BleepingComputer.com: Antivirus 2009, MyWebSearch, VideoEgg won't just go away

Hi,

I have being trying to get rid of these programs (Antivirus 2009, MyWebSearch, VideoEgg) but they are proving to be far smarter than me and i've almost hang the boxing gloves. the problem started when my newphew downloaded antivirus 2009 on to the computer (hp windows vista home premium service pack 2, 32 bit). I thought i've remove it by using the control panel and searching through the registry.

but after doing more searches on google i realise it doesn't go away like, i use malwarebyte but it hang after finding aboout 51 malwares/virus. i uninstall it and install it again run the scan but now it says everything is clean but i do not really trust it...so i've tried the combofix at first it deleted about 3 folder from "$recycler" but did not show any log. so i did it again about twice and now i have so logs but am not sure if my system is clean now..

please can you help me out.... i have the combofix logs if you want to see them

ps
i mcafee antivirus and i regularly use ad-adware and recently malwarebyte

Edit: Moved topic from Vista to the more appropriate forum, as the poster below suggests. ~ Animal

Hey ozzy_b

I suggest you move this topic to the Am I Infected? forum. They will be able to guide you from there.

oh thanks alot.. am newby still not familiar with everything here yet ;-)

Run this application and try mbam again

Please download Rkill by Grinler and save it to your desktop.

Link 2
Link 3
Link 4

• Double-click on the Rkill desktop icon to run the tool.
  
• If using Vista, right-click on it and Run As Administrator.
  
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  
• If not, delete the file, then download and use the one provided in Link 2.
  
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  
• If the tool does not run from any of the links provided, please let me know.

Do not reboot the computer or you will have to run it again

=======================

Also try this

We Need to check for Rootkits with RootRepeal

• Download RootRepeal from the following location and save it to your desktop.
  • Direct Download (Recommended)
    • Primary Mirror
      
    • Secondary Mirror
      
    • Secondary Mirror
      
    • Secondary Mirror
    
    
  • Zip Mirrors (Recommended if you have a slower connection or if the Direct Download mirror is down)
    
    • Primary Mirror
      
      
    • Secondary Mirror
      
      
    • Secondary Mirror
    
    
  • Rar Mirrors - Only if you know what a RAR is and can extract it.
    
    • Primary Mirror
      
      
    • Secondary Mirror
      
      
    • Secondary Mirror
  
  
• Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
  
• Open on your desktop.
  
• Click the tab.
  
• Click the button.
  
• Check all seven boxes:
  
• Push Ok
  
• Check the box for your main system drive (Usually C:), and press Ok.
  
• Allow RootRepeal to run a scan of your system. This may take some time.
  
• Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

----------------------------------

Please note: If Rootrepeal fails to run, try this step: Click Settings - Options. Set the Disk Access slider to High

Also try: right-click on rootrepeal.exe and rename it to tatertot.scr

hi sorry for the late reply..is just that the computer/virus/malware is still outsmarting me ;-(
i was trying to run the RKill by right clicking and selecting the run as admin option but it was not available so when it clicked on open vista just kept on asking me for the admin password...so log on as admin and ran the RKill but when i right clicked the RootRepeal to run it as admin it showed the blue screen of death and restart...so i ran the RKill in the admin account the RootRepeal in my normal user account...everything went smoothly followed all the instruction and the scan starts and was running well but at the last minute....out of no where a small black dialog/pop up box appeared with to text in it and the RootRepeal pause, so i thought it was asking me for an input i type in Y and hit enter and it closed the RootRepeal...

ever since i've tried RootRepeal everywhere but my computer just kept on crashing. It seems it's starting it's old habit of trying to frustrate me and it is succeeding, right now i just wish that i was a little kid so can just smash the computer on the floor, trow myself to the ground and start rolling, kicking and screaming my lungs out....but then i realise that i a man and a man is not suppose to cry...so i hoping that you will help again to find a way around this, and thanks for your continuous help.

please find below the MBam log..

Malwarebytes' Anti-Malware 1.41
Database version: 3171
Windows 6.0.6002 Service Pack 2

15/11/2009 19:33:23
mbam-log-2009-11-15 (19-33-23).txt

Scan type: Quick Scan
Objects scanned: 139103
Time elapsed: 8 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Try this

Please download Win32kDiag.exe by AD and save it to your desktop.
alternate download 1
alternate download 2

• This tool will create a diagnostic report
  
• Double-click on Win32kDiag.exe to run and let it finish.
  
• When it states Finished! Press any key to exit..., press any key on your keyboard to close the program.
  
• A file called Win32kDiag.txt should be created on your Desktop.
  
• Open that file in Notepad and copy/paste the entire contents (from Starting up... to Finished! Press any key to exit...) in your next reply.

--------------------------------------


Go to > Run..., then copy and paste this command into the open box: cmd
Click OK.
At the command prompt C:\>, copy and paste the following command and press Enter:

DIR /a/s %windir%\scecli.dll %windir%\netlogon.dll %windir%\eventlog.dll >Log.txt & START notepad Log.txt

A file called log.txt should be created on your Desktop.
Open that file and copy/paste the contents in your next reply.

hi garmanma, thanks very much....please find below the information you asked to provide. I hope i've done everything ok

Win32KDiag

Starting up...
Running from: C:\Users\Fanta\Desktop\Win32kDiag.exe
Log file at : C:\Users\Fanta\Desktop\Win32kDiag.txt
WARNING: Could not get backup privileges!
Searching 'C:\Windows'...

Cannot access: C:\Windows\bthservsdp.dat
[1] 2009-11-18 23:42:59 12 C:\Windows\bthservsdp.dat ()

Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
[1] 2009-11-19 15:56:29 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLo
g.etl ()

Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Applicati
on.etl
[1] 2009-11-19 15:56:07 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventL
og-Application.etl ()

Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.
etl
[1] 2009-11-19 15:56:07 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventl
og-Security.etl ()

Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.et
l
[1] 2009-11-20 04:41:42 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventL
og-System.etl ()

Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTkerberos.etl
[1] 2009-11-20 04:04:37 10208 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTker
beros.etl ()

Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession.etl
[1] 2009-11-19 15:57:14 0 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsS
ession.etl ()


Finished! Press any key to exit...

Log File

Volume in drive C is COMPAQ
Volume Serial Number is A023-6818

Directory of C:\Windows\ERDNT\cache

11/04/2009 06:28 177,152 scecli.dll

Directory of C:\Windows\ERDNT\cache

11/04/2009 06:28 592,896 netlogon.dll
2 File(s) 770,048 bytes

Directory of C:\Windows\System32

11/04/2009 06:28 177,152 scecli.dll

Directory of C:\Windows\System32

11/04/2009 06:28 592,896 netlogon.dll
2 File(s) 770,048 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-

s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e

02/11/2006 09:46 176,640 scecli.dll
1 File(s) 176,640 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-

s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12

19/01/2008 07:36 177,152 scecli.dll
1 File(s) 177,152 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-

s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e

11/04/2009 06:28 177,152 scecli.dll
1 File(s) 177,152 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-security-

netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783

02/11/2006 09:46 559,616 netlogon.dll
1 File(s) 559,616 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-security-

netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857

19/01/2008 07:35 592,384 netlogon.dll
1 File(s) 592,384 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-security-

netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3

11/04/2009 06:28 592,896 netlogon.dll
1 File(s) 592,896 bytes

Total Files Listed:
10 File(s) 3,815,936 bytes
0 Dir(s) 89,543,221,248 bytes free

Now that you were successful in creating those two logs you need to post them in our HJT forum There they will help you with the removal through some custom scripts and programs that we cannot run here in this forum

First, try to run a DDS / HJT log as outlined in our preparation guide:
http://www.bleepingcomputer.com/forums/topic34773.html

If it won't run, don't worry, just give a brief description and tell them that these logs were all you could get to run successfully

Post them here:
http://www.bleepingcomputer.com/forums/forum22.html

The HJT team is extremely busy, so be patient and good luck

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/topic274787.html you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days, up to two weeks perhaps less, to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom