request for assistance - all logs attached

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Satan165, Nov 5, 2015.

  1. Satan165

    Satan165 Private E-2

    Big thanks in advance to whomever would be willing to help me.

    I have carefully reviewed the guidelines and run Hitman, Rogue Killer, Malwarebytes, TDSSkiller and MG tools as requested, and also attached the logs as requested.

    I see a couple highly suspect EXEs running in task manager on and off:
    -presentationhost.exe
    -NOTEPAD.exe (clearly a phony, I am not running the 'real' text editor

    CPU power is crippled, Windows Explorer especially is brutally slow. It took me over 3 hours to download, install and run the 5 scanners above and longer to save the logs (takes forever to browse for a save location). I am running Firefox now instead of Chrome as Firefox has a smaller memory footprint and runs a bit faster.

    THANK YOU VERY MUCH! for all the help, or at least the offer of assistance. This computer is in sleep mode 16 hours a day and often 24, I have not had a virus/worm/etc in many years and I do not remember anything in particular that would have led to the infection. I got home last night and 'woke up' the PC and noticed right away it was super sluggish. I saw the obvious malware in Task Manager and spun my wheels for a few hours trying to manually remove the garbage then gave up and found this forum.

    THANK YOU and I look forward to the next steps.
     

    Attached Files:

    Satan165, Nov 5, 2015
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    This PC is running an illegal copy of Windows XP as observed in your Malwarebytes logs with the below files:

    Modules: 2
    PUP.Optional.WpaKill, C:\WINDOWS\system32\antiwpa.dll, Delete-on-Reboot, [1a4edd9d2368fe38dd6192d36c986997],
    Trojan.I.Stole.Windows, C:\WINDOWS\system32\antiwpa.dll, Delete-on-Reboot, [4523daa0305bd95dd2d350734bb77b85],

    We really do not support people running illegal copies of Windows. Also you are using Windows XP which is out of date and no longer supported by Microsoft and it is prone to having security issues now. However you can try running Hitman Pro again and activate the 30 day free trial. Have it fix all the Malware and Potential Unwanted Programs that it finds.


    presentationhost.exe is a valid Windows system file as is notepad.exe depending on where it is running from.
     
    chaslang, Nov 6, 2015
    #2
  3. Satan165

    Satan165 Private E-2

    thanks for the help
     
    Satan165, Nov 6, 2015
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Did you let Hitman fix those items and did it help at all after a reboot?
     
    chaslang, Nov 9, 2015
    #4
  5. Satan165

    Satan165 Private E-2

    Yes sir - fixed the issues entirely. THANK YOU!
     
    Satan165, Nov 9, 2015
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.



    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    3. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    9. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore​
      • For Windows 8 and 8.1 system restore see this link: Win 8 System Restore - How to enable/disable​
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Nov 9, 2015
    #6

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds