zero access

Discussion in 'Malware Help (A Specialist Will Reply)' started by alyssa, Aug 23, 2012.

  1. alyssa

    alyssa Private E-2

    Hope I'm not double posting this. I inadvertently closed the page before posting.
    I got infected a couple of weeks ago with a 1jfuweif virus and was able to access the internet on another computer and got relief. Does not appear that it was totally removed. Computer locked up yesterday.
    Happened upon your site yesterday and followed your read and run first instructions to clear up the problem.
    Step 3 states to run the computer for a couple days to determine if any problems remain. My concern is that roguekiller and hitman identified several zero access malware files and, by direction, they were not quarantined or removed. I am concerned about using the computer for access to other systems perhaps compromising passwords and such.
    Is it safe to continue to use the computer for online banking, for example?
    Log files are attached.
     

    Attached Files:

  2. alyssa

    alyssa Private E-2

    I forgot to upload the MBAM logs
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please downloadComboFix to your desktop. Turn off any AV software you have before you run it. Attach the log when finished. Do not do anything while it runs.

    Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  4. alyssa

    alyssa Private E-2

    Thank you so much for your assistance.
    Attached are the files from combofix and mgtools.
     

    Attached Files:

  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks much better. Just use windows explorer to find and delete:
    C:\Documents and Settings\All Users\Application Data\529C50A8000083BB6A53363FD151FC4E

    Tell me what issues remain, if any.
     
  6. alyssa

    alyssa Private E-2

    Thank you again for your time and assistance. Your web site is remarkable.
    I have not had any problems since I ran the "read and run first" programs. I will restart and run thru tomorrow to see if any problems develop.
     
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let me know if you have any more issues. In the meantime:

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
  8. alyssa

    alyssa Private E-2

    Well, I messed up and installed combofix on the C:\ drive. Can I change the path instruction in the "run" command and accomplish the uninstall? I suspect you may already know that I installed it in the wrong placed based on the log files. Sorry.
     
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yeah, I forgot. Just slide it off the C: drive and onto your desktop.
     
  10. alyssa

    alyssa Private E-2

    Seems that I have gotten myself into a ditch because I did not properly follow your initial instructions.
    I "slid" the .exe file onto the desktop and it created a shortcut.
    When I tried to "run" the uninstall I got the message "could not find file C:\Documents and Settings\User\Desktop\Combofix.
    I deleted the shortcut and moved the combofix.exe and the combofix.txt files from the C:\ drive to the C:\documents and settings\user\desktop folder.
    I then tried to "run" the uninstall and the system activated the combofix executable file and started extracting all of its files and then tried to run combofix again.
    Do I now have the combofix extracted files in two different locations? Will I have to run the uninstall from the C:\ drive in addition to the desktop?
    Sorry again for my error. Judging from the amount of problems posted on your site, you don't have time for goofups like this.
     
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Just find all copies of the program or shortcuts and delete them manually. ;)
     
  12. alyssa

    alyssa Private E-2

    Just wanted to thank you again for the support.
    One comment: I am running windows xp and the system restore cycling was accomplished via START, CONTROL PANEL, SYSTEM, SYSTEM RESTORE tab. I did not have a restore capability by right clicking MY COMPUTER.
     
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you wish, you can pursue that in the software forum. And you are most welcome. Safe surfing. :)
     
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I just noticed that your BITS service is not running and therefore you probably can not do updates.

    Download the below to your dektop.

    BITS.reg


    • Now please click Start, and type regedit into the search box.
    • You should see a regedit.exe and icon appear in the Programs area of the Start Menu.
    • Right click on regedit.exe and select Run As Administrator
    • Then in the Registry Editor menu click File and select Import.
    • Navigate to the BITS.reg file saved to your Desktop and double click it. Allow it to be added to the registry.


    Reboot.
    Is Windows Update now okay?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds