Multiple Malware problems

Discussion in 'Malware Help (A Specialist Will Reply)' started by Traveler37, Mar 12, 2015.

  1. Traveler37

    Traveler37 Private E-2

    Hi,

    Upon switching on my laptop on Monday morning it started to operate very slowly. The CPU usage was extremely high and the physical memory was almost completely used up. The laptop had been working fine when I powered down previously.

    Hitman Pro advised me that it had found a Trojan. I ran my antivirus (Sophos) and Malwarebytes, which found and quarantined several items. My laptop returned to a usable speed.

    However, Malwarebytes flashed up every couple of seconds telling me a malicious website had been blocked - from memory: c/program files/syswow64.dll

    I ran Malware bytes, hitman pro and Sophos again but none of them could find the problem. Interestingly, the next day Malwarebytes continued to block outgoing websites but the address listed is now c/program files (x86)/internet explore/ iexplore.exe - I have no reason to believe the syswow64.dll problem was fixed.

    The only effects I'm currently seeing are that I often get directed to adds when I try to visit a website.

    I've gone through all of the steps from the READ ME section and have attached the logs - with the exception of Malwarebytes, which didn't find anything and didn't give me the option to export (v.2.00.4.1028)

    Thanks in advance for any assistance.
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Rerun Hitman and have it fix everything except:
    C:\Users\g.lawrence\Downloads\FRST64.exe

    Download OTM by Old Timer and save it to your Desktop.




    Code:
    :Processes
    explorer.exe
    
    :files
    C:\Users\g.lawrence\AppData\Local\Temp\*.*
    C:\TEMP\*.*
    
    :reg
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Agrworks"=-
    "Afdworks"=-
    
    :Commands
    [purity]
    [emptytemp]
    [start explorer]
    [Reboot]

    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.


    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.

    Reboot and rescan with Hitman and attach the new log. Tell me how things are running.
     
  3. Traveler37

    Traveler37 Private E-2

    Hi Tim,

    OTM required me to reboot my laptop. Once that pop-up box appeared, I couldn't copy and paste the results.

    However, I've attached the logs for OTM and Hitman Pro, which no longer can detect any problems. Additionally, Malwarebytes is no longer giving me the 'blocked website' messages.

    Thanks for your help.
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let me know what issues remain or if you are ready for final clean up instructions.
     
  5. Traveler37

    Traveler37 Private E-2

    I haven't had any issues this morning since following the instructions you gave. As such, I believe I'm ready for final clean up instructions.

    Thanks
     
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
  7. Traveler37

    Traveler37 Private E-2

    I've done all of that and am back up and fully operational. Thanks for your assistance - I appreciate it.
     
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. ;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds