Virus Scan Problem

hcrawfor · Jan 4, 2008

After following the Malware procedures, I’m not convinced I have a Virus/Spyware
problem but am starting at this forum. Attached are the log files from that
procedure..... except the AVG Antivirus log files. That’s because TrendMicro’s
Antivirus software is running on the system. Therein lies my problem.

Although the software is running and continually updates definitions, I can not
successfully complete a scan of my system. The software goes into a loop, and
the only way I can re-start is through the power button on the CPU. Other than
that, my system appears normal. I’ve also started a Incident Report with
TrendMicro, but would appreciate any input you folks can supply.

I have been able to run a scan (1hr) in Windows XP ‘Safe Mode.’ Attached is a
log file it produced, but I don’t believe it provides much information. I
noticed many errors (Error - 94) on a variety of files in the DOS screen when it
was running.

chaslang · Jan 4, 2008

hcrawfor said: ↑

Attached are the log files from that
procedure..... except the AVG Antivirus log files. That’s because TrendMicro’s
Antivirus software is running on the system.
Click to expand...

The READ & RUN ME does not ask you to run AVG Antivirus!! It asks you to run AVG Antispyware.

Your logs do not really show any malware. I just see some leftovers from Symantec that need to be cleaned up along with a few other miscellaneous things to do.

First let's remove a leftover service from Symantec.

Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.

On the page that opens, scroll down to Symantec Core LC

then right click the entry, select Properties and press Stop Service.

When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.

Click OK until you get back to Windows.

Now Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall the below old versions of software:
Java 2 Runtime Environment, SE v1.4.2_03

Make sure you reboot after uninstalling the above! Do not skip this reboot.

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.6.0_03\bin\jusched.exe
O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/se...000001f.0000005b&c=00000083.0000001A.000000B7

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it
double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}]
Click to expand...

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

Make sure you tell me how things are working now!

Log in or Sign up

Virus Scan Problem

hcrawfor Corporal

Attached Files:

ComboFix.txt

MGlogs.zip

Virus ScanSafeMode010308.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member