A Friend Needs Help (page 2) — malwareremoval.com Archive

rayzer · 2005-04-24T23:22:04+00:00

Hi guy's, sorry I haven't been around for awhile, but I'm quite busy at present Anyway... A friend of mine asked me to have a look at his system as he couldn't get onto IE, however he could use Firefox. Upon viewing the logfile, there are obvious signs of infection. I have already attempted two fixes to no avail and the same things re-appear or simply will not delete (google.exe for one). I've used various methods/tools and whats more strange, the log keeps changing all the time, new things appearing/others not showing when they should etc. Now after posting a new logfile, I have a strange 'R1' entry as well as the obvious infections that still exist in the log. I ask you as the experts to please clean this up once and for all. Thanks. Ray. Logfile of HijackThis v1.99.1 Scan saved at 23:59:31, on 24/04/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WIN

'KotaGuy

April 28, 2005, 1:06 AM UTC

Got rid of snapple... which is good... that google thing is still there though :confused2:

Maybe something will show in the Silent Runners log.

rayzer

April 28, 2005, 1:24 AM UTC

Like I said, I'm really sorry about the delay, it seems I only get a reply from him in the early hours

I think he's logged off now so I doubt we are going to get this log same time tomorrow.

Thankyou for your patience with this, I will edit the logfile in (below the HJT one) when I receive it and bump the thread.

You can show me how silent runners works too

'KotaGuy

April 28, 2005, 1:33 AM UTC

No problem.... got some more instructions for you to pass on though.

Have him fire up regedit again and go to the
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Key.

Look for and delete any/all of the following entries if found:

".Prog"="%Windir%\system\services.exe"
"BuildLab"= "%Windir%\system\services.exe"
"ccApps"="%Windir%\system\services.exe"
"FriendlyTypeName"="%Windir%\system\services.exe"
"Microsoft Visual SourceSafe"="%Windir%\system\services.exe"
"RegDone"="%Windir%\system\services.exe"
"TEXTCONV"="%Windir%\system\services.exe"
"WMAudio"="%Windir%\system\services.exe"

Run and scan with HijackThis. With all other browsers and windows closed, place a check besdie the following and Fix:

O4 - HKLM\..\Run: [MsCom32Agent] C:\WINDOWS\System32\google.exe
O4 - HKLM\..\RunOnce: [*MsCom32Agent] C:\WINDOWS\System32\google.exe
O4 - HKCU\..\Run: [MsCom32Agent] C:\WINDOWS\System32\google.exe
O4 - HKCU\..\RunOnce: [*MsCom32Agent] C:\WINDOWS\System32\google.exe

Boot to Safe Mode. Search for and delete google.exe

Clean temp files, Recycle Bin, etc...

Reboot Windows normally and post a new log along with the Silent Runners log.

rayzer

April 28, 2005, 1:55 AM UTC

Thanks :

He's currently online and said that he cannot download the silent runners file, it just takes him to that script page that I attempted to post

I regave him the link to double check (tested it myself too) and he's assured me that all he gets when clicking on it is the script??

*Bangs head against the wall*

I will post that fix for him to try though

'KotaGuy

April 28, 2005, 2:48 AM UTC

Have him copy/paste the contents of that link into a new text document.

Name it "SilentRunners.vbs". Save it as File Type "All Files".

He should then be able to run the script.

rayzer

May 9, 2005, 3:25 PM UTC

He hasn't got back to me since, I can only presume this topic is now dead :cry:

'KotaGuy

May 9, 2005, 11:58 PM UTC

OK rayzer... let us know if there is a change in the situation.