Need Help Getting Rid of Trojans

[Sassafras]

I first noticed problems last night. A game I was playing at FB was freezing up (as they've been doing for me for about a week, I guess), so I closed it. Whenever I tried to click on the Start menu or one of the buttons at the top of my browser window (File, Bookmarks, etc.), the pop-up and drop-down menus would sort of flash and then disappear, not allowing me to click on anything in those menus.

So I ran AVG, which told me I had/have a Generic9.SIB.dropper. Avast told me I had a downloader. I restarted my computer, but problems continued. Among them a screen I've never seen come up before.

"Please select boot device
PM-ST3160023AS
3M-_NEC DVD+RW ND-2100AD
3S-ASUS CD-S480/AH

F4 to boot using defaults"

Anyway (I apologize for the length of this), I did the Read and Run thing, including uninstalling AVG so that I now only have Avast. SAS found Adaware.Vundo Variant, PUP.MyWebSearch, Unclassified.Unknown Origin. Malwarebytes found 13 threats (mostly Pup.MyWebSearch). I couldn't get RootRepeal to work. It froze the first time, so I restarted my computer. The next two or three times a pop-up appeared saying that the system is low on virtual memory, then froze again. So I gave up on that.

Here are my log files:

[chaslang]

Other than the minor items removed, I'm not seeing any malware problems. Are you have any?

Is your PC performance slow? Is so, uninstall some of the stuff you installed. Like the below which I don't recommend at all:
a-squared Free 3.0
Ad-Aware SE Personal

And also the below if you still have performance problems:
Advanced SystemCare 4
IObit Malware Fighter

[Sassafras]

I haven't restarted my computer yet for fear of the virus re-installing (or whatever it does) at start-up, but so far so good. I will do what you recommend and re-start. Hopefully everything will still be good.

Oh, and is there anything I can do about the boot message I get at start-up?

"Please select boot device
PM-ST3160023AS
3M-_NEC DVD+RW ND-2100AD
3S-ASUS CD-S480/AH

F4 to boot using defaults"

It didn't used to do that before the virus.

[Sassafras]

I re-started my computer and the same problems are back. I can't get any drop-down menus to open, can't get any programs (other than internet, though sometimes not that) to run. I've tried clicking on Avast in the tray, Start menu (which won't open) and MyComputer (then click on C:\, then Program Files, Avast), but it won't open.

I'm going to try re-starting again and then try again to run Avast. Any other recommendations?

[Sassafras]

I've re-started my computer 2 more times and still can't do anything other than get online. Probably because I can click on desktop icons/short-cuts. I can't click on anything in the tray or Start menu. Facebook is my homepage and it's not always loading. I can't get any of the toolbar buttons to work (File, Edit, Bookmarks). Drop-down menus just sort of flash and are gone before I can use them. I can click on my search bar and use that. Which is how I'm getting here.

So I haven't been able to do an anti-virus scan because the virus (or some other problem) isn't letting me.


ETA: Finally. Doing a full system scan using Avast right now. Will let you know if it finds anything.

[Sassafras]

Avast detected a threat: Win32:CTX.

There are also many problems found in the hard drive in various places. (I can't find a way to save a log file of this. Would it be automatic?) Status for these errors is "Error: Archive is password protected (42056)".

The errors seem to all be in Downloads, flashplayer 10 - buttons, icons, action (list, install, download, launch, registry), language, launcher, bundleloader, etc., etc. It's a very long list. Appears to only be related to flashplayer 10. Though my current flashplayer is 11.

[chaslang]

Originally Posted by Sassafras

Oh, and is there anything I can do about the boot message I get at start-up?

"Please select boot device
PM-ST3160023AS
3M-_NEC DVD+RW ND-2100AD
3S-ASUS CD-S480/AH

F4 to boot using defaults"

I suggest that you check in the Software Forum. This sounds like a settings issue. Possibly something in your BIOS.

[chaslang]

Originally Posted by Sassafras

Avast detected a threat: Win32:CTX.

Most of the time, this is just a false detection of PandaActiveScan files. Attaching a log from Avast that shows exactly what is being found is more helpfule. Infection names are typically not of too much help to us. There are ways to save/retrieve logs with Avast. I just don't have that info right now since I don't have Avast on any PCs right now.



Possibly the below folder:
C:\Program Files\Alwil Software\Avast5\log

see >>http://forum.avast.com/index.php?topic=70818.0 but this is for Win 7 / Vista

Originally Posted by Sassafras

The errors seem to all be in Downloads,

What do you mean by "errors"? Did you mean to say an infection is detected.

[Sassafras]

Thank you. I will go to Software about that odd boot screen I'm getting.

Avast detected a threat, Win32: CTX, and also said that there were "errors" (a very long list). Each error ("Error: Archive is password protected (42056)") appears to be with Flashplayer 10. (I updated to Flashplayer 11 sometime back.) Since getting these "errors" for Flashplayer 10, I've attempted to completely remove it from my computer. Hopefully I was successful. I haven't done any other scans while waiting to hear back from one of y'all.

I can't find C:\Program Files\Alwil Software\Avast5\log. I went to MyComputer, then Program Files, then the Avast Software folder. Everything there ends with dll and exe.

[chaslang]

You're welcome.

Originally Posted by Sassafras

Avast detected a threat, Win32: CTX, and also said that there were "errors" (a very long list). Each error ("Error: Archive is password protected (42056)") appears to be with Flashplayer 10. (I updated to Flashplayer 11 sometime back.) Since getting these "errors" for Flashplayer 10, I've attempted to completely remove it from my computer. Hopefully I was successful. I haven't done any other scans while waiting to hear back from one of y'all.

Without a real log I cannot really comment too much but since you logs are clean, I would say the Win32.CTX item is a false detection or a detection of things we already removed and that are quarantined. The other items with passwords are not malware detections. They are just locked or password protected files which is quite common and not a problem.



Since you dod not really appear to be having malware problems now, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!