Edited by zenrox, 12 March 2009 - 02:20 PM.
removed most viruses/spywares. is my log clean? [Solved]
Started by
zenrox
, Mar 07 2009 05:57 PM
-
This topic is locked
#2
Posted 08 March 2009 - 04:40 AM
heir
-
- Malware Removal
-
- 5,427 posts
Trusted Helper
Hello zenrox !
My nickname is heir and I'll be helping clean up your computer.
Before we proceed to clean your computer from malware, let's go over some points that will help both me and you, and prevent causing damage to your computer:
Please read my posts completely before following the instructions.
It may be easier for you if you copy and paste a post to a new text document or print it for reference later.
This is required when you won't have access to Internet.
Step 1.
OTL2:
Step 2.
Lop S&D:
Disable resident protections (Antivirus...); you'll re-enable them after the scan
Download Lop S&D < here and save it to the desktop
Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Step 3.
Things I would like to see in your reply:
My nickname is heir and I'll be helping clean up your computer.
Before we proceed to clean your computer from malware, let's go over some points that will help both me and you, and prevent causing damage to your computer:
- To make sure that you receive an email when I reply to this topic, please click here and check that this topic is listed under Malware Removal - HijackThis™ Logs Go Here.
- Please don't be afraid to ask questions! No question is considered dumb here. It's better to be safe than sorry!
- When posting logs, please ensure Wordwrap is turned off in Notepad (to check, open Notepad in the menubar click on Format and make sure that Word Wrap is unchecked)
- Please follow the steps exactly in the same order posted. If you can't perform a certain step, or you're unsure on what to do, please stop and let me know.
- NEVER fix anything in HijackThis or other programs on your own! This can be very dangerous and cause harm to your system. If you see a certain entry or program you're unsure about, please don't hesitate to ask!
- Make sure you reply to this thread using the Add Reply button:
Please read my posts completely before following the instructions.
It may be easier for you if you copy and paste a post to a new text document or print it for reference later.
This is required when you won't have access to Internet.
Step 1.
OTL2:
- Download OTListIt2 to your desktop.
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- When the window appears, underneath Output at the top change it to Minimal Output.
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
Step 2.
Lop S&D:
Disable resident protections (Antivirus...); you'll re-enable them after the scan
Download Lop S&D < here and save it to the desktop
Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Step 3.
Things I would like to see in your reply:
- The content of OTListIt.txt and Extras.txt from step 1.
- The content of C:\lopR.txt from step 2.
#3
Posted 08 March 2009 - 05:47 PM
zenrox
- Topic Starter
-
- Member
-
- 23 posts
Member
log
Edited by zenrox, 12 March 2009 - 02:19 PM.
#4
Posted 09 March 2009 - 01:48 AM
heir
-
- Malware Removal
-
- 5,427 posts
Trusted Helper
I'm looking over the logs from OTL2. Meanwhile
Try it again, and capture the error message or post the log if it succeeds.
What was the error message, so we can troubleshoot why it didn't run?
Let's try this tool also.
Download Rooter.exe to your desktop
Lop S&D installed but didn't run properly. It opened up a command window and said invalid things in it.
Try it again, and capture the error message or post the log if it succeeds.
What was the error message, so we can troubleshoot why it didn't run?
Let's try this tool also.
Download Rooter.exe to your desktop
- Then doubleclick it to start the tool
- A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here
Edited by heir, 09 March 2009 - 01:51 AM.
#5
Posted 09 March 2009 - 03:25 AM
zenrox
- Topic Starter
-
- Member
-
- 23 posts
Member
log
Edited by zenrox, 12 March 2009 - 02:18 PM.
#6
Posted 09 March 2009 - 04:09 AM
heir
-
- Malware Removal
-
- 5,427 posts
Trusted Helper
Thanks for the info.
Rooter worked though. Let's hit that rootkit.
Download ComboFix from one of these locations:
Link 1
Link 2
Link 3
* IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Rooter worked though. Let's hit that rootkit.
Download ComboFix from one of these locations:
Link 1
Link 2
Link 3
* IMPORTANT !!! Save ComboFix.exe to your Desktop
- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
- Double click on ComboFix.exe & follow the prompts.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
#7
Posted 09 March 2009 - 06:48 PM
zenrox
- Topic Starter
-
- Member
-
- 23 posts
Member
log
Edited by zenrox, 12 March 2009 - 02:17 PM.
#8
Posted 10 March 2009 - 02:01 AM
heir
-
- Malware Removal
-
- 5,427 posts
Trusted Helper
Step 1.
Uninstall unwanted software:
Please go to Start > Control Panel > Add/Remove Programs and remove the following:
SoulSeek Client 156c
Viewpoint Media Player
Optional removals
SoulSeek and P2P programs in general are legal themselves, but much of the content downloaded with them is downloaded illegally. They are also a great way to infect yourself with malware.
It's up to you if you want to remove the above programs, however I recommend you do.
Step 2.
CFScript:
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the codebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
Step 3.
Lop S&D:
Please run Lop S&D again and post the log (C:\lopR.txt)
Step 4.
OTL2:
Please scan your computer with OTListIt2 again and post the fresh log (OTListIt.txt)
Step 5.
Things I would like to see in your reply:
Uninstall unwanted software:
Please go to Start > Control Panel > Add/Remove Programs and remove the following:
SoulSeek Client 156c
Viewpoint Media Player
Optional removals
SoulSeek and P2P programs in general are legal themselves, but much of the content downloaded with them is downloaded illegally. They are also a great way to infect yourself with malware.
It's up to you if you want to remove the above programs, however I recommend you do.
Step 2.
CFScript:
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the codebox below into it:
File::
c:\windows\system32\LoopyMusic.wav
c:\windows\system32\BuzzingBee.wav
c:\windows\system32\ubasawig.ini
c:\windows\system32\ugagadat.ini
Folder::
c:\documents and settings\miss park\Application Data\Azureus
Registry::
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O20 - AppInit_DLLs: C:\WINDOWS\system32\yizimife.dll nqecgz.dll
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{106d5ee2-13e6-11dc-b5c5-0013202523b7}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\Azureus\Azureus.exe=-Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
Step 3.
Lop S&D:
Please run Lop S&D again and post the log (C:\lopR.txt)
Step 4.
OTL2:
Please scan your computer with OTListIt2 again and post the fresh log (OTListIt.txt)
Step 5.
Things I would like to see in your reply:
- Which P2P programs you uninstalled in step 1.
- The content of C:\ComboFix.txt from step 2.
- The content of C:\lopR.txt from step 3.
- The content of OTListIt.txt from step 4.
#9
Posted 10 March 2009 - 01:45 PM
zenrox
- Topic Starter
-
- Member
-
- 23 posts
Member
log
Edited by zenrox, 12 March 2009 - 02:16 PM.
#10
Posted 11 March 2009 - 09:24 AM
heir
-
- Malware Removal
-
- 5,427 posts
Trusted Helper
Step 1.
CFScript:
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the codebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require a long with a fresh HJT-log in your next reply.
Step 2.
Lop S&D:
Delete LopSD.exe on your desktop.
Disable resident protections (Antivirus...); you'll re-enable them after the scan
Download Lop S&D < here and save it to the desktop
Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Step 3.
Things I would like to see in your reply:
CFScript:
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the codebox below into it:
KillAll:: File:: c:\windows\003614_.tmp c:\windows\system32\SET33B.tmp c:\windows\system32\SET501.tmp c:\windows\system32\SET65B.tmp c:\windows\system32\SET1177.tmp c:\windows\system32\SET11AA.tmp c:\windows\system32\SET1172.tmp c:\windows\system32\SET116F.tmp c:\windows\SET5F5.tmp c:\windows\system32\SET75D.tmp c:\windows\system32\SET763.tmp c:\windows\system32\SET2A4.tmp c:\windows\003596_.tmp c:\windows\system32\drivers\_004071_.tmp.dll c:\windows\system32\SET1095.tmp c:\windows\system32\SET10C8.tmp c:\windows\system32\SET1090.tmp c:\windows\system32\SET108D.tmp c:\windows\system32\SET678.tmp c:\windows\system32\SET67E.tmp c:\windows\system32\SET344.tmp c:\windows\system32\SET20E.tmp c:\windows\003587_.tmp c:\windows\system32\drivers\_004009_.tmp.dll c:\windows\system32\SETFB6.tmp c:\windows\system32\SETFE9.tmp c:\windows\system32\SETFB1.tmp c:\windows\system32\SETFAE.tmp c:\windows\SET434.tmp c:\windows\system32\SET59C.tmp c:\windows\system32\SET5A2.tmp c:\windows\system32\SET1BD.tmp c:\windows\system32\SET113.tmp c:\windows\003579_.tmp c:\windows\system32\drivers\_003999_.tmp.dll Folder:: c:\program files\Soulseek
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require a long with a fresh HJT-log in your next reply.
Step 2.
Lop S&D:
Delete LopSD.exe on your desktop.
Disable resident protections (Antivirus...); you'll re-enable them after the scan
Download Lop S&D < here and save it to the desktop
Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Step 3.
Things I would like to see in your reply:
- The content of C:\ComboFix.txt from step 1.
- The content of the fresh HJT-log from step 1.
- The content of C:\lopR.txt from step 2.
- Information on how your computer is running now
#11
Posted 11 March 2009 - 06:33 PM
zenrox
- Topic Starter
-
- Member
-
- 23 posts
Member
log
Edited by zenrox, 12 March 2009 - 02:15 PM.
#12
Posted 12 March 2009 - 01:33 AM
heir
-
- Malware Removal
-
- 5,427 posts
Trusted Helper
PKP_DLdu.DAT <<<--- Let's scan this and find outAlso.. what are these files?
pcouffin.sys
conime.exe
wmiprvse.exe
nwprovau.dll
NPDocBox.dll
runservice.exe
Step 0.
Filescan:
- Please go to VirSCAN.org FREE on-line scan service
- Copy and paste the following file path into the "Suspicious files to scan"box on the top of the page:
- %Path%\AnyFile.exe
- Click on the Upload button
- Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
- Paste the contents of the Clipboard in your next reply.
Step 1.
Clean temp locations:
Please download ATF Cleaner by Atribune.
Caution: This program is for Windows 2000, XP and Vista onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
Step 2.
Scan with MABM:
Please download Malwarebytes' Anti-Malware from Here or Here
Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish,so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Step 3.
Scan with Kaspersky Online Scanner:
Please do an online scan with Kaspersky Online Scanner
Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion.
- Read through the requirements and privacy statement and click on Accept button.
- It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
- When the downloads have finished, click on Settings.
- Make sure the following is checked.
- Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Click on My Computer under Scan.
- Once the scan is complete, it will display the results. Click on View Scan Report.
- You will see a list of infected items there. Click on Save Report As....
- Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
- Please post this log in your next reply.
Upgrading Java:
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systemsUpgrading Java:
- Download the latest version of JRE 6 Update 12.
- Click the "Download" button to the right.
- Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
- Click on Continue.
- Click on the link to download Windows Offline Installation (jre-6u12-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
- Close any programs you may have running - especially your web browser.
- Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
- Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove each Java version.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u12-windows-i586-p.exe and select "Run as an Administrator.")
Step 4.
Things I would like to see in your reply:
- The result from the filescan in step 1.
- The content of the report from MBAM from Step 2.
- The content of the report from Kaspersky Online Scanner from Step 3.
#13
Posted 12 March 2009 - 02:15 PM
zenrox
- Topic Starter
-
- Member
-
- 23 posts
Member
Thanks. the scans came out clean.
#14
Posted 12 March 2009 - 02:21 PM
heir
-
- Malware Removal
-
- 5,427 posts
Trusted Helper
Hey there, zenrox !
OK! Well done, your log is clean again!
Time for some housekeeping.
Step 1.
Clean up:
We need to do is to remove all the tools that you have used. This is so that should you ever be re-infected, you will download updated versions. It will also remove the quarantined Malware from your computer.
First:
Second:
Double-click OTListIt2.exe to start it.
Click the Clean up button
Click Yes to the reboot.
Now delete any tools/logs that is left over after you ran OTListIt2 Clean up.
Step 2.
Prevention:
OK, lets carry out a few preventative steps to make sure you reduce the risk of further infections.
First:
Your Adobe Acrobat Reader is out of date. Older versions are vunerable to attack.
Please go to the link below to download an update.
http://www.adobe.com.../readstep2.html
Remove the older versions and install the latest,
Second:
One of the essentials is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vunerable. It is best if you have these set to download automatically.
Automatic Updates for Windows
Third:
Now lets download some preventative programs that will help to keep the nasties away! We will start with Anti Spyware programs. I would advise getting a couple of them at least, and running each at least once a month.
Anti Spyware
Note: If you find your system slows down after installing any of these, just uninstall it, or disable it from running at startup.
Fourth:
On to personal Anti Virus programs.
One AV is a must have! But never more than one, as this can and will cause conflicts and false readings. I have listed three free AV's below which are as good as any paid subscription AV, as long as you allow them to update themselves.
Anti Virus Programs
Fifth:
Nearly done! If you like to use chat, MSN and Yahoo have vunerabilities that can leave you open to infections. There are however a couple of very good, Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN):
Instant Messengers
Lastly:
It is a good idea to clear out all your temp files every now and again with ATF Cleaner. This will help your computer from bogging down and slowing. It also can assist in getting rid of files that may contain malicious code that could re-infect your computer.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein.
I will keep this log open for the next couple of days, so if you have any further problems post another reply here.
OK, all the best, and stay safe!
OK! Well done, your log is clean again!
Time for some housekeeping.
Step 1.
Clean up:
We need to do is to remove all the tools that you have used. This is so that should you ever be re-infected, you will download updated versions. It will also remove the quarantined Malware from your computer.
First:
- Click START then RUN
- Now type Combofix /u in the runbox and click OK. Note the space between the X and the /u, it needs to be there.
Second:
Double-click OTListIt2.exe to start it.
Click the Clean up button
Click Yes to the reboot.
Now delete any tools/logs that is left over after you ran OTListIt2 Clean up.
Step 2.
Prevention:
OK, lets carry out a few preventative steps to make sure you reduce the risk of further infections.
First:
Your Adobe Acrobat Reader is out of date. Older versions are vunerable to attack.
Please go to the link below to download an update.
http://www.adobe.com.../readstep2.html
Remove the older versions and install the latest,
Second:
One of the essentials is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vunerable. It is best if you have these set to download automatically.
Automatic Updates for Windows
- Click Start.
- Select Settings and then Control Panel.
- Select Automatic Updates.
- Click Automatic (recommended)
- Choose a day and a time when you know the computer will be on and connected to the internet.
- Click Apply then OK.
Third:
Now lets download some preventative programs that will help to keep the nasties away! We will start with Anti Spyware programs. I would advise getting a couple of them at least, and running each at least once a month.
Anti Spyware
- SpywareBlaster to help prevent spyware from installing in the first place. A tutorial can be found here.
- SpywareGuard to catch and block spyware before it can execute. A tutorial can be found here.
- IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email. A tutorial can be found here
Note: If you find your system slows down after installing any of these, just uninstall it, or disable it from running at startup.
Fourth:
On to personal Anti Virus programs.
One AV is a must have! But never more than one, as this can and will cause conflicts and false readings. I have listed three free AV's below which are as good as any paid subscription AV, as long as you allow them to update themselves.
Anti Virus Programs
- avast! 4 Home Edition an excellent free AV.
- AVG Anti-Virus Free Edition 8.0 is free for personal use.
- Avira AntiVir PersonalEdition, yet another good free AV.
Fifth:
Nearly done! If you like to use chat, MSN and Yahoo have vunerabilities that can leave you open to infections. There are however a couple of very good, Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN):
Instant Messengers
Lastly:
It is a good idea to clear out all your temp files every now and again with ATF Cleaner. This will help your computer from bogging down and slowing. It also can assist in getting rid of files that may contain malicious code that could re-infect your computer.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein.
I will keep this log open for the next couple of days, so if you have any further problems post another reply here.
OK, all the best, and stay safe!
#15
Posted 18 March 2009 - 01:59 AM
heir
-
- Malware Removal
-
- 5,427 posts
Trusted Helper
Why did you edit your posts?
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
