Still need help... I think

Discussion in 'Malware Help (A Specialist Will Reply)' started by Javaslinger, Nov 30, 2007.

  1. Javaslinger

    Javaslinger Private E-2

    Ok, I followed the procedures for cleanup prior to posting logs. I think it helped, but for some reason my Windows updates will not apply. This was one of the previous symptoms I was experiencing including IE random popups, multiple registry changes detected by SpyBot, and a slew of virus/malware detections by WinDefender/SpyBot/Avast.

    Unfortunately, the only one I recall specifically is Fotomoto.

    I ran AdAware/Avast/Spybot/Windefnder each in /SAFEBOOT mode with no luck.

    As mentioned the cleanup procedures in the sticky's have helped a lot, but somethings still seem amiss.

    I'm attaching the logs, but a few notes.

    AVG did not produce a log for whatever reason. It only found tracking cookies.

    MGtools go an error about no finding somethign like procdll.txt and stopped until I clicked the error window at which point it wrapped up. The error window says 'The application failed to initialize properly (0x0000135). Click OK to terminate the application'. But I don't think it finished correctly. The error occurs while updating the hijackthis.log (gets to 64%) shortly after finishing the ShowNew part.

    Thanks in advance!!

    Javaslinger
     

    Attached Files:

    Javaslinger, Nov 30, 2007
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Please note that the READ & RUN ME does not ask you to attach a HijackThis log. The reason for this is the MGtools already gets one automatically and puts it into the MGlogs.zip file. This was explained on the download page.

    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {162C6BC2-E852-4D45-B139-E8A6737F1054} - C:\WINDOWS\system32\iifgeeb.dll
    O2 - BHO: (no name) - {165717F9-F772-4122-88AC-12A9B946AC1C} - (no file)
    O2 - BHO: (no name) - {B308FAE2-7D98-490E-B7BD-D079D7B2431D} - (no file)
    O2 - BHO: (no name) - {DED0B266-CFDA-412A-ADC0-B8777C1A846D} - (no file)
    O2 - BHO: (no name) - {FFB3DBF1-0397-4FEC-A99B-E3C2C39BDCDD} - (no file)
    O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
    O20 - Winlogon Notify: iifgeeb - C:\WINDOWS\SYSTEM32\iifgeeb.dll
    O20 - Winlogon Notify: rmkrjyyi - rmkrjyyi.dll (file missing)

    After clicking Fix, exit HJT.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Make sure you tell me how things are working now!
     
    chaslang, Dec 1, 2007
    #2
  3. Javaslinger

    Javaslinger Private E-2

    I really appreciate your help!

    Ok, I performed your instructions.

    The MGTools log.bat file still fails near the end with the same error as before.

    I removed the other HijackThis and it's logs prior to running it incase that was interfering. Didn't help.

    I tried to install the Windows updates again, and it failed to take again.

    I've attached the requested logs from Avenger and MGtools.

    Thanks again!

    Ken
     

    Attached Files:

    Javaslinger, Dec 1, 2007
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's okay! We don't need the processDLL.exe log anyway for your problems.


    There are many reasons for problems with Windows Updates. Most of them are not malware related. When we finish everything with malware, you can head to the Software Forum for this problem if it still occurs.

    You logs appear to be in good shape now; however I question.

    Somethng shows in your runkeys.txt log under the Haxdoor area but it is not Haxdoor. The trouble is that the service name is a little strange; but that does not mean it is bad. It just means I have never seen it and don't recognize it. Do you know what the below could be for?
     
    chaslang, Dec 1, 2007
    #4
  5. Javaslinger

    Javaslinger Private E-2

    Unfortunately no. It does not look like anything I'm aware of. The most recent PnP device might be my new Samsung MP3 player.... But the name is nothing like that.... Samsung T10

    What do you think?

    Thanks!

    Javaslinger
     
    Javaslinger, Dec 1, 2007
    #5
  6. Javaslinger

    Javaslinger Private E-2

    One more note.... There is a reference to SkyTel in my HiJackThis log... I'm pretty positive I don't have anything related to that 'on purpose'. From what I can tell that's related to pager systems???

    I've never had anything that would use that... Do you think that's hiding a trojan or something?

    Javaslinger
     
    Javaslinger, Dec 1, 2007
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If your PC is running okay, I would leave it alone for now.

    So how are things working?


    skytel.exe is for your Realtek sound card. It is the Realtek Voice Manager used by some of their audio chipsets.
     
    chaslang, Dec 1, 2007
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds