Requesting help with malware removal please, logs attached.

Hello all,

My father recently reported that his computer was acting a little slow and that he suspected some files on it. So I decided to go through the READ & RUN ME FIRST thread for general malware removal of Windows XP.

There are two things that I would like to note. The first is that I have my dad use AVG anti-virus since it's been pretty reliable. Anyhow I uninstalled it per the instructions so that I could run ComboFix and it ran without incident. After I finished with all steps I installed AVG again so that my dad has some anti-virus protection while we wait for you guys to look through the logs. I hope that this is alright and doesn't interfere with anything.

The second thing is that I could not run Root Repeal at all. I followed your intructions and tried to run the program but no dice. AVG was also currently not installed since I had run ComboFix prior. Root Repeal would just lock up the computer completely. I thought maybe this was intended behavior and let it sit for about 45 minutes. However upon my return the machine was still locked up and I had to reset it and skip this step completely. I'm sorry if this hampers things but I simply can't run the program without it locking up the computer.

Hope I was able to give you as much information up front as I could. I appreciate any help you guys can give and thank you in advance for taking the time.

Ian

 

Hi Ian,

I am not finding any malware in your logs.
Let's run the below scans to make sure there is not any rootkit activity.

I want you to read and follow these instructions: TDSSKiller - How to run


Please download aswMBR to your desktop.

• Double-click aswMBR.exe to run (Vista/7 right-click and select Run as Administrator)
• Select No when asked "Would you like to download latest Avast! virus definitions?"
• Click the [Scan] button.
• On completion of the scan click [Save log], save it to your desktop and attach this log to your next message. (How to attach)

 

Hey there thisisu,

Thanks for the help, wasn't expecting such a fast reply so there's a nice bonus. Anyhow I've downloaded and run the two programs that you have asked me to. I've attached the logs for both programs for you viewing pleasure. Thanks again for the help in making sure my dad's PC is clean as possible.

Ian

 

Hi Ian,

These logs are clean as well.

The issue with this computer is not malware related. Please seek additional help if you need it in the Software forum.

__

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Be safe