MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Closed Thread
 
Thread Tools Display Modes
  #1  
Old 05-20-12, 13:25
Sassafras's Avatar
Sassafras Sassafras is offline
Private First Class
 
Join Date: Jan 2005
Location: NC
Posts: 48
Thanks: 0
Thanked 1 Time in 1 Post
Default Need Help Getting Rid of Trojans

I first noticed problems last night. A game I was playing at FB was freezing up (as they've been doing for me for about a week, I guess), so I closed it. Whenever I tried to click on the Start menu or one of the buttons at the top of my browser window (File, Bookmarks, etc.), the pop-up and drop-down menus would sort of flash and then disappear, not allowing me to click on anything in those menus.

So I ran AVG, which told me I had/have a Generic9.SIB.dropper. Avast told me I had a downloader. I restarted my computer, but problems continued. Among them a screen I've never seen come up before.

"Please select boot device
PM-ST3160023AS
3M-_NEC DVD+RW ND-2100AD
3S-ASUS CD-S480/AH

F4 to boot using defaults"

Anyway (I apologize for the length of this), I did the Read and Run thing, including uninstalling AVG so that I now only have Avast. SAS found Adaware.Vundo Variant, PUP.MyWebSearch, Unclassified.Unknown Origin. Malwarebytes found 13 threats (mostly Pup.MyWebSearch). I couldn't get RootRepeal to work. It froze the first time, so I restarted my computer. The next two or three times a pop-up appeared saying that the system is low on virtual memory, then froze again. So I gave up on that.

Here are my log files:
Attached Files
File Type: log SUPERAntiSpyware Scan Log - 05-20-2012 - 08-09-00.log (1.1 KB, 1 views)
File Type: txt mbam-log-2012-05-20 (08-49-43).txt (6.5 KB, 1 views)
File Type: txt ComboFix.txt (17.6 KB, 1 views)
File Type: zip MGlogs.zip (180.5 KB, 1 views)
Sponsored links
  #2  
Old 05-20-12, 20:17
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,771
Thanks: 62
Thanked 7,840 Times in 4,257 Posts
Default Re: Need Help Getting Rid of Trojans

Other than the minor items removed, I'm not seeing any malware problems. Are you have any?

Is your PC performance slow? Is so, uninstall some of the stuff you installed. Like the below which I don't recommend at all:
a-squared Free 3.0
Ad-Aware SE Personal

And also the below if you still have performance problems:
Advanced SystemCare 4
IObit Malware Fighter
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
  #3  
Old 05-20-12, 22:13
Sassafras's Avatar
Sassafras Sassafras is offline
Private First Class
 
Join Date: Jan 2005
Location: NC
Posts: 48
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Need Help Getting Rid of Trojans

I haven't restarted my computer yet for fear of the virus re-installing (or whatever it does) at start-up, but so far so good. I will do what you recommend and re-start. Hopefully everything will still be good.

Oh, and is there anything I can do about the boot message I get at start-up?

"Please select boot device
PM-ST3160023AS
3M-_NEC DVD+RW ND-2100AD
3S-ASUS CD-S480/AH

F4 to boot using defaults"

It didn't used to do that before the virus.
  #4  
Old 05-20-12, 22:46
Sassafras's Avatar
Sassafras Sassafras is offline
Private First Class
 
Join Date: Jan 2005
Location: NC
Posts: 48
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Need Help Getting Rid of Trojans

I re-started my computer and the same problems are back. I can't get any drop-down menus to open, can't get any programs (other than internet, though sometimes not that) to run. I've tried clicking on Avast in the tray, Start menu (which won't open) and MyComputer (then click on C:\, then Program Files, Avast), but it won't open.

I'm going to try re-starting again and then try again to run Avast. Any other recommendations?
  #5  
Old 05-20-12, 23:00
Sassafras's Avatar
Sassafras Sassafras is offline
Private First Class
 
Join Date: Jan 2005
Location: NC
Posts: 48
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Need Help Getting Rid of Trojans

I've re-started my computer 2 more times and still can't do anything other than get online. Probably because I can click on desktop icons/short-cuts. I can't click on anything in the tray or Start menu. Facebook is my homepage and it's not always loading. I can't get any of the toolbar buttons to work (File, Edit, Bookmarks). Drop-down menus just sort of flash and are gone before I can use them. I can click on my search bar and use that. Which is how I'm getting here.

So I haven't been able to do an anti-virus scan because the virus (or some other problem) isn't letting me.


ETA: Finally. Doing a full system scan using Avast right now. Will let you know if it finds anything.
Sponsored links
  #6  
Old 05-21-12, 00:29
Sassafras's Avatar
Sassafras Sassafras is offline
Private First Class
 
Join Date: Jan 2005
Location: NC
Posts: 48
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Need Help Getting Rid of Trojans

Avast detected a threat: Win32:CTX.

There are also many problems found in the hard drive in various places. (I can't find a way to save a log file of this. Would it be automatic?) Status for these errors is "Error: Archive is password protected (42056)".

The errors seem to all be in Downloads, flashplayer 10 - buttons, icons, action (list, install, download, launch, registry), language, launcher, bundleloader, etc., etc. It's a very long list. Appears to only be related to flashplayer 10. Though my current flashplayer is 11.
  #7  
Old 05-21-12, 22:03
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,771
Thanks: 62
Thanked 7,840 Times in 4,257 Posts
Default Re: Need Help Getting Rid of Trojans

Quote:
Originally Posted by Sassafras View Post
Oh, and is there anything I can do about the boot message I get at start-up?

"Please select boot device
PM-ST3160023AS
3M-_NEC DVD+RW ND-2100AD
3S-ASUS CD-S480/AH

F4 to boot using defaults"
I suggest that you check in the Software Forum. This sounds like a settings issue. Possibly something in your BIOS.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
  #8  
Old 05-21-12, 22:11
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,771
Thanks: 62
Thanked 7,840 Times in 4,257 Posts
Default Re: Need Help Getting Rid of Trojans

Quote:
Originally Posted by Sassafras View Post
Avast detected a threat: Win32:CTX.
Most of the time, this is just a false detection of PandaActiveScan files. Attaching a log from Avast that shows exactly what is being found is more helpfule. Infection names are typically not of too much help to us. There are ways to save/retrieve logs with Avast. I just don't have that info right now since I don't have Avast on any PCs right now.



Possibly the below folder:
C:\Program Files\Alwil Software\Avast5\log

see >>http://forum.avast.com/index.php?topic=70818.0 but this is for Win 7 / Vista


Quote:
Originally Posted by Sassafras View Post
The errors seem to all be in Downloads,
What do you mean by "errors"? Did you mean to say an infection is detected.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
  #9  
Old 05-22-12, 02:14
Sassafras's Avatar
Sassafras Sassafras is offline
Private First Class
 
Join Date: Jan 2005
Location: NC
Posts: 48
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Need Help Getting Rid of Trojans

Thank you. I will go to Software about that odd boot screen I'm getting.

Avast detected a threat, Win32: CTX, and also said that there were "errors" (a very long list). Each error ("Error: Archive is password protected (42056)") appears to be with Flashplayer 10. (I updated to Flashplayer 11 sometime back.) Since getting these "errors" for Flashplayer 10, I've attempted to completely remove it from my computer. Hopefully I was successful. I haven't done any other scans while waiting to hear back from one of y'all.

I can't find C:\Program Files\Alwil Software\Avast5\log. I went to MyComputer, then Program Files, then the Avast Software folder. Everything there ends with dll and exe.
  #10  
Old 05-22-12, 23:48
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,771
Thanks: 62
Thanked 7,840 Times in 4,257 Posts
Default Re: Need Help Getting Rid of Trojans

You're welcome.
Quote:
Originally Posted by Sassafras View Post
Avast detected a threat, Win32: CTX, and also said that there were "errors" (a very long list). Each error ("Error: Archive is password protected (42056)") appears to be with Flashplayer 10. (I updated to Flashplayer 11 sometime back.) Since getting these "errors" for Flashplayer 10, I've attempted to completely remove it from my computer. Hopefully I was successful. I haven't done any other scans while waiting to hear back from one of y'all.
Without a real log I cannot really comment too much but since you logs are clean, I would say the Win32.CTX item is a false detection or a detection of things we already removed and that are quarantined. The other items with passwords are not malware detections. They are just locked or password protected files which is quite common and not a problem.



Since you dod not really appear to be having malware problems now, it is time to do our final steps:
  1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
  2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
    • "%userprofile%\Desktop\combofix" /uninstall
      • Notes: The space between the combofix" and the /uninstall, it must be there.
      • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
  3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  7. Go to add/remove programs and uninstall HijackThis.
  8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures pointed to by step 7 of the READ ME
      for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  10. After doing the above, you should work thru the below link:
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Sponsored links
Closed Thread

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Many Trojans and No IE priapist Malware Removal 4 02-08-10 20:06
Please HELP!! Trojans! crazydudemanperson Malware Removal 5 01-20-10 05:13
please help: tried everything - still got trojans! RobertHoliday Malware Removal 1 05-07-09 02:24
Help with Trojans 1451 Malware Removal 1 01-08-07 14:07
Major confusion, trojans, no trojans? zlaser84 Malware Removal 21 02-23-06 23:49


All times are GMT -5. The time now is 12:43.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger