following malware removal instructions - MGTools not working

Hello,

Sorry for the length of this post, but I try to describe in detail what I've done. I have used the instructions in the "READ & RUN ME FIRST. Malware Removal Guide".

The reason I have done this is, because Avast On access scanner periodically alerted me to trojans in the temporary internet folder for the past two weeks. I instruct Avast to delete these files but the messages always come back a short while later. Two days ago it started alerting me of blocking access to a malicious site (the url for this site is garbled and ends in .cn). This message would pop up every 5 to 10 seconds. So I attempted to remove the malware on the pc with the help of the instructions of this forum yesterday night.

I am not sure where the trojan/malware originated from, as I am not the only user of this computer (my parents also use it). Around the time that the problems started, I visited a reputable (or so I thought) job site (engineeringcareers.co.za) - upon visiting Avast alerted me to a trojan attempting to download and gave me the option to block the connection to the site, so I did so.

Now, on to how I followed the instructions in your guide and the problems that I encountered:

I followed all the instructions to the letter, up to and including the Malwarebytes' Anti-Malware. Super antispyware had to be renamed to SAS.exe to run, as the explorer window crashed if I tried to run it normally. After MBAB finished, I could not connect to the internet anymore (internet was still working after I finished with Super antispyware of step 1). To remedy this I tried repairing in the Network Connections of Control Panel and also the repair option in Super anti spyware. After this did not work I called it a night and decided to try again today, as I suspected it was the ISP that did not activate this month's cap yet (our cap doesn't carry over to the next month) or cap ran out.

As it turned out I was incorrect - restarting the router fixed this (silly me). But before I thought of restarting the router, I did a system restore to yesterday ( thinking that MBAB somehow broke the connection). This did not work and I restored back to today's point.

So, I reran SAS and MBAB - SAS found nothing new and MBAB found 2 objects. I then ran combofix and rootrepeal without any problems.

I then tried to run MGTools.exe. It created the MGTools folder on the C drive as promised, but the 3 batch programs did not execute. I can see the console window open for a moment, but for less than half a second, then it is gone - no error message or anything else is displayed. My antivirus, Avast, is disabled when I do this.

It is possible that all the malware is removed from the system - so far Avast has not alerted me to anything suspect again. But I want to be really sure, so what can I do to get MGTools running?

I'm attaching the Super antispyware and MBAB logs of before and after the system restores in this post. In the next post I will attach the logs for combofix and rootrepeal.

Your help is appreciated greatly,

Z.

 

Hello again,

Here are the combofix and rootrepeal logs I intended to post. I wanted to post them directly after my earlier post, but real life interfered in the time between posting and my post showing up in the forum. This will probably be seen as a bump, but oh well - so far it looks like my problems are sorted out, so far Avast has not given me any more alerts to trojans/rootkits.

Thanks again,

Z.

 

Thank you for your reply.

I have deleted explorer(3).exe and run Getrunkey and Shownew.

GetRunKey gave a message "The system cannot find the file specified.". No mention of what the filename is.

ShowNew ran without error messages.

I have included the zip file of logs produced.

 

The program ran without problems, here is the log.

Thanks,

Z.

 

Thank you for all the help! Haven't had any more alerts or problems so far, hopefully it stays this way.

Z.