System infected with My Web Search stuff

trisha · Mar 5, 2013

This is my friend's computer. The computer was running very slow and she said it was sending emails out without her knowledge. She had never cleared the temp files and that was quite a wait for those to be dealt with. I realize she needs to add more RAM. Computer seems to be running a bit faster but is still infected. Read & Run Files are attached.

Thanks for your help. I ended up with two MB log files. One shows no action taken because I saved the file before running the cleaner part. There were many files deleted, however, the second log shows only 5 files cleaned.

Another thing is that the mouse on this computer seems to have a mind of it's own, keeps scrolling without a button being pressed. Maybe just needs a new mouse. Also, cannot access My Documents and Documents and Settings Folders "Access Denied" even though I followed instructions regarding UAC.

trisha · Mar 5, 2013

Second MB log file.

Kestrel13! · Mar 5, 2013

Rerun Hitman and have it delete Malware, Malware remnants and Potentially Unwanted Programs.

Uninstall the below:

Ask Toolbar
Viewpoint Media Player
Click to expand...

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

trisha · Mar 5, 2013

I ran Hitman Pro again. Some of the choices were to quarentine some of the files. I changed those to Delete as well. The ASK files they recommended Ignore so I did.

I uninstalled Ask Toolbar and Viewpoint Media Player.

Attached is the logs for Hitman Pro and MG Tools Getlogs.bat.

The reboot is rough after the log in screen. The desktop wallpaper kind of pops in and out of view with a white screen replacing it for a few seconds.

Also, at boot there was an error message:

KBD.exe has stopped working. Then there is a notification to Microsoft.

There was also a notification about a security patch for Adobe Reader. I suppose I should wait for all of this other stuff to be taken care of before I go messing with that.

Kestrel13! · Mar 6, 2013

No, I don't want you to ignore the ASK stuff Hitman finds, you need to re run it as I asked and have it delete items under the heading: Potential Unwanted Programs
Now re run it again and show me the new log, hopefully with hitman finding nothing of what we wanted killed.

trisha · Mar 17, 2013

Sorry it has taken so long to get back to you Kestrel13!. I have not had access to the computer in question. I should be gaining access to it again sometime this week and I will rerun Hitman. Sorry about the misunderstanding.

Kestrel13! · Mar 18, 2013

Not a problem.

trisha · Apr 4, 2013

Kestrel13! said: ↑

No, I don't want you to ignore the ASK stuff Hitman finds, you need to re run it as I asked and have it delete items under the heading: Potential Unwanted Programs
Now re run it again and show me the new log, hopefully with hitman finding nothing of what we wanted killed.
Click to expand...

ask toolbar.msi cannot be found on the computer so it was not uninstalled. I reran Hitman and deleted all references to ASK. I ran MG Tools Getlogs.bat.

Logs are attached for Hitman and MGtools

Kestrel13! · Apr 5, 2013

OK so is everything running nicely at this point?

trisha · Apr 5, 2013

The browser is still a bit sluggish after disabling almost all add-ons. She has YahooBrowserPlus installed. I did disable it in the browser but of course it is still listed in the Add/Remove Programs so I don't know if just disabling it will make that much of a difference. This computer came with Vista and with 1Gig of RAM. How much more RAM do you suggest she adds? Do you think that adding more RAM will help with the sluggishness of the browser. The computer does seem to boot slowly as well. The hard drive is less than half capacity full so I don't think that contributes to the slowness of the loading of the computer after the password is entered. That is when the slowdown begins.

Kestrel13! · Apr 6, 2013

You can ask about this in the software forum.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Press and hold the Windows key http://forums.majorgeeks.com/chaslang/images/Windows_Logo_key.gif and then press the letter R on your keyboard. This opens the Run dialog box.

Copy and paste the below into the Run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

trisha · Apr 23, 2013

I haven't forgotten about this clean up. I need to get back to my friend's computer. Thanks for all the help.

Kestrel13! · Apr 23, 2013

You are most welcome.

Log in or Sign up

System infected with My Web Search stuff

trisha Corporal

Attached Files:

RKreport[1]_S_03042013_02d1615.txt

MGlogs.zip

MBAM-log-2013-03-04 (16-40-35).txt

TDSSKiller.2.8.16.0_05.03.2013_11.59.27_log.txt

HitmanPro_20130305_1217.log

trisha Corporal

Attached Files:

mbam-log-2013-03-04 (16-47-08).txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

trisha Corporal

Attached Files:

MGlogs.zip

HitmanPro_20130305_1536.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

trisha Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

trisha Corporal

Attached Files:

MGlogs.zip

HitmanPro_20130404_1425.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

trisha Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

trisha Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member