!please help!

kenny306 · Dec 17, 2008

hi there,

i have only recently become a member, and im having some srious problems,

the problem has only occoured over the last 3 days(15th - 18th), first i noticed that my search engine within my browser had become YOOG, this was not a major problem but i use firefox and to be honest im lazy and i dont type www. :-o this became a problem this search engine isnt helpfull it seems to only produce adverts and porn. within 24 hours of this my machine was slow had endless pop ups, fake alerts, and 5 second freeze's.

Before going threw your malware removal procedure and getting the logs requested and attached i only had Zone Alarm security suit as protection, didnt know if this is any use to, i also have a a 12 year old brother and 8 year old sister one visits free flash game webisites and the other i dont even want to think about it.. hes 12 and i had to look threw cookies lol, they have both been banned from using the machine and i belive this is the cause of the problem. but the damage is far beyond repair and my pc skills.

also after super spyware scan the machine asked to reboot as instructed i did but it blue screen'd twice at the win xp loading stage also didnt know if this was any help.

get in touch kenny

chaslang · Dec 19, 2008

Welcome to Major Geeks!

When you ran MGtools.exe, did you forget to accept the Trend Micro HijackThis license agreement as requested in the READ & RUN ME. You have to click OK twice. It did not produce a log and we need to see it. So please to the below.

Did you know that when you ran MGtools, it shows that 113 connections to/from your PC were in use? Are you using P2P or torrent downloading programs and if so, why are they always running? They are dangerous and they slow your connection down tremendously due to opening all these connections so that people all of the world can connected to your PC and bypass your firewall protection.

Downloading things like below are major sources of infections!!!!!!
C:\DOCUMENTS AND SETTINGS\KENNY\MY DOCUMENTS\DOWNLOADS\FAR CRY 2 (NO-CD) CRACK + SERIAL [PC] CRACK KEYGEN\CRACK.EXE

If you are not using P2P or torrent downloaders then the malware you have is opening all these connections.

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Now we need to use ComboFix.

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Open Notepad and copy/paste the text in the below quote box into it:

KILLALL::

File::
c:\windows\ykgee3362.exe
c:\windows\pn8.exe
c:\windows\c20232.exe
c:\windows\system32\cont_adsoftinc-remove.exe
c:\windows\wuan364443.exe
c:\windows\hw5305.exe
c:\windows\gu58826.exe
c:\windows\gbg033414.exe
c:\windows\feoc827.exe
c:\windows\o255.exe
c:\windows\vtj708346.exe
C:\WINDOWS\SET3.tmp
C:\WINDOWS\SET4.tmp
C:\WINDOWS\SET8.tmp
Click to expand...

Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). If the Trend Micro HijackThis license agreement pops up, make sure you click it twice to accept it.

Then attach the below logs:

C:\ComboFix.txt

[COLOR

Log in or Sign up

!please help!

kenny306 Private E-2

Attached Files:

logs.zip

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member