logs. You also must disable Spybot's Teatimer (as indicated in the READ ME) because it will get in the way of the fixes. Then he will be able to help you cleanup ALL of your malware problems.
     
  5. kotton

    kotton Private E-2

    Allright I went through and ran all of the programs and scanners up until the online scanners, because I dont use IE, firefox only. I posted the logs as attachments for runkeys, newfiles, and HJT. Also thru my scans I found no new problems and the only software I found was a viewpoint media player which I am pretty sure I had downloaded knowingly for a reason but uninstalled anyways. I hope that this is enough info for you to check my scans. thanks
     

    Attached Files:

  6. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    The online scanners are required. IE must be installed on your computer, or it won't function correctly. It's that deeply embedded into the OS.

    I need those logs.
     
  7. kotton

    kotton Private E-2

    damn I cant afford to waste 3 or 4 hours of my computer time on those scans, I have IE I just dont ever use it. Well I will give the scans a run over night and see if I can get them done. thanks sorry for being a PainInTheAss.:eek:
     
  8. kotton

    kotton Private E-2

    The counterspy scan come back completely clear, as well as the ccleaner, and the long for bitdefender is attached but is clean as well all that I have left is panda so I will get it to you when its done.
     

    Attached Files:

    Last edited: Sep 6, 2006
  9. kotton

    kotton Private E-2

    All right all the scans are done and all the logs are submitted with the posting of this reply, I am going to run a fresh HJT log for this reply as well. Thanks again for your time and patients.:)
     

    Attached Files:

  10. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Download
    - Pocket Killbox

    << The installed version of Java on this compter is out-dated. Install Java Runtime Environment (JRE) 5.0 Update 8 available from http://java.sun.com/javase/downloads/index.jsp. Uninstall all older versions of Java on your computer, before installing the latest version of Java. >>

    Using Add or Remove Programs in the Control Panel; uninstall the following:
    Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop.
    Close Notepad.

    Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

    Follow teh porcedures for WareOut Removal.

    Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:
    Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

    Now run Pocket Killbox:

    Choose Tools -> Delete Temp Files and click Delete Selected Temp Files

    Then after it deletes the files click the Exit (Save Settings) button.

    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

    Select:
    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
    If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

    Now boot into SAFE MODE

    Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

    Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.

    REBOOT to Normal Mode.

    Post a fresh HijackThis log.
     
  11. kotton

    kotton Private E-2

    Allright I followed all the directions except to delete limewire cause I use that program. The new HJT log and fixwareout log are attached. Thanks again for you time and effort.
     

    Attached Files:

  12. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Peer-to-peer file swapping programs, such as Audiogalaxy, Bearshare, Blubster, E-Mule, Gnucleus, Grokster, Imesh, KaZaa, KaZaa Lite, Limewire, Morpheus, Shareaza, WinMX and Xolox. Degrade network performance and consume vast amounts of storage. Create security issues as outsiders are granted access to internal files. Often bundled with Adware or Spyware.

    Which is the case with Limewire, contrary to whatever claims Limewire may make their software is bundled with spyware and often what you are downloading contains a virus.

    Your logs are clean. How is your computer running?
     
  13. kotton

    kotton Private E-2

    The computer is running great not that I noticed much of a difference but its very nice to know that I dont have anybody looking over my sholder and slowing down my machine. I use limewire for avi, mepg, and mp3s only, so I think that keeps me pretty much clear of viruses. Thanks again
     
  14. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds