Malware, Trojans

Discussion in 'Malware Help (A Specialist Will Reply)' started by Foreverunstopable, Mar 7, 2008.

  1. Foreverunstopable

    Foreverunstopable Private E-2

    Again my computer has trojans. I opened an emailed .rar from a friend. It loaded something to quick to catch what it was then the file vanished. Red flag. My computer then said updating, started to shut itself down and I pulled the plug, restarted in safe mode and there was a file like 1535.exe something running in the background. my internet browsers would not run. I ran combo fix in safe mode and it found mrofinu1535.exe I then rebooted in normal and was able to access the internet and followed the instructions exactly. Attached are two log.txt log2.txt log is the first time I ran combo in safe mode as an admin log2 is normal mode under my login.
     

    Attached Files:

  2. Foreverunstopable

    Foreverunstopable Private E-2

    mglogs.zip
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Uninstall the below old Sun Java versions as requested in step 1 of the READ ME:
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

    After clicking Fix, exit HJT.

    Now reboot your PC.
    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  4. Foreverunstopable

    Foreverunstopable Private E-2

    Things seem smoother. For some reason I had no internet access but its back up and running. I had to preform the install of Sun Java after running get logs. Attached are the files. Do you see any processes that aren't necessary for my computer to run that I can get rid of? Thank you for your help!

    I'm getting ComboFix.txt:
    You have already attached this file in thread : Malware, Trojans

    I have tried to re-name it but still it wont attach.
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Everyone has different needs. What I would need and use would probably be quite different than what you need and use. Thus you need to decide this for yourself. You don't have any malware that needs removing and we have updated a few items for security purposes. Thus we have completed the goal of this forum.


    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN
      • Now type combofix /u in the runbox and click OK.
      • Note: The space between the X and the /U, it must be there.
    2. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    3. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    4. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    5. After doing the above, you should work thru the below link:
     
  6. Foreverunstopable

    Foreverunstopable Private E-2

    I'm not sure if its related but I now cant access yahoo email through firefox or IE. I can login to yahoo but when I try to access the mail.yahoo.com it never loads. How can I find out if its related to malware?
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It is not related to anything we did. All we did is get your Sun Java version updated and a few malware items were removed in your first ComboFix run.

    Are you sure you are not blocking anything in your firewall?

    Also maybe your cookies with automatic login info were deleted and you will need to provide login and password information.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds