Mustafx

0




We have been infected by a nasty lil bugger.

It creates 6 files every time we reboot ..

C:\windows\mustafx.exe
C:\windows\mustafx2.exe
C:\windows\murka.dat


C:\windows\system32\mustafx.exe
C:\windows\system32\mustafx2.exe
C:\windows\system32\murka.dat

We have tried to run HyjackThis but it is terminated every time we start it.

any suggestions on what to do now would be great..

 

Hi Ferretz!
Welcome to Major Geeks!

Try not to boot too often. I would like for you to do the following two steps to begin with so we can get a set of logs to look at.

• Download and install CCleaner
  • Now run Ccleaner with the default options (that means don’t change anything) to clean out temporary files.
  • Only use the default settings on the Windows Tab and select Run Cleaner. Do not run any other options from other tabs.
  • Also it is highly recommended to login to all other User Accounts on the PC including the Administrator account (on Win2K,XP and Vista) which will only show when you boot in safe mode.
    • Run CCleaner on each account. This can greatly reduce scan time and log sizes from the later scanning you will do below.
    • If you don’t see Ccleaner’s link when logging into the other accounts, just goto the C:\Program Files\Ccleaner folder and double click on the ccleaner.exe file to run it. You can also create a shortcut to the file on the Desktop of your other user accounts to make it easier to run in the future.

After you finish the above, please go to the READ & RUN ME FIRST and scroll down to the bottom of the page. You'll see a link for instructions for your operating system. Click on the one that applies and on the next page, look for the MGTools.exe link and instructions. When you download this, it will create a set of logs which you can find directly under C:\ (or the directory where your operating system is located) called MGlogs.zip

Please attach this set of logs in your next post and then go back to the beginning of the READ & RUN ME FIRST and follow all the instructions with the exception of those two you've already completed.

Thanks.
abri