Computer infected with fake "spyware protection" program

OTL opened and i'm able to check boxes and stuff, but now i can't open the scan.txt file

Hi kristin031204, That's ok. Please run it without the custom scan.

Okay…the scan ran (says "Scans complete!"), but aren't two notepad files supposed to open (OTL.txt and Extras.txt)? Nothing opened. There is one new txt file on the desktop (OTL.txt)…but no Extras.txt (I'm figuring maybe that's because no text was pasted into the custom scan area?) OTL.txt attached Thanks so much for your help…i've got to scoot off to bed (early meeting tomorrow) so I'll check back in sometime tomorrow. have a good night, kristin

Hi kristin031204, You did fine. The Extra.txt is only created the first time OTL is ran. Going over the log now. will post later. 'Night.

Hi kristin031204,

Let's see if we can get the custom scan to run a different way. Ensure scan.txt is on the desktop.

We'll use OTL again (the renamed copy)

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, click the None button near the top (it may looked greyed out)
• In the Extra Registry section change it to All
• Double click inside the Custom Scan box at the bottom
• A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
• Click the OK button and navigate to the file scan.txt which should be on your desktop
• Select scan.txt and click Open. Writing will now appear under the Custom Scan box
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic
  The OTL.txt should be much smaller this time.
  
  Pleas post back with
  • OTL.txt
  • Extra.txt
  Thanks

okay…i'm back… attached are the two requested logs. thanks again, your help is really appreciated!!!

Hi kristin031204,

Interesting to noye that since we started this every log you have posted has the same date. This will not solve the problem but will explain the large OTL log. You clock is about 7 years behind. Please set it to the correct Time and date.

• Right click the clock (lower right corner of your screen)
• Click adjust Time/Date
• Once you have set the time, date and time zone correctly click apply, click ok

Please confirm that the time/date is now correctly displayed.

Just for clarification the "Spyware Protection" popup only occur on your husband's account?

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Let's see if we can do a little manipulating.

Open Windows Explorer (right click your start button and click explore)

In the left hand panel navigate to this folder C:\Program Files\Malwarebytes' Anti-Malware

• Click on it
• In the right hand file locate this file mbam.exe
• right click on the file and select rename
• on the keyboard type iexplore.exe
• press enter
• double click on the renamed file and MBAM should open

• Click the Update tab (if MBAM opens but can not update run the scan any way)
• Click Check for Updates
• If an update is found, it will download and install the latest version.
• The program will close to update and reopen.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Please post back with the MBAM log if it was able to run.

Thanks

i apologize that the time of day issue affected the logs. here is full disclosure of the ancillary problems with our computer. these have been occurring for sometime (2-3yrs). don't know which are important for you to know, but here they all are. these are things we have kind of just come to live with with our computer: 1) Time of day At startup (during the what looks like the "DOS phase") we receive the following message: Invalid configuration information – please run SETUP program Next, the computer beeps and the following messages come up: Time-of-day not set – please run SETUP program Strike F1 to continue, F2 to run the setup utility We always strike F1, then when the computer has finally started up, we set the time/date if we are going online. 2) Missing Component After selecting which account to use, as soon as windows has started to come up and is still loading the following box pops up Mm_tray.exe -= Unable to Locate Coomponent This application has failed to start because CoreDll.dll was not found. Re-installing the application may fix this problem. We always click "ok" To answer your queston: Spyware protection still only pops up on my husband's account. Other problems related to this malware/virus (i.e., cannot open any programs) seem limited to his account (for example, i cannot burn a CD from his account. i have to go into my account to burn the logs that are plopped onto his desktop by the OTL scan). Malwarebytes… located it, renamed it, opened it. cannot get updates. tried to update through both my husband's and my account. note that i was successful in opening firefox through my account, but still could not get malwarebytes to update. the following box pops up: Update failed. Make sure you are connected to the internet and your firewall is set to allow malwarebyes’ anti-malware to access the internet. So I ran the program/scan without the updates from my husband's account. it identified a program and i see a log from today in the logs tab. i can open it for a brief moment, but then it disappears. i then went into my account and poked around in windows explorer, but i cannot find the log. any idea where malwarebytes may have put it??

Hi kristin031204

C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs

You will need to show hidden files and folders first.

Open windows explorer (right click the Start button and click Explore)

At the top of windows explorer, click tools, folder options, click the
view tab

• check Display the contents of system folders
• check Show hidden files and folders
• uncheck "Hide extensions for known file types" box
• uncheck "Hide protecting operating system files" box

Click apply, click ok

ah-ha! found it, thanks!! i've attached the log

Hi kristin031204,

Files Infected:
C:\Documents and Settings\Michael Angello\Desktop\explorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Seems MBAM took exception to us renaming OTL to explorer.exe and removed it. Don't worry the file wasn't infected.

As to some of the other problems:

1) Time of day
At startup (during the what looks like the "DOS phase") we receive the following message:
Invalid configuration information – please run SETUP program

That would indicate the CMOS battery is probably dead.

2) Missing Component
After selecting which account to use, as soon as windows has started to come up and is still loading the following box pops up

Mm_tray.exe -= Unable to Locate Coomponent
This application has failed to start because CoreDll.dll was not found. Re-installing the application may fix this problem

That's from Music Match. I don't see it installed. We can stop it from loading at startup.

Now back to the current issue. There is something on this profile that is not showing in the logs. Let's check a couple of things.

Can you connect to the internet with Internet Explorer from the infected account?

If you boot to safe mode and log into that account does the problems persist?

okay, checking right now on using Internet Explorer as for safe mode…ugh, can you remind me how to boot in safe mode? thanks for sticking w/ me on this! kristin

Hi kristin031204,

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your husband's account.

Now back to the current issue. There is something on this profile that is not showing in the logs. Let's check a couple of things.

Can you connect to the internet with Internet Explorer from the infected account? YES

If you boot to safe mode and log into that account do the problems persist? NO (programs such as solataire, word, paint shop could be opened. "spyware protection" did not pop up. could open internet explorer, but could not conncet - indicated a connectivity issue)

Hi kristin031204,

Good job.

It's normal that you cannot connect to the internet in safe mode as only minimal drivers are loaded.

I will need you to run this fix on the computer from the infected account in safe mode.

We will need a new copy of OTL. You can get one from HERE You may need to use another computer and a CD to transfer it the infected computer along with the fix.

You will also need this fix. Please save it in a notepad and transfer it to the infected account's desktop along with OTL.exe.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

:Services
:OTL
O4 - HKCU..\Run: [Spyware Protection] C:\Documents and Settings\Michael Angello\Application Data\defender.exe ()
O4 - HKCU..\Run: [Juno_uoltray]  File not found
O4 - HKCU..\Run: [MoneyAgent]  File not found
O4 - HKCU..\Run: [uoltray]  File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MMTray"=-

:Files
ipconfig /flushdns /c

:Commands
[emptytemp]
[createrestorepoint]
[Reboot]

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "fix.txt"
• Click save

Once you have booted to the infected account in safe mode:

Double click on OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in all of the text from fix.txt
  
• Then click the Run Fix button at the top
• Let the program run unhindered
• When OTL reboots your computer allow it to boot to normal windows.
• Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

How's the computer?

Thanks