Numerous trojans & malware

Furrag · Aug 11, 2009

For the past decade, I've Googled problems and read threads on forums such as this to remove Malware. The current problem, I can't shake off, and as a result, have been forced to sign up and call on you unsung heroes for help!

My computer has malware. I think my problem started when I tried running a non-secure video in windows media player which had to 'download a codec'.

Now not only is the computer sluggish, and the internet cuts out randomly forcing me into a restart, I hear a stream from what sounds like a channel running the background occasionally. I also find b.exe in the background, as well as my temporary folders full of nasties (a.exe, b.exe, c.exe etc). There are also far more than normal svchost.exe processes running.

I have read the 'Read & Run me first' post. Attached are my logs:

Furrag · Aug 11, 2009

Here are the remaining two logs:

TimW · Aug 14, 2009

We have a few things to do>
Please use add/remove programs to uninstall:
Java(TM) SE Runtime Environment 6 Update 1

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
Code:
KILLALL::

Driver::
nenum13E

File::
c:\documents and settings\Gareth Thomas\Local Settings\Temp\nenum13E.sys 
C:\1951046703
C:\RECYCLER\S-1-5-21-2633166748-9710051672-061147426-6282\msimfo32.exe
C:\Documents and Settings\Gareth Thomas\Local Settings\Temp\1c5a1600.tmp  
C:\Documents and Settings\Gareth Thomas\Local Settings\Temp\a.dat       
C:\Documents and Settings\Gareth Thomas\Local Settings\Temp\esdf6th3e42.tmp
c:\windows\Hxopubucamotigih.dat
c:\windows\eyaweriq.dll
c:\windows\dr6vrjhgf.ini

Folder::
c:\documents and settings\All Users\Application Data\Viewpoint
* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

Numerous trojans & malware

Furrag Private E-2

Attached Files:

SASlog.txt

MBAM.txt

RRlog.txt

Furrag Private E-2

Attached Files:

MGlogs.zip

Combofix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member