Malware Removal Help Needed - 26Apr13

I recently purchased a refurbished Dell Computer running Windows 7. I had an XP and transferred my files to the new PC. After doing that, I installed Microsoft Security Essentials. Almost immediately, I received warnings from MSE that I had 5 viruses. I told MSE to cleanse my computer. It said it did, but shortly thereafter, the same 5 viruses popped up. Also, after "cleaning" the 5 viruses, it pops up with 2 more. I clean them and then it starts over with the 5 viruses it found, followed by the 2.

I have run CCleaner, Spybot S&D, Computer Associates (CA Virus) scans and Malwarebytes. None of these scans found any virus, but MSE does, but doesn't kill them. My last resort is MajorGeeks. I followed the steps for malware removal by running scans and keeping logs. Of the 5 or so program I was to run, only MGlogs.zip failed to be created. I was unable to save the program to my C root, so I put it on my desktop as was alternatively suggested. I am attaching the logs that I have and request help in getting MGtools to create the log file. I don't think there was a log for TDSS. I couldn't find one and don't think it found viruses.

If I need to provide additional information please let me know.

Thanks.

Dave

 

Edit to add to my original post. These are the 5 viruses MSE finds and doesn't fix:

Adware:Wiin32/SideStep
SoftwareBundler: Win32/Imesh
Adware:Win32/Ezula.g
Adware:Win32/NewDotNet
Adware:Win32/Clariagain.B
After MSE "doesn't" cleanse the above, the following two appear while MSE is "cleaning" the original 5 viruses:
BrowserModifier:Win32/Favoriteman
Trojan:Win32/Malat

The Malat is marked: Severe.

"Cleansing" doesn't remove those two either.

 

Question regarding Malware Help

A few days ago I started a thread regarding malware on my Dell computer. After writing my post and providing the attachments requested, I thought it might help if I told you what viruses were on my computer. That created a 2nd posting.

I read in your FAQs that we are not to bump threads that it would delay considerably any help. Even though my 2nd post was 15 or so minutes after the first, I realize that might be interpreted as a bump in order to keep my problem on the first page. That was never my intent. However, it has been a few days that I've reported this problem and no response yet. I note that other people's problems are being worked on, even though their posting date is after mine.

I'm not asking to be helped next, but I just wanted to offer an explanation of why there are two posts in my thread, and both of them are mine and not that of one of you experts from Major Geeks.

The URL of my thread is: http://forums.majorgeeks.com/showthread.php?t=275994 any help will be appreciated.

BTW, I ran malwarebytes that one time and it came up "clean", but I can't run it anymore because I'm beyond the 14 day trial.

After reading this and deciding to work on my problem, you can delete this thread.

Thank you,

Dave

 

Malwarebytes log is now attached.
TDSSKiller when I start it, it gives a popup that says "Can't initialize log" and followed by "Can't Load Driver". But it still runs and doesn't have a log. It said that there are 0 Threats, etc. No viruses found. I ran as an administrator.
UAC was and still is disabled.
I put CA-Anti virus in the "snooze" status. I didn't see any other way to disable.

As for MGtools, I am running it as the Administrator: I don't see any log file on my C drive, but there was a window opened up and dumping a bunch of messages...lots of them I/O errors: I've copied it here:

[edit by chaslang] Inline log snipit removed.

 

That seems to have worked. The MGlogsR.zip is attached.

Dave

 

Hello.

1. I uninstalled Microsoft Security Essentials.
2. I uninstalled Search Protect by conduit
3. I downloaded OTM and pasted the code into its window.
a. The program ran, but right after where it displayed === REGISTRY ==== followed by two lines of HKEY messages, the OTM went into a Not Responding Mode. I let it sit for 10-15 minutes until I finally ENDED the Task. It said it was using 50% of the CPU cycles, but still not doing anything.
b. I had to reboot my machine as it was locked up because of this.
c. On startup, OTM started again and produced a log.
d. Assuming the LOCK OUT was typical for some, I continued with your instructions.

4. I am attaching mmddyyyy_hhmmss.log from _OTM
5. I downloaded JunkYard and did what I could to stop CA Anti-Virus. (It doesn't let me EXIT, all I could do was to put it into snooze status for 999 minutes. It said I would have no virus protection with the snooze status, so I figured I complied with your request to stop my anti-virus.
6. I also exited malwarebytes too.
7. I ran JunkYard and have attached the JRT.txt
8. I ran GetLogs.bat and attached the MGlogs.zip

 

Hello.

(I was in the middle of posting this and uploading my attachments, when it somehow got posted. so I went into Edit and tried to finished my message and Save. I got a message about Editing taking more than 10 minutes and told me to contact the administrator. I'm not sure how that works from reading the page. anyway, here is what I was trying to say and here are the attachments that got lost from my previous post. )

1. I uninstalled Microsoft Security Essentials.
2. I uninstalled Search Protect by conduit
3. I downloaded OTM and pasted the code into its window.
a. The program ran, but right after where it displayed === REGISTRY ==== followed by two lines of HKEY messages, the OTM went into a Not Responding Mode. I let it sit for 10-15 minutes until I finally ENDED the Task. It said it was using 50% of the CPU cycles, but still not doing anything.
b. I had to reboot my machine as it was locked up because of this.
c. On startup, OTM started again and produced a log.
d. Assuming the LOCK OUT was typical for some, I continued with your instructions.

4. I am attaching mmddyyyy_hhmmss.log from _OTM
5. I downloaded JunkYard and did what I could to stop CA Anti-Virus. (It doesn't let me EXIT, all I could do was to put it into snooze status for 999 minutes. It said I would have no virus protection with the snooze status, so I figured I complied with your request to stop my anti-virus.
6. I also exited malwarebytes too.
7. I ran JunkYard and have attached the JRT.txt
8. I ran GetLogs.bat and attached the MGlogs.zip

How is it running?

While it was not my original problem, I have noticed for the past couple of days, my keystrokes displaying were not keeping up with my typing. It was slow. Starting IE was slower than I expected for having a "new" refurbished computer.

The only thing I wonder about is that Microsoft Security Essentials was the only program to identify the 5-7 viruses mentioned in my original post (#2). Since MSE is uninstalled, I don't know for sure if they are gone, because no other anti-virus found them. I was most worried about the one marked "serious" and wonder if it is now removed: MATVAR or something like that.

I will wait for your next set of instructions to see where I go from here. (Don't say it!!! "Hell!" ha ha

With appreciation for your help,

Dave