Trying to secure my PC... can't DL any AV at all.

lsdnnll · Sep 13, 2009

I play warcraft and after my account got hacked and recovered twice, I am desperately trying to secure my computer. I've tried to download AVG, the free AV from pctools, the online Kapersky scanner wont work... I get some kind of corrupted file error message every time. I am going nuts trying to fix this, and this is my last attempt before I spend the $70 at dell to get a new disk to just wipe the whole thing clean so I can start over.

I don't have an antivirus running and I'm using the Windows firewall.

I did my best to follow the sticky and the results are as follows. Every step that actually worked, I didn't bother commenting on.

On trying to install Java...

"Error 1330.A file that is required cannot be installed because the cabinet file C:|Documents and Settings\Lisa\Application Data\Sun\Java\...\Data1.cab has an invalid digital signature. This may indicate that the cabinet file is corrupt."

On trying to install superantispyware.exe...

"Corrupt installation detected, check source media or re-download."
(said the same thing after renaming the file)

On trying to install malwarebytes...

"An error occurred while trying to copy a file: The source file is corrupted."

On trying to run ComboFix...

"Some installation files are corrupt. Please download a fresh copy and retry the installation."

On running RootRepeal...

"Error - Invalid PE image found!"

I was able to rum MGtools and attached the log. I also attacked a HJT log just because nothing else really worked.

Thank you so much,
Lisa

*Edited to add... In the meantime, I did change all my passwords on my email, game accounts, paypal, etc... on a secure computer.

TimW · Sep 18, 2009

Let's see what we can do.

Please go to start / run / type:
services.msc
When the window opens, scroll down to zzzHPSETUP and change it to disabled.

Now, run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [zzzHPSETUP] E:\Setup.exe
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O24 - Desktop Component 0: (no name) - http://picsrv.manutd.com/?fif=/manu...iip,1.0&wid=1280&hei=960&rgn=0,0,0,0&cvt=jpeg
Click to expand...

After clicking Fix, exit HJT.

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"zzzHPSETUP"=-

Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now use windows explorer to find and delete;
E:\Setup.exe

Now run Ccleaner to clean out only temp files and nothing else!

See if you can now download the scanning tools.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

Log in or Sign up

Trying to secure my PC... can't DL any AV at all.

lsdnnll Private E-2

Attached Files:

MGlogs.zip

hijackthis.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member