Help!! Trojans,Malware,Spyware in the system

Discussion in 'Malware Help (A Specialist Will Reply)' started by vijuk100, Jul 8, 2008.

  1. vijuk100

    vijuk100 Private E-2

    Hi,

    I noticed some exe tasks in my task manager which looked suspicious. example Nobicyt.exe, afinding.exe, perfs.exe and therefore decided to clean the system as per the guidance available on the Major Geeks site using
    1. Super Anti Spyware.
    2. Spybot.
    3. Malwarebyte's Anti Malware
    4. Combofix
    5. MG Tools.

    However after running the said programs, I still find Nobicyt.exe present and one more file added to the task manager,i.e. xwxfst.sys. I am not sure if these are the nasties. Please someone have a look and help me resolve the problems.

    The rest of the logs are being attached and posted in the next message.

    Vijay
     

    Attached Files:

  2. vijuk100

    vijuk100 Private E-2

    The rest of the logs are attached here. Pls help.

    Vijay
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    o If it is not on your Desktop, the below will not work.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::
    
    Drivers::
    Nobicyt
    afinding
    wserving
    routing 
    perfs
    
    File::
    C:\WINDOWS\system32\Nobicyt.exe
    C:\WINDOWS\system32\afinding.exe  
    C:\WINDOWS\system32\wserving.exe 
    C:\WINDOWS\system32\routing.exe  
    C:\WINDOWS\system32\perfs.exe 
    
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from ComboFix.
     
  4. vijuk100

    vijuk100 Private E-2

    Dear TimW,

    Thanks for your reply. I have followed the steps as per your instructions. The log files are attached for your perusal. (Mglogs.zip and combofixlog) I think the removal has been done but kindly confirm the same. Also pls tell me how to complete the thread by posting the "Solved" note. Thanks for helping. Have a nice day.

    Brgds,
    Vijay
     

    Attached Files:

  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    We don't do a "solved" note...:)

    Your logs look clean.

    If you are not having any other malware problems, it is time to do our final steps:

    1. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    2. Click START then RUN
    * Now type "%userprofile%\Desktop\cf" /u in the runbox ( or whatever you renamed it to) and click OK.
    * Note: The space between the cf and the /U, it must be there.
    3. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    4. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    5. If you are running Windows XP or Windows ME, do the below:
    * Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    6. After doing the above, you should work thru the below link:
    How to Protect yourself from malware!
     
  6. vijuk100

    vijuk100 Private E-2

    Hi,

    Thanks for your advice. I tried to uninstall the combofix.exe through the control panel>add remove progs, however the program was not listed there so I have just deleted the exe file. Also after this delete the Start>Run>"%userprofile%\Desktop\cf" /u gives an error report as the file is not found.

    Should I go ahd and delete the other MG logs and exe files as adviced?

    Thanks again for all your help. Love it.

    Vijay
     
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Should have run the script before manually uninstalling ...but not a problems.
    You can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs.

    Yes, you can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds