Kaspersky Lab Forum > PC Mighty Max [Merged]

purpleowllady

2.11.2009 02:12

I have these pop-ups (2) that appear periodically telling me that I can buy this PC Mighty Max that will solve all my problems. Kaspersky does not isolate these no matter how many times I try. I read the directions about creating an AVZ log, which I did and am attaching. I hope you can help me delete these. Nothing works

richbuff

2.11.2009 02:23

Welcome. Run this script, instructions: http://forum.kaspersky.com/index.php?s=&am...st&p=678368 PC will reboot:

CODE

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
QuarantineFile('C:\Program Files\PC MightyMax 2009\ConfigurationManager.dll','');
QuarantineFile('C:\Program Files\PC MightyMax 2009\Core.dll','');
QuarantineFile('C:\Program Files\PC MightyMax 2009\ScanSpecific.dll','');
QuarantineFile('c:\program files\pc mightymax 2009\trayicon.exe','');
DeleteFile('c:\program files\pc mightymax 2009\trayicon.exe');
DeleteFile('C:\Program Files\PC MightyMax 2009\ScanSpecific.dll');
DeleteFile('C:\Program Files\PC MightyMax 2009\Core.dll');
DeleteFile('C:\Program Files\PC MightyMax 2009\ConfigurationManager.dll');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

After run script, attach a Combofix log, please review and follow these instructions carefully.

Before Saving combofix to Desktop, please rename combofix to something like 123.exe to stop malware from disabling it.

Now, please make sure no other programs are running, close all other windows and pause Kaspersky (right click the K icon and click pause protection > Choose the
option "resume manually" if still active) until after the scanning and removal process has taken place.

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan.
Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall.
It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after
scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post. Also, please don't
forget to resume the Kaspersky that you paused.

Download Combofix here -> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

purpleowllady

3.11.2009 19:49

Let me first say, I am very computer dumb and "scared." I understand copying the script, but when you say "Next, launch AVZ.exe (that you have previously downloaded) and navigate to File->Custom scipts." I am lost. Is the AVZ.exe the Sysinfo file that I sent to you, or is there another AVZ file? Thank you for your help.

purpleowllady

3.11.2009 20:10

I have the AVZ downloaded and attempted to run it. However, I get an error "avz.exe is not a valid Win32 application." How do I get beyond this problem?

Please help. I'm still having thos PC Mighty Max pop ups.

Thank you very much

purpleowllady

4.11.2009 00:03

I can't believe it, but after reading, and re-reading the directions several times, I figured it out. The little pop-up guys are no longer here!! Thank you for your help. I'm attaching the Combofix.txt, as directed in the directions.

purpleowllady

4.11.2009 00:05

I can't believe it, but after reading, and re-reading the directions several times, I figured it out. The little pop-up guys are no longer here!! Thank you for your help. I'm attaching the Combofix.txt, as directed in the directions.

purpleowllady

4.11.2009 00:18

I can't believe it, but after reading, and re-reading the directions several times, I figured it out. The little pop-up guys are no longer here!! Thank you for your help. I'm attaching the Combofix.txt, as directed in the directions.

Baz^^

4.11.2009 00:20

Please use the "add reply" button instead of "new topic" button....you opened six seperate topics for this issue, each was simply a reply to the orignal instructions.

purpleowllady

4.11.2009 00:33

I can't believe it, but after reading, and re-reading the directions several times, I figured it out. The little pop-up guys are no longer here!! Thank you for your help. I'm attaching the Combofix.txt, as directed in the directions.

Lucian Bara

4.11.2009 00:38

Hi, please continue there instead of opening a new topic each time:
http://forum.kaspersky.com/index.php?s=&am...t&p=1150391

richbuff

4.11.2009 03:32

In addition to what Baz^^ and Lucian instructs:

Run this script, PC will reboot:

CODE

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
QuarantineFile('c:\windows\TEMP\TMP0000007972D66ACE46CC7C64','');
DeleteFile('c:\windows\TEMP\TMP0000007972D66ACE46CC7C64');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Then, run this one:

CODE

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

A file called quarantine.zip should be created in C:\. Then please zip up C:\qoobox\quarantine and upload both it and C:\quarantine.zip to a filehost such as http://rapidshare.com/
Then, Private Message me the Download link to the uploaded file. Click my user name and select Send message. Lastly, uninstall Combofix by: pause Kaspersky > Start > run >
type combofix /u > ok. Or Start > run > type 123 /u > ok. Restart Kaspersky.

Also, if you use Windows System restore, turn it off > reboot. This to remove malware from system volume information files. Then turn system restore back on, if you wish. How to turn it off/on: http://support.kaspersky.com/faq/?qid=208279208

Also, scan with Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php Update it first, scan and attach its log, but Please Don't fix anything yet, until the log is reviewed.

Edit: del request for the log, I found it.