Windows loaded with Malware issues

Welcome to Major Geeks!

Why are you running this PC without proper protection? Sandboxie is not going to protect you from malware as can obviously be seen from your logs which show you are very badly infected. In fact based on your ComboFix log you may have to reinstalled if it is correct. We will know more after the below is completed and we get a full set of logs from MGtools. What I'm expecting is that you have a Virut infection along with dozens of other infections and if I'm correct about the Virut infection, ComboFix will probably complain about it during the next fix and you will be reinstalling to fix this.


Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall any of the below software if found:
Viewpoint Manager (Remove Only) <-- should have been uninstalled in step 5 of the READ ME
Viewpoint Media Player <-- should have been uninstalled in step 5 of the READ ME

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
O4 - HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [hgcheck] C:\WINDOWS\system32\wxwgl.exe
O4 - HKUS\S-1-5-18\..\Run: [msnmager] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\TEMP\cagaag.dll,Set1 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmager] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\TEMP\cagaag.dll,Set1 (User 'Default user')
O4 - S-1-5-18 Startup: scandisk.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: scandisk.lnk = ? (User 'Default user')
O4 - .DEFAULT User Startup: scandisk.lnk = ? (User 'Default user')
O4 - Startup: is-C6O9A.lnk = C:\Documents and Settings\j\Desktop\Virus Removal Tool\is-C6O9A\startup.exe
O4 - Startup: scandisk.lnk = ?
O20 - AppInit_DLLs: ,C:\WINDOWS\TEMP\14xxx.dll
O23 - Service: fastnetsrv Service (fastnetsrv) - Netopsystems A - C:\WINDOWS\system32\FastNetSrv.exe
O23 - Service: Net Login (NetLogin) - Unknown owner - C:\WINDOWS\svchost.exe
O23 - Service: Net_Login - Unknown owner - C:\WINDOWS\svchust.exe

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

After clicking Fix, exit HJT.


Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

I would not scan the external drive right now from this PC since it would infect it for sure. If the external drive has any files that are executable type files on it then in all likelihood they are already infected. Executable files are not just EXE files. It can include the following too: .com, .doc, .jpg, .htm, .html, .msi, .pdf, .pif, .rar, .scr, .zip and even other files like this that cause processes to run.

You would be better off rescanning after reinstalling your PC and installing only protection software and absolutely nothing else since you could waste too much time installing and tweaking only to reinfect yourself quickly after the external drive is plugged in. All it takes is for one infected file to remain and be accessed for the infection to respread all over again.

 

There is little difference when it comes to scanning for infections like this. Anyone should be fine but I would also suggest throwing the below two online scans in just to be safe:

Using BitDefender Online Scan

Trend Micro Housecall