You fixed my husband...now it's my turn :)

Message 1 of 2

Hi there,

I'm greatful that you recently helped my husband clean up our family computer. I'm hoping you can help me too with my own computer. I've followed the Run Me First instructions in the Malware Removal Guide and I am attaching the logs from BitDefender, Panda, GetRunKey, ShowNew, and HijackThis.

In general, the computer exhibits some weird bahavior...sometimes you double-click an icon but the program never launches. Other times it just runs really slowly. I'm worried it is as infected as the other computer was.

Thanksgiving dishes are done, so I thought I would take a moment and upload the files...

Happy Thanksgiving! And thanks in advance for your help.

-C

 

2nd Attempt - First Thread Lost

I am grateful that you were able to help my husband fix our family computer. Now it's my turn. My computer runs very slowly and frequently when I click on an icon, nothing ever launches.

I have followed the Read Me First directions completely and I will attach the files from BitDefender, Panda, GetRunKey, ShowNew, and HiJackThis.

Any advice you can offer would be greatly appreciated.

(Note: I think I did something wrong when I sent the first Thread, but if it shows up, please pardon the fact that I submitted twice.)

Thank you in advance for your help.

-C

 

Welcome to MG's!

First, we need to rename HijackThis to "analyzethis.exe", once renamed run ComboFix from the thread below and then atatch fresh logs from the below.

Running ComboFix

Attach fresh logs from the below once you have ran ComboFix.

 

I was using PcCillin from TrendMicro and it kept locking up my computer while I was doing everything, so I completely uninstalled it. During the uninstall, CounterSpy went crazy with warnings. I hope I haven't made a mess of things.

Anyway, I renamed HiJackThis to AnalyzeThis, I ran ComboFix, HiJackThis, GenRunKeys, and ShowNew.

The files are attached.

Thanks.

-C

 

Message 2 of 2

 

Your logs are clean, there are no obvious signs of malware present per your logs.

If installed during the READ ME, you can now uninstall the trial version of Sunbelt CounterSpy.

I would recommend running CCleaner or ATF-Cleaner to cleanup any junk files.

 

OK - That seems to have cured most of the problems. Thank you.

However, I still have an occassional error that I can't solve and it is still happening after all the malware removal.

The computer goes to a blue screen and the error message reads:

***STOP: 0X000000A(0X691D2FF4, 0X0000000Z, OX00000000, 0X804E65DE)

Beginning dump of physical memory.
Physical memory dump complete.............contact system adminstrator, etc.

This crash isn't necessarily random. It seems to happen when I am on Internet Explorer and I open a Word Document over the Internet. But perhaps something else is causing it.

Any suggestions?

 

I would recommend posting this in the Software Forum, those guys can help you with this as it's not malware related.

 

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
7. If we had you run Avenger, you can delete all files related to Avenger now.
8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete C:\MGlogs.zip
10. If you are running Windows XP or Windows ME, do the below:
    • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!