Super AntiSpyware Problem

[Gruene Girl]

I realize I'm supposed to finish before I ask questions but this is the 2nd free spyware I've tried to download (Spy Doctor) and once it's downloaded it won't run - it allowed me to follow your instructions re set up but when I click the scan button it immediately goes offline (not responding); Also, I've tried to do a system restore to go backwards because I somehow deleted my Microsoft Office products (excel, word, etc.) with Windows install clean up (I think) (obviously I didn't understand what it was).  Any suggestions?  I'll continue on with your instructions - thanks!

[evilfantasy]

Try this please.

Download this Malwarebytes' Anti-Malware file and save to your desktop.

* Right click on the renamed Malwarebytes' Anti-Malware file on your desktop and chose Copy
* Next go to Start > Computer > C > Program Files.
* Right click on the Malwarebytes' Anti-Malware Folder and click Paste
* Next Double click on the Malwarebytes' Anti-Malware file.
* Malwarebytes should now run. Be sure to check for updates!

* After the update have been completed, Select the Scanner tab.
* Select Perform quick scan, then click on Scan
* Leave the default options as it is and click on Start Scan
* When done, you will be prompted. Click OK, then click on Show Results
* Checked (ticked) all items and click on Remove Selected
* After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the newest.

[Gruene Girl]

Thanks - Got that accomplished but pretty much the same thing happens - at about 6 seconds in it stops responding - I tried three different times and it stopped on the following:
c:\Windows\system32\zipflder.dll
c:\Windows\system32\WscEapPr.dll
c:\Windows\system32\wshelper.dll

Don't know if that means anything? 

Also, after posting yesterday I went on to install the malware (which may the same one I just installed?) MBAM with same results.

Thanks again

[evilfantasy]

Try not to restart the computer until one of the tools we use does it for you or tells you to.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
 
There are 4 different versions. If one of them won't run then download and try to run the next one.
 
Vista and Windows 7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.pif
* Rkill.exe

* Double-click on the Rkill desktop icon to run the tool.
* If using Vista or Windows 7 right-click on it and choose Run As Administrator.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run then try to immediately run the following.

 
Download and run exeHelper

* Please download exeHelper from Raktor to your desktop.
* Double-click on exeHelper.com to run the fix.
* A black window should pop up, press any key to close once the fix is completed.
* A log file named log.txt will be created in the directory where you ran exeHelper.com
* Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


Now try to update Malwarebytes and run a scan!

[Gruene Girl]

This is what I got when I ran the first one - I didn't get an opportunity to run as administrator - should I save first then run?  Download challenged I guess!  Thanks! 



This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as glenda on 02/10/2010 at 11:20:18.


Processes terminated by Rkill or while it was running:


C:\Users\glenda\AppData\Local\Temp\is-56NVD.tmp\iMonitor.exe
C:\Users\glenda\AppData\Local\Temp\is-56NVD.tmp\vcredist_x86.exe
C:\Users\glenda\AppData\Local\Temp\is-56NVD.tmp\vcredist_x64.exe
C:\Windows\SoftwareDistribution\Download\Install\NDP35SP1-KB958484-x64.exe
C:\Users\glenda\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A374ROIS\rkill[1].com


Rkill completed on 02/10/2010  at 11:20:35.

[evilfantasy]

Keep going with the rest now.

[Gruene Girl]

Sorry, I'm an idiot!!  Here's what I got - running the spyware now.

THANKS for being patient

exeHelper by Raktor
Build 20091220
Run at 11:25:43 on 02/10/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

[Gruene Girl]

I was able to run this one - am I good to go?  Can you help me get my Word, Excel etc. back that disappeared when I ran that windows install clean up?  Or should I try to do a system restore?

Thanks in advance!

GKS


Malwarebytes' Anti-Malware 1.44
Database version: 3719
Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

2/10/2010 11:32:05 AM
mbam-log-2010-02-10 (11-32-05).txt

Scan type: Quick Scan
Objects scanned: 1
Time elapsed: 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[evilfantasy]

If you already have ComboFix be sure to delete it and download a new copy.

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
Vista users Right-Click on ComboFix.exe and select Run as administrator (you will receive a UAC prompt, please allow it)
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

[Gruene Girl]

Hello - It's raining hard here today and I'm on a satellite so everything is in SLOW motion plus I keep getting kicked off so I'll wait till it clears up to proceed with your directions; but, I do have a couple of questions - the link doesn't give directions to temporarily suspend the Super Antispyware or the Malwarebytes product - do they need to be turned off or uninstalled?  Also, I have the free version of Spy Dr and it's not working so I uninstalled it - it prompted me to restart but referring back to your post I did not restart; last, my Norton 360 seems to be buggered up too........................I keep getting an error when I try to open it - it's due to renew early March so I wouldn't mind just uninstalling it too since it obviously didn't/doesn't work that well. 

Thanks again!

[evilfantasy]

just keep going with ComboFix and ignore any warnings.

[Gruene Girl]

Hello again - I had a problem with the ComboFix - decided I had done something wrong so I deleted or uninstalled everything and started over with, unfortunately, the same result - the message I get from Link 1 is "incompabible OS" only runs with Windows 2000 and XP - when I deleted that version and clicked on Link 2 it sends me to a compter help page that is in Spanish?  I scanned it quickly and didn't see anything resembling ComboFix so I'm back for further help if possible. 

Also, when I ran the Spyware and Malware downloads you provided I got basically the same result (they both stop responding once they start the scan) with the exception that the Malwarebytes won't go away - I've tried task manager and it won't go away but it looks "faded" ? for lac of a better description. 

Thanks!

[evilfantasy]

This is a 64 bit OS?


Download OTL to your desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* When the window appears, underneath Output at the top change it to Minimal Output.
* Check the boxes beside LOP Check and Purity Check.
* Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy and pate the contents of these files, one at a time, into your next reply.

Note: You may need two or more posts to fit them all in.

[Gruene Girl]

Same result - I clicked the start scan and at the bottom is has a line that says "Getting Drive info... but nothing happens - I left it for about 20 minutes and when I came back it was "not responding" anything else I can try?

Thank you so much!

[evilfantasy]

Is this a 64 bit OS?

Right click on OTL and choose Run as Administrator.