System Integrity Scan wizard trouble!

Discussion in 'Malware Help (A Specialist Will Reply)' started by Barney2012, Mar 30, 2008.

  1. Barney2012

    Barney2012 Private E-2

    Hi Clever People!
    I've very new to all this but have spent the last 12 hours trying to sort out this problem and your site appeared to have the best advice and guidance so i'm hoping you may be able to help me out.

    My machine appears to be infected with a spyware causing a number of different popups claiming System integrity Scan wizard and linking to a web site for PCantispyware, and also alerting me about a trogandownloader.XS and again trying to get me to but a new virus scanner. Also a system warning abopout Adebot virus.
    I've seen a number of other people with the same trouble but I think you need to see my logs to check the best way to get rid of them.
    In addition, initially Windows VISTA was also playing up and i would click on the start menu and them computer link and it would make all my icons disappear and then reappear but I couldn't access control panel (and therefore turn off UAC) or explorer to open any files. I could only open programmes via the taskmenu. After running MABM, skybot, SUPERantivirus and Sky scanner the problems with VISTA improved a little (I can open explorer but the control panel is still playing up) but I'm stil getting the popups.
    Hope you can help. It seems to have started since yesterday when the wife was "playing" on the internet, but unclear what she was looking for.
    Thanks in advance. B
     

    Attached Files:

    Barney2012, Mar 30, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Is your copy of Spy Sweeper a paid version or free trial? If free, uninstall it now.


    Uninstall the below old versions of software:
    Java(TM) SE Runtime Environment 6

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [rmwtehjf] C:\ProgramData\rmwtehjf\iherqtox.exe
    O4 - HKCU\..\Run: [WwTcnImqkf] C:\ProgramData\kdolodet\ahefgnwp.exe
    O4 - HKCU\..\Run: [qpicbbob] C:\ProgramData\qpicbbob\pkpctclo.exe
    O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\Barney\AppData\Local\Temp\dniappsu.dll",run
    O4 - HKCU\..\Run: [uppjpdrn] C:\ProgramData\uppjpdrn\nsxkxefk.exe
    O4 - HKLM\..\Policies\Explorer\Run: [WwTcnImqkf] C:\ProgramData\kdolodet\ahefgnwp.exe

    After clicking Fix, exit HJT.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\TEMP
    C:\Users\Barney\AppData\Local\Temp

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Make sure you tell me how things are working now!
     
    chaslang, Mar 31, 2008
    #2
  3. Barney2012

    Barney2012 Private E-2

    Hi Chaslang

    So pleased there is someone out there to help us simple people!!:confused

    Followed instructions (I hope)

    few issues:
    the line below wasn't present to delete, but I think it may be because I had just uninstalled the programme.

    HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"

    When deleting the tempory folders do i need to delete all the subfolders such as Google Toolebar which has files from 2 days ago?

    Hopefully attached are the two logs.
    so far system running okay and no popups or warning triangles in the corner telling me to buy antispyware programmes....... You may just have been a cyber saver!

    Please let me know if I need to do anything else. What do I need to do about my system restore? I tried running that before finding your website but although I could find the restore points, after I rebooted it told me it didn't work and the system didn't restore.

    Thanks so so much again for your help
    B
     

    Attached Files:

    Barney2012, Mar 31, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Not necessary unless we said files and folders. ;)

    Yes! Everything we tried to fix last time was not fix. I will give you some new instructions below.

    This may be an issue for the Software Forum, however we are going to be deleting all of your old restore points when we get to our final instructions because some are definitely infected anyway and you cannot trust them.


    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Policies\Explorer\Run: [WwTcnImqkf] C:\ProgramData\kdolodet\ahefgnwp.exe

    After clicking Fix, exit HJT.

    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Make sure you tell me how things are working now!
     
    chaslang, Apr 1, 2008
    #4
  5. Barney2012

    Barney2012 Private E-2

    Instuctions followed. I'm not sure if it worked though looking at the logs but I'll leave the clever interpretation to you, I'm just guessing.

    Thanks again for your help I have no idea what i would do without your assistance! :)
     

    Attached Files:

    Barney2012, Apr 1, 2008
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your MGlogs.zip is not correct. You need to run it again and attach a new log. And make sure you allow it to finish running. It looks like you stopped it from completing. Also watch for any error messages. The log you just posted contained mostly old information. Only the procdll.txt log was new.
     
    chaslang, Apr 2, 2008
    #6
  7. Barney2012

    Barney2012 Private E-2

    Sorry, I may not have turned off the User access control. It seemed to work okay this time.

    Sorry it take me a few hours to reply, I'm both across the pond and working night shifts... doesn't work well with communicating with anyone, even the family!

    Anyway hopefully this one will be correct.

    Thanks again
     

    Attached Files:

    Barney2012, Apr 2, 2008
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes that's better. ;) Your logs are clean.


    If you are not having any other malware problems, it is time to do our final steps:
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\cf" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    3. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you run Avenger, you can delete all files related to Avenger now.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    8. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    10. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
     
    chaslang, Apr 2, 2008
    #8
  9. Barney2012

    Barney2012 Private E-2

    Chaslang

    Following your advice its all working wonderfully.

    Thank you, thank you, thank you! :D:D:D

    Looking through previous threads I know I'm not the only one to be utterly impressed and very greatful for your help with dealing with matters that can give us simple folk such a massive headache.

    I also looked for a donation button which you definately deserve but note you don't have one. I know some computer companies over here would have charged me a fortune to fix this problem so I shall use the money I would have spent for a much better cause and I'll donate to one of our Children's charities in the UK instead and send you a "virtual beer " as a sign of my gratitude.

    I know where to come to (and send my friends!) when the little bugs come back to play. Thanks again.......:wave
     
    Barney2012, Apr 5, 2008
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome!

    Excellent!!!! :)

    Thanks! Surf safely.
     
    chaslang, Apr 6, 2008
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds