Total Security/Sys Security/Windows Police Pro battle

Discussion in 'Malware Help (A Specialist Will Reply)' started by insignius, Sep 9, 2009.

  1. insignius

    insignius Private E-2

    Okay guys, thanks first of all for the great site and all the guides/tips. A little about my situation/system.

    I'm trying to save my mom's machine which she or I inadvertantly allowed to be infected with a nice (nasty) variety of malware, including but probably not limited to Total Security 2009, System Security, and Windows Police Pro.:cry After days and days of fooling around I finally managed to get task manager to open upon startup and kill the main process (16547070 or some such), but this is only where the fun began. my machine then started restarting itself at random between 20 sec and 2-3 mins after startup, random bluescreens, and a couple of occassions of being obliterated with like 50-60 different error messages all piling. anyway, after MUCH fiddling with killing various random processes i didn't recognize, i was finally able to get the machine stable enough to surf. i had a hell of a time until i found this and the MBAM forum (of course, copy and pasting google results to get around the spammish redirects from the browser hijacking). all my .EXE associations were broken so after a little research i downloaded and installed the fix for this (WinXP_EXE_fix.reg), which took care of that. i was trying to run MB and it was blocked, and renaming it didn't help. at this point i found this site and started going thru the Read & Run... unfortunately, i didn't think to start taking *comprehensive*, detailed notes until i had got to this point, so i'm a little sketchy on some of the details as far as what i did and in what order prior to getting a couple steps into the R&R. i pretty much uninstalled/deleted everything at that point and just started from scratch from the R&R.

    anyway i'll attach the logs, with the exception of SAS, which ran the first time, shut itself down (after producing a log that was blank), and then would not startup again... even after trying to redownload and reinstall, i get an "Error 1321. Windows installer has insufficient privileges to modify this file: C:\program files\SUPERAntispyware\superantispyware.exe." Upon getting this error, i hit the installer's "ignore" button and tried to plod on, but alas, when i try to run it from the desktop it says "Windows cannot access specified device, path, or file. You may not have the appropriate permissions to access the item." it also does not run from the alternate start, though I get no error: nothing. MBAM would not run at first, either; the .exe would be running in the taskmgr, but no action. then it loaded, started the scan, and shut down after 4-5 seconds, and then was inaccessible via the same error mentioned above for SAS. RootRepeal did the same thing, but I was able to get it to run after combofix opened things up for me.

    lets see. anyway, I think that's basically all I can think of to include other than the logs. combofix was the first program that sort of "broke thru" so to speak, and after I ran it successfully I was able to run MBAM and whatnot, though SAS never did start running again. the machine is running fairly smoothly now, and I don't see any signs or anything suspect other than a "Windows Security Alert" that popped up in the tray, but appeared to be valid as it did not ask me to purchase WinDefender or any other software, and disappeared for good after I acquiesced and switched on the firewall.

    so all in all I think i'm in fairly good shape, but i'd like to be sure that i've taken care of EVERYTHING... so that the smashed up roach doesnt crawl out of the trashcan, so to speak. anyway thanks in advance for any advice you can give on whether i've got things squared away.
     

    Attached Files:

    insignius, Sep 9, 2009
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O24 - Desktop Component 0: tets - C:\WINDOWS\system32\onhelp.htm

    After clicking Fix, exit HJT.

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Now attach the below log:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Sep 13, 2009
    #2
  3. insignius

    insignius Private E-2

    hey Chas,

    thanks so much for your assistance. I really, really appreciate it. Things are (still?) running smoothly, so far so good.

    I have now done the following (and in that order):
    -Ran the app for removal of windows msgr.
    -ran analyse.exe and fixed requested items.
    -ran combofix as requested via dragging the CFscript.txt.
    -ran ccleaner.
    -updated and ran MGtools from C:\

    the requested logs will now be attached.

    the only thing in any way, even *remotely* strange throughout this process was after running combofix, my wallpaper was killed and went to solid blue, but that fixed itself on reboot so everything (to my very modestly trained eyes?) looks good. :cool

    question: i am now totally devoid of any type of AV/antispy software, and obviously will need to address this after we're done w/ cleanup etc. i don't have funds to purchase anything at this time so I am working simply from the free stuff. what would you recommend as far as configuring a type of suite to offer up the best protection?? I was really unhappy with AVG 8.5 as it let this thing through in the first place, and then was virtually impossible to uninstall. i was thinking something like Avira and Spybot SD, but am not totally sure about what will work in unison and how and what will interfere with one another. please advise! :confused

    thanks again, man the help was greatly needed.
     

    Attached Files:

    insignius, Sep 14, 2009
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just standard operating procedure for many scanners since they cannot tell when malware has stuck in a fake wallpaper or a user has a desired one. The easiest thing to do is set it back to default. Similar things can happen with browser start pages too.

    Spybot is not an antivirus program and only has antispyware type protection if you use Teatimer which we do not recommend. Avira is on our list of tools and would currently be the one I recommend to use before using AVG. Even Avast would be recommended ahead of AVG. Do remember that none of these are perfect. Protection begins and ends with you!!! Things like PartyGaming are far from recommended.

    Your logs are clean.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Sep 19, 2009
    #4

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds