Malware / Virus removal problem please help....

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by iPromo, Feb 29, 2012.

  1. iPromo

    iPromo Private E-2

    Hi guys,

    I have a big problem which has really been bugging me for 2 weeks now:mad .
    I have searched all over the web but found no solution :tired .
    As you may see i am new to this forum so please dont be harsh / strict :-o .

    Just before i describe my problem i will list my laptop specs:
    Acer Aspire 5820T
    Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
    4GB Ram (3.80GB usable)
    64Bit Operating system

    + My OS (Operating System) , Windows 7 Home Premium

    Ok so here's my problem:

    Before 2 weeks my computer was fine but one day i got a problem which caused me to get Bsod and heavily decreased my speed. It also heavily decreased my startup and shut down speed. My startup speed was usually 15 secs and shutdown speed like 25 but now my startup speed is 4mins + and shutdown speed the same:confused .

    So what i did was restore my computer to default factory settings with Acer eRecovery Management. Once i booted up again i still recognised the slow speeds like before; i also recognised that eRecovery only deleted all the files on my "C" drive so i went on my "D" drive and deleted everything and started eRecovery Management again.

    Again i recognised the same problem so now i downloaded malware bytes and it blocks many ip's using the process svchost.exe i have only seen 2 ip's which it has blocked: "88.214.193.251" and "206.161.121.3" the first one is using port : 53075 but i didn't see the second ones port.

    So this virus must be infected in my windows folders. :cry

    So I am asking this forum + you guys :) to help me, i hope someone can help me because i have lots of work to do andi have to many exams to waste my time to much.

    Also there is another thread on this forum which is like mine

    http://forums.majorgeeks.com/showthread.php?t=238867




    Thank you for people who auctually help :), please no timewasters!
     
    iPromo, Feb 29, 2012
    #1
  2. iPromo

    iPromo Private E-2

    1111
     
    iPromo, Feb 29, 2012
    #2
  3. iPromo

    iPromo Private E-2

    I have found more blocked ip's :

    2012/02/29 18:52:34 GMT Milad-PC Milad MESSAGE Starting protection
    2012/02/29 18:52:36 GMT Milad-PC Milad MESSAGE Protection started successfully
    2012/02/29 18:52:39 GMT Milad-PC Milad MESSAGE Starting IP protection
    2012/02/29 18:52:40 GMT Milad-PC Milad MESSAGE IP Protection started successfully
    2012/02/29 18:57:15 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 52794, Process: svchost.exe)
    2012/02/29 18:57:15 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 52795, Process: svchost.exe)
    2012/02/29 19:02:05 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53075, Process: svchost.exe)
    2012/02/29 19:04:22 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53375, Process: svchost.exe)
    2012/02/29 19:07:38 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53736, Process: svchost.exe)
    2012/02/29 19:07:38 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53737, Process: svchost.exe)
    2012/02/29 19:07:55 GMT Milad-PC Milad IP-BLOCK 206.161.121.3 (Type: outgoing, Port: 53756, Process: svchost.exe)
    2012/02/29 19:08:43 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53767, Process: svchost.exe)
    2012/02/29 19:08:43 GMT Milad-PC Milad IP-BLOCK 173.236.35.99 (Type: outgoing, Port: 53768, Process: svchost.exe)
    2012/02/29 19:11:01 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53802, Process: svchost.exe)
    2012/02/29 19:11:01 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53803, Process: svchost.exe)
    2012/02/29 19:15:44 GMT Milad-PC Milad IP-BLOCK 173.236.56.93 (Type: outgoing, Port: 53892, Process: svchost.exe)
    2012/02/29 19:15:44 GMT Milad-PC Milad IP-BLOCK 206.161.121.5 (Type: outgoing, Port: 53888, Process: svchost.exe)
    2012/02/29 19:15:44 GMT Milad-PC Milad IP-BLOCK 206.161.121.5 (Type: outgoing, Port: 53890, Process: svchost.exe)
    2012/02/29 19:15:44 GMT Milad-PC Milad IP-BLOCK 206.161.121.5 (Type: outgoing, Port: 53894, Process: svchost.exe)
    2012/02/29 19:15:44 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53895, Process: svchost.exe)
    2012/02/29 19:15:53 GMT Milad-PC Milad IP-BLOCK 206.161.121.4 (Type: outgoing, Port: 53927, Process: svchost.exe)
    2012/02/29 19:15:53 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 53928, Process: svchost.exe)
    2012/02/29 19:15:53 GMT Milad-PC Milad IP-BLOCK 206.161.121.2 (Type: outgoing, Port: 53934, Process: svchost.exe)
    2012/02/29 19:17:06 GMT Milad-PC Milad IP-BLOCK 206.161.121.5 (Type: outgoing, Port: 53985, Process: svchost.exe)
    2012/02/29 19:18:10 GMT Milad-PC Milad IP-BLOCK 206.161.121.4 (Type: outgoing, Port: 54037, Process: svchost.exe)
    2012/02/29 19:21:00 GMT Milad-PC Milad IP-BLOCK 206.161.121.4 (Type: outgoing, Port: 54154, Process: svchost.exe)
    2012/02/29 19:21:00 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 54155, Process: svchost.exe)
    2012/02/29 19:22:21 GMT Milad-PC Milad IP-BLOCK 173.236.35.99 (Type: outgoing, Port: 54205, Process: svchost.exe)
    2012/02/29 19:26:58 GMT Milad-PC Milad IP-BLOCK 206.161.121.5 (Type: outgoing, Port: 54282, Process: svchost.exe)
    2012/02/29 19:27:06 GMT Milad-PC Milad IP-BLOCK 173.236.56.93 (Type: outgoing, Port: 54285, Process: svchost.exe)
    2012/02/29 19:27:06 GMT Milad-PC Milad IP-BLOCK 173.236.56.93 (Type: outgoing, Port: 54286, Process: svchost.exe)
    2012/02/29 19:27:06 GMT Milad-PC Milad IP-BLOCK 206.161.121.4 (Type: outgoing, Port: 54287, Process: svchost.exe)
    2012/02/29 19:27:57 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 54326, Process: svchost.exe)
    2012/02/29 19:29:58 GMT Milad-PC Milad IP-BLOCK 173.236.56.93 (Type: outgoing, Port: 54397, Process: svchost.exe)
    2012/02/29 19:31:44 GMT Milad-PC Milad IP-BLOCK 88.214.193.251 (Type: outgoing, Port: 54466, Process: svchost.exe)
    2012/02/29 19:38:23 GMT Milad-PC Milad IP-BLOCK 178.162.172.39 (Type: outgoing, Port: 54757, Process: svchost.exe)
    2012/02/29 19:50:18 GMT MILAD-PC Milad MESSAGE Starting protection
    2012/02/29 19:50:21 GMT MILAD-PC Milad MESSAGE Protection started successfully
    2012/02/29 19:50:24 GMT MILAD-PC Milad MESSAGE Starting IP protection
    2012/02/29 19:50:26 GMT MILAD-PC Milad MESSAGE IP Protection started successfully
    2012/02/29 19:50:40 GMT MILAD-PC Milad IP-BLOCK 141.136.16.150 (Type: outgoing, Port: 49174, Process: svchost.exe)
    2012/02/29 19:53:07 GMT MILAD-PC Milad IP-BLOCK 178.162.172.39 (Type: outgoing, Port: 49243, Process: svchost.exe)
    2012/02/29 19:53:40 GMT MILAD-PC Milad IP-BLOCK 173.236.35.99 (Type: outgoing, Port: 49278, Process: svchost.exe)
    2012/02/29 19:54:04 GMT MILAD-PC Milad IP-BLOCK 178.162.172.39 (Type: outgoing, Port: 49323, Process: svchost.exe)
    2012/02/29 19:57:02 GMT MILAD-PC Milad IP-BLOCK 173.236.56.93 (Type: outgoing, Port: 49414, Process: svchost.exe)


    From Malwarebytes.....
     
    iPromo, Feb 29, 2012
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Major Geeks!

    Please read ALL of this message including the notes before doing anything. Note if you cannot save things in C:\ then just save them to your Desktop. Make sure that you have disable UAC and rebooted first if you are running Windows Vista or Windows 7.

    Please follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide


    and attach the requested logs when you finish these instructions.

    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.



    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

    Helpful Notes:


    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:


    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
    ​
     
    TimW, Feb 29, 2012
    #4
  5. iPromo

    iPromo Private E-2

    Hi Admin,

    Thanks for your quick reply :)

    I have attached the logs below as requested ;)


    Thank you again mate :)
     

    Attached Files:

    iPromo, Mar 1, 2012
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I also need the logs ( attached ) from running:
    SAS
    ComboFix
     
    TimW, Mar 1, 2012
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please run the C:\MGTools.exe and then attach the C:\MGLogs.zip.
     
    TimW, Mar 1, 2012
    #7
  8. iPromo

    iPromo Private E-2

    I did it was scanning files and then asked me to instal hijacker and i had to accept twice, anyway i'l do it again once I am home :) .


    + I really appreciate your help, you do this all for me and you do it for free! I really can't thank you enough the world is missing people like you...
     
    iPromo, Mar 1, 2012
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Not a problem. :)
     
    TimW, Mar 1, 2012
    #9
  10. iPromo

    iPromo Private E-2

    Hi again Tim,

    So i recognised that i uploaded the wrong thing before :-o so here is the MGlogs.zip file.


    Thanks again mate :)
     

    Attached Files:

    iPromo, Mar 1, 2012
    #10
  11. iPromo

    iPromo Private E-2

    Hi Tim,

    I have also uploaded the SAS (Super anti Spyware) log.



    Thank you :)
     

    Attached Files:

    iPromo, Mar 1, 2012
    #11
  12. iPromo

    iPromo Private E-2

    Hi Tim,

    I have recocgnised that i get Bsod even when im idle now :confused i hope it hasn't affected my memory. I also think the virus has spread in my windows folders because even when i restore my laptop to factory settings it still appears... (But i haven't restored my laptop till this thread started).

    Also i have only had the laptop for 1 year now.




    Thanks iPromo.
     
    iPromo, Mar 2, 2012
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now use windows explorer to find and delete:
    C:\ProgramData\Partner
    Though you may have to first delete the .dll.

    I am not finding any malware in your logs. I suggest you post in the software forum for further assistance with your BSOD issue.

    Since you are not having any malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Mar 2, 2012
    #13
  14. iPromo

    iPromo Private E-2

    Hi Tim,


    Ok so i did a full system scan and as my laptop is nearly empty (of software) it only took 40mins to complete. I saw 2 viruses which were named svchost.exe and they were identified as trojans. I also mentioned that i always get blocked ip messages from my computer under the process name svchost.exe and it is outgoing. So malwarebytes said i have to restart my pc to delete the files. I restarted my pc and this time only scanned my windows folder and the 2 files were there again! so this means the virus reproduces itself even when i delete it.... So i am searching the web for anything that resolves the problem..

    So if you have any past experience about this virus or know anything about it please state it :) ... Also i am very sorry to bug you so much Tim -.-" but your the guy with answers :-D



    Thanks mate.
     
    iPromo, Mar 2, 2012
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please attach the log from MBAM.
     
    TimW, Mar 2, 2012
    #15
  16. iPromo

    iPromo Private E-2

    Hi Tim,

    I have attached it for you mate.


    Thanks iPromo
     

    Attached Files:

    iPromo, Mar 2, 2012
    #16
  17. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download ComboFix to your desktop and run it. Attach the resultant log.
     
    TimW, Mar 2, 2012
    #17
  18. iPromo

    iPromo Private E-2

    Hi Tim,

    As requested i ran combofix and attached the logs which it produced at the end.



    Thanks mate :)
     

    Attached Files:

    • log.txt
      File size:
      23.7 KB
      Views:
      3
    iPromo, Mar 2, 2012
    #18
  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Strange, it didn't recognize that file as infected.

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    ClearJavaCache::
KILLALL::

File::
C:\Windows\svchost.exe
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the previous file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    [​IMG]
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Note: If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below log:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Mar 2, 2012
    #19
  20. iPromo

    iPromo Private E-2

    Hi Tim,

    I forgot to state that when i was running combofix it said it deleted C:\Windows\svchost.exe , (I didn't get a message box or anything i read it in the batch file) and from then i have scanned my windows folder and Malwarebytes has found nothing but i still get random messages from malwarebytes saying that they blocked the ip "xxxxxxxx" because it was malicious and it also states that it is running under the process name svchost.exe .

    So should i do what you stated me to do? (Dragging in the notepad file into combofix on the desktop).

    (By "xxxxxx" i mean random ip's every time because i get a message every 5+ minutes"


    Thanks Mate
     
    iPromo, Mar 2, 2012
    #20
  21. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, go ahead and run the fix. ;)
     
    TimW, Mar 2, 2012
    #21
  22. iPromo

    iPromo Private E-2

    Hi Tim,

    Ok so i did what you said but these things happened:

    1) When i did the thing on combofix everything went smooth and then it rebooted itself and automatically opened the batch file again, at the end it said Creating logs and then a line below it said Please wait for combofixer to create logs and don't turn on any programs (it was something similar) , i left it for 30 mins but it still had the same message so i eventually turned it off but it had produced a log which i have attached.


    2) When i did the thing on MGlogs i got a message from hijacker stating that it cannot acess a specific system type... This might be because i had enabled UAC before so should i do everything again with UAV of?




    Sorry i know my questions seem stupid to you but im not really into resolving virus type problems im more into programming and designing .... (btw im only 14 so there you go :p)


    Anyway thanks mate. :)
     

    Attached Files:

    iPromo, Mar 2, 2012
    #22
  23. iPromo

    iPromo Private E-2

    Hi Tim,

    I scanned my Windows folder again with Malwarebytes and i got the 2 viruses again. This time i have attached the log + a screenshot by the way i took no action to delete it.


    Thanks mate.
     

    Attached Files:

    iPromo, Mar 3, 2012
    #23
  24. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, you should have done everything with UAC disabled!! Please disable it now and re-run MBAM and have it fix what it finds.
     
    TimW, Mar 3, 2012
    #24
  25. iPromo

    iPromo Private E-2

    Hi Tim,

    I am very sorry that i haven't been active for these few days. I have had over 5 exams! And i went libary everyday to revise -.-" I will quickly get back to work on my laptop asap.

    Sorry for all my time wasting but my grades matter to me :)

    Anyway thanks mate.
     
    iPromo, Mar 6, 2012
    #25
  26. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Not a problem. We will be here when you are ready.
     
    TimW, Mar 6, 2012
    #26
  27. iPromo

    iPromo Private E-2

    Hi Tim,

    I am very sorry for my late reply but I managed to use a bit of time on my laptop. Ok so i recognised everytime i turn on my laptop a small window quickly opens and closes, it is only visible for 1/2 second so i can't read the title. So i go on task managaer -> all processes and see "svchost.exe" *32 running, i knew this one was the virus because all the other svchost's process's wer only named "svchost.exe". So to verify it was the virus i clicked open file location and it went into C -> Windows -> svchost.exe , i scanned the file and it was infected (Trojan Agent). So I played a bit with the process options and managed it to only read & execute because the system was allowing it to do everything! And when i turn my laptop on now i see the window for 1/2 second but the process is not running. I still get Bsod sometimes (e.g. When i turn on my computer and quickly press Mozilla Firefox) . However i think my Windows files are still infected altough malwarebytes only detects 2 viruses (svchost.exe and the process svchost.exe *32). In addition when I am running in safe mode i never get Bsod.

    I think my only solution is to get a new windows cd and install it onto my laptop:(


    Anyway Tim thanks for helping me, can you please tell me what to do now? (do i still need to run combofix?).

    Thanks again mate :)
     
    iPromo, Mar 14, 2012
    #27
  28. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Be sure you disable UAC and then run both MBAM and ComboFix. Attach the two logs. ;)
     
    TimW, Mar 14, 2012
    #28
  29. iPromo

    iPromo Private E-2

    Hi Tim,

    I finally got a chance to continue reparing my laptop, so i have attached the mglogs.zip file but the Combofix said that my it is expired, so it shut itself and deleted the shortcut from my dekstop i dont know what to do about the combofix issue redownload?

    Addiotional details: The virus file is in C:\Windows\svchost.exe this runs a process called "svchost.exe *32" the username in task manager is identified as "SYSTEM" and the details are "winrscmde" .

    Anyway i really appreciate your help Tim ;) you are really talented.
     

    Attached Files:

    iPromo, Mar 28, 2012
    #29
  30. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It "expired" due to age.

    Download a fresh copy of ComboFix to your desktop and try to run it. Attach the log once it is finished.
     
    TimW, Mar 28, 2012
    #30
  31. iPromo

    iPromo Private E-2

    Hi Tim,

    Long time no see ;) , sorry again I have minimal time.
    So i ran combofix 3 times but my computer got bsod 3 times while having combofix on for about 10 mins. However when I do work on my computer I don't get bsod but my startup time is still affected and malwarebyted identifies it still as a virus. I can close the proccess with the step's below:
    1) Computer turns on
    2) I see the virus window open straight away but I wait for malwarebytes to open in the tray menu
    3) When malwarebytes is active, i go on task manager -> show all processes -> and find "svchost.exe*32" -> i click on it once and press end process.
    4) (When you end the process of the virus it automatically restarts but the window is not visible like it is on startup) so the virus tries to startup again but malwarebytes opens a window saying to "quarantine" the virus or "ignore" it.
    5) I always press quarantine but on the next startup it is the same story :cry

    I still think the virus is affecting my bsod problems too well I hope so...
    So do you have any other suggestions? or should i try combofix again?

    (I dont get the bsod at a specific time when I run combofix, it just happens at a random time) I also don't have any other programs open while I run combofix, i just sit next to my laptop waiting for it :zzz

    Thank you again Tim :)
     
    iPromo, Apr 3, 2012
    #31
  32. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing Combo in your logs. Did you download it to your desktop as instructed?

    You need to remove all that you can in this folder:
    C:\Users\Milad\AppData\Local\Temp\

    I am not seeing the svchost file in your logs.

    Download OTL to your desktop.


    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Vista and Windows 7 users Right-click OTL and choose Run as Administrator)
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.


    When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

    Attach both of these logs into your next reply.
     
    TimW, Apr 3, 2012
    #32
  33. iPromo

    iPromo Private E-2

    Hi Tim,

    I attached the 2 logs, thanks for your quick reply :)
     

    Attached Files:

    Last edited by a moderator: Apr 4, 2012
    iPromo, Apr 3, 2012
    #33
  34. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click OTL.exe to start the program.

    • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

    Code:
    :processes
:killallprocesses
:otl
:files
C:\Windows\svchost.exe
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
    • Then click the Run Fix button at the top.
    • Click the OK button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Apr 4, 2012
    #34
  35. iPromo

    iPromo Private E-2


    Hi Tim!,

    I finally managed to remove the virus, and for everyone else having the same problem I have posted how I have resolved it:

    1) Download tdsskiller.

    2) Extract the zip file and then right click the .exe file and select "run as administrator" (in win7/vista).

    3) It will open up a small gui, just press start scan and it will only take about 2 mins.

    4) When it finishes scanning it will ask you what to do with the infected file(s). Just cure them all.

    5) It will ask you to reboot your computer, reboot it!

    6) When you computer is on again, open task manager and select, "view proccesses from all users". You should now see that there is no svchost.exe*32 running anymore ;)

    7) But your nearly finished there is only one last thing to do. Download Malwarebytes and then go to, My computer -> C -> and right click the "Windows" folder. Select scan with Malwarebytes and wait for the scan to finish. At the end of the scan it will ask you to reboot, reboot your computer.

    8) Just to be sure everything went correctly, check task manager for the svchost*32.exe process and check the svchost.exe in the windows folder. If they are not there then the virus is gone :wave .


    That's It! :)


    Again I would like to thank everyone on this forum who has tried to help me and especially Tim because he has worked his socks of to help me :-D

    Thank Again to everyone!

    ______
    iPromo
     
    iPromo, Apr 11, 2012
    #35
  36. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know, as TDSSKiller was our next process to try.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Apr 11, 2012
    #36

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds