Spyware 2009

Discussion in 'Malware Help (A Specialist Will Reply)' started by Once upon a Geek, Apr 11, 2009.

  1. Once upon a Geek

    Once upon a Geek Private E-2

    Hello Major Geeks,

    Here's the story...

    Anti-Malware I generally run:
    McAfee, Spybot, AdAware, and sometimes MalewareBytes. But have several other programs installed from previous adventures.

    What happened: Approximately 10 days ago
    1. Started getting IE errors…. “ie has encountered an error and needs to close” etc.

    2. Ran my cleanup programs. Found some nasties and quarantined or deleted.

    3. Still problems. Downloaded ie7 (which I HATE), but still problems.

    4. Started getting the Spyware 2009 pop-ups along with redirected websites.

    5. Ran more clean-up programs and did some manual cleaning and website blocking. (Somewhere along the way I messed up my sonic update and had to delete it).

    6. Still more problems.
    Some of the Nasties and questionable stuff I found along the way:
    Trojan. Fake Alert
    Sysguard.exe
    Mcods.exe application error
    RemAdm – ProcLaunch 171
    Sysvol Info\.........|A0032642.exe (couldn’t completely remove)
    Trogen.dropper/Gen-123
    LAHCOCO.dll


    7. Went to your website and did all of the Read and Run Me First steps except for ComboFix.

    8. Then…..I couldn’t finish and had to be away from the computer for a week and it was in use while I was gone..


    What’s currently happening:
    Slow performance, unable to access McAfee website (and some other anti-malware sites such as Bleeping Computer), unable to run regedit.

    So….I’m sending this in and asking for your help.

    Have searched and can't find the SuperAntiSpyware scan results that I ran last week so I'm attaching the files that I do have.

    Let me know if I should just start over with your “read and run me first” since the scans aren’t fresh and I've failed to submit everything required.

    Really appreciate your help.
     

    Attached Files:

    Once upon a Geek, Apr 11, 2009
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to start anew. And this time make sure you let MGTools run to completion ( download the newest version and let it overwrite your version before you run it).
     
    TimW, Apr 14, 2009
    #2
  3. Once upon a Geek

    Once upon a Geek Private E-2

    TimW,

    Thanks for the reply.

    Trying to follow the directions but things are not going well.

    1. Re Ran SAS. Came up clean. File attached.

    2. ReInstalled Malewarebytes. Re Ran. Came up clean. File attached.

    3. Can't run ComboFix because I'm blocked from the BleepingComputer website -- and -- also I read elsewhere on the majorgeeks site not to run this program.

    4. Re Ran MGtools but it just seems to hang. First time I waited over an hour. Then I deleted everything and reinstalled. Ran for an hour and a half. Same result. The zip file only seems to contain the GetUnKey.txt. Attached.
    Appeared to create newfiles.txt - Attached

    Looks like I'm out of space and need to attach more files. Will have to double post.

    Thanks, More to follow...........
     

    Attached Files:

    Once upon a Geek, Apr 15, 2009
    #3
  4. Once upon a Geek

    Once upon a Geek Private E-2

    TimW,

    Here is part 2 from my previous post.

    I could not get GetRunKey to go either from the MGtools.exe or from the GetRunKey.bat file.

    I did run the analyse.exe from the MGtools folder and I attached the hijack log.

    Trying to give you everything you need but it's not going well.

    Appreciate your help.
     

    Attached Files:

    Once upon a Geek, Apr 15, 2009
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The logs arent giving me enough. Try running Dr.Web.

    Attach the log. Then see if you can run either Combo and then run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.
     
    TimW, Apr 18, 2009
    #5
  6. Once upon a Geek

    Once upon a Geek Private E-2

    TimW

    Thanks for the response.
    I’m operational,,,, but ,,, I don’t know what animals might be running in the background.

    Web pages are still getting redirected. Outlook messages are slow to open. I’m getting what appears to be false alarm popups and questionable icons in the tray.

    I still am blocked from anti-malware sites and my mcafee updates.

    Have tried a few different routes to my registry and can’t get there.

    Right before I saw your post I booted into safe mode as administrator and ran MGtools. Was able to finally get a RunKey file (but I don’t know if that helps in safe mode vs. normal mode). FILE ATTACHED.

    Followed your directions and downloaded Dr. Web. Ran the app.
    Express Scan --- showed no viruses.
    Ran complete Scan --- REPORT FILE ATTACHED.
    Found – C:\$VAULT$.AVG\05812437.FIL .. infected with Trojan.DownLoader.34097 --- Cure? I pressed Yes.
    Found – C:\$VAULT$.AVG\09489390.FIL .. infected with Trojan.FakeAlert.342 --- Cure? I pressed Yes.
    Found – C:\$VAULT$.AVG\46304016.FIL .. infected with
    Trojan. FakeAlert.342 --- Cure? I pressed Yes.

    A0032642.exe/data002\32788R22FWJFW\C.bat
    C:\System Volume Information\_restore-{129201FA-B0AC-49B3-96B2-DEB8B91E727B}-\RP502\A0032642.exe/data002 Probably BATCH.Virus -- Deleted File

    A0032642.exe/data002\32788R22FWJFW\psexec.cfexe
    C:\System Volume Information\_restore-{129201FA-B0AC-49B3-96B2-DEB8B91E727B}-\RP502\A0032642.exe/data002 Program.PsExec.171

    C:\System Volume Information\_restore-{129201FA-B0AC-49B3-96B2-DEB8B91E727B}-\RP502\A0032642.exe Archive contains infected objects Move? I pressed Yes
    C:\System Volume Information\_restore-{129201FA-B0AC-49B3-96B2-DEB8B91E727B}-\RP502\A0033012.exe infected with Trojan.Fakealert.4139 ---- Cure? I pressed Yes.

    LOG FILE FROM DR. WEB is HUGE. Will have to try to break up, compress, and submit separately.

    Tried to go to Bleeping Computer to get ComboFix but access is still Blocked.

    Re-Ran MGtools in Normal Mode and “appeared to get a RunKey file. FILE ATTACHED

    I know you guys are swamped and I appreciate the help.
     

    Attached Files:

    Once upon a Geek, Apr 19, 2009
    #6
  7. Once upon a Geek

    Once upon a Geek Private E-2

    Here's Part 2, the Dr Web Logs.
     

    Attached Files:

    Once upon a Geek, Apr 19, 2009
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    All that was found were items in either the quarantine folder or your system restore files.

    Please set msconfig to normal boot and then reboot.

    We will try this again:
    Open notepad and copy and paste the following text in the quote box into the window:
    Save this as fix.bat
    Choose to save as all files.
    Doubleclick fix.bat and let the program run.
    A small black dos window will flash, this is normal.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):
    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Use windows explorer to find and delete:
    C:\WINDOWS\system32\qblkdbl.qke --- use the find function when you open the sys32 folder.

    Do you have your xp cd? (I've slept since then if you said already...LOL),
     
    TimW, Apr 21, 2009
    #8
  9. Once upon a Geek

    Once upon a Geek Private E-2

    TimW

    Argh….I was hoping we were making progress….Have been at this for 3 weeks…sigh

    Anyway, you asked about XP CDs. I found them,,,,right there with my WIN98 CDs. What I have are two Dell Reinstallation DVDs for Win XP Media Center Ver 2005. Still sealed. (I hope you’re not going to make me use them.)

    Followed your instructions the best I could. Start-up was set to Selective – changed to Normal. Had trouble on reboot – still looking for my sonic file.

    Assume I should change back when we are done?

    Ran fix.bat. No dos window appeared but desktop went blank and re-appeared.

    I think I disabled all anti- spyware. Built the fixME file. Ran it. Did not get a success message. Just lost desktop for a moment and then reappeared.

    Did not find qblkdbl.qke in win\sys32 but was present in C :\windows. Delete (?)

    What next?

    Thanks
     
    Once upon a Geek, Apr 21, 2009
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Try to download The Avenger by Swandog469, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:


    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Please run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file and the avenger log.
     
    Last edited: Apr 25, 2009
    TimW, Apr 25, 2009
    #10
  11. Once upon a Geek

    Once upon a Geek Private E-2

    Progress!

    Avenger only found C:\WINDOWS\qblkdbl.qke
    Did not get the popup on reboot, but FILE ATTACHED

    But was able to successfully run C:\MGtools\GetLogs.bat
    FILE ATTACHED

    Looks like one of the culprits was the C:\WINDOWS\qblkdbl.qke

    I tested access to Mcafee and Bleeping Computer and I'm able to hit those websites. Also able to get to my registry.

    Thanks,
    What next?
     

    Attached Files:

    Once upon a Geek, Apr 25, 2009
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You should now be able to run ComboFix.

    First, run Ccleaner to clean out only temp files and nothing else!

    Please do so and afterwards, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip
     
    TimW, Apr 29, 2009
    #12
  13. Once upon a Geek

    Once upon a Geek Private E-2

    Logs attached.

    Thanks
     

    Attached Files:

    Once upon a Geek, Apr 29, 2009
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Sweet.......your logs are clean. :)

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, May 2, 2009
    #14
  15. Once upon a Geek

    Once upon a Geek Private E-2

    TimW,

    Final steps completed.

    ....If only the maleware creators would do something to help people...instead of just being a nuisance and wasting all of our time.....

    You guys do a great service!!!

    Thanks again.:)
     
    Once upon a Geek, May 5, 2009
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are very welcome....safe surfing!! :)
     
    TimW, May 8, 2009
    #16

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds