IE works fine and then quits responding

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Signlady906, Jan 20, 2008.

  1. Signlady906

    Signlady906 Private E-2

    I've ran the suggested Malware scans, and IE still locks up (not responding) after about an hour of online use.
    Spybot says I'm clean, AVG Anti Spyware only found 2 MRUs. I'm attaching the reports from combofix & MGTools.
    I've also ran AVGRootkit (clean), Ad-Aware SE (4-5 MRUs), CWShredder (clean), and a-squared Free, which found 11 things, mostly Low/Medium risk Trace.Registry items, except for 2 locations of
    Trojan-Downloader.Win32.Agent.bkw
    All 2-squared items are in quarantine.
    Any suggestions?
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please use add/remove programs to uninstall:
    J2SE Runtime Environment 5.0 Update 10"
    J2SE Runtime Environment 5.0 Update 11"
    J2SE Runtime Environment 5.0 Update 4"
    J2SE Runtime Environment 5.0 Update 6"
    J2SE Runtime Environment 5.0 Update 9"
    Java(TM) 6 Update 2
    Java(TM) SE Runtime Environment 6 Update 1

    Please disable all anti-virus and anti-spyware programs while we do the following:

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.


    Use windows explorer to find and delete:
    C:\Program Files\pokesol.exe
    C:\Program Files\fgf13.exe

    Tell me how things are running.
     
  3. Signlady906

    Signlady906 Private E-2

    Just did all that you suggested and will give it a day or two to see if there are any improvements.
    Thanks so much for the quick response.
    Should I post any more scan results?
     
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You can come back and attach the MGLogs.zip if you notice any problems......if all is well:
    it is time to do our final steps:

    1. If we used Pocket Killbox during your cleanup, do the below
    * Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    10. If you are running Windows XP or Windows ME, do the below:
    * Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
    *How to Protect yourself from malware!
     
  5. Signlady906

    Signlady906 Private E-2

    I'll know this evening if all is well. I will follow these steps, but only used ComboFix & MGTools. Would there be any benefits in running the other items you've mentioned below?
    Thanks again,
    Beth


     
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    No need to run any of the others ...if you have any doubts ...it is always a good practice to run an online scan such as BitDefender periodically to be sure:
    Bitdefender agree to the license and then select Scan. DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED. That will make your logs huge and we don't need to see clean files. Once Bitdefender completes the scan:

    Click-on the Detected Problems tab. Then select Click here to export the scan report

    When the window comes up to save the report, change the Save as type: box to Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click save. This will save a file named bdscan.txt in whatever folder you are currently in when you save the file (take notice of where you are at so you can find it later). This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.
     
  7. Signlady906

    Signlady906 Private E-2

    I ran BitDefender. Here is the report I sent to BitDefender:
    BitDefender Online Scanner - Real Time Virus Report
    Generated at: Tue, Jan 22, 2008 - 10:45:04
    Scan Info
    Scanned Files 292223
    Infected Files 6
    Virus Detected
    DeepScan:Generic.Malware.P!.5F1AEB08 2
    Trojan.Dropper.Agent.BCT 2
    Adware.CyDoor 1
    BehavesLike:Win32.Malware 1

    I have also attached the bdscan file.
    Thanks again for all your help!
    Beth
     

    Attached Files:

  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good job....you had some malware in the system restore files which is also why we have you toggle that when we are done.....:)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds