Spware says there is a Trojan HELP!!!

Techwoman · Aug 20, 2015

Hi all I have windows 8.1 64 Bit Toshiba Satlite Laptop. The web browsers constantly freeze so I thought since I could not find anything wrong when running malware scans that I would do a factory reset. It did not fix the problem. So scratching my head as to what the heck is wrong with this thing. The Laptop is only a year old. Anyway I would try to go on Fb and it completely froze the whole computer. Then all of a sudden out of no where AVG says Trojan horse. So this is just all weird.

I could use your help to figure out what the heck is going on.

Info is attached.

Thanks so much.

Kestrel13! · Aug 20, 2015

Welcome to the Malware Removal forum.

Please read ALL of this message including the notes before doing anything.

Please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****

Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual update Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only RogueKiller and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run the rest of the READ & RUN ME FIRST instructions on the infected account.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

Techwoman · Aug 20, 2015

Here is what I got from Malwarebytes scan when I ran it on safe mode.

Kestrel13! · Aug 20, 2015

I need it in log form please, as per the instructions in the Read and Run me First. Thanks.

Techwoman · Aug 21, 2015

I need help. I am downloading these links to my Desktop however that is not what they are doing. I am using IE to download it does not show how to do that for IE. Now I do have Firefox however the video is old and the options are completely different. Can you show me how I can get the folders where they need to be. Thanks

Techwoman · Aug 21, 2015

I figured it out. Thanks

Techwoman · Aug 21, 2015

RogueKiller V10.10.1.0 [Aug 17 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : Steadygaze1 [Administrator]
Started from : C:\Users\Steadygaze1\Desktop\RogueKiller.exe
Mode : Scan -- Date : 08/21/2015 15:52:37

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 8 ¤¤¤
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-13374198-3692986321-2984287824-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-13374198-3692986321-2984287824-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://toshiba13.msn.com/?pc=TNJB -> Found
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MQ01ABF050 +++++
--- User ---
[MBR] a84dd93b5b19931ceaddbccc47850486
[BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1024 MB
1 - [MAN-MOUNT] Basic data partition | Offset (sectors): 2099200 | Size: 100 MB
2 - [MAN-MOUNT] Basic data partition | Offset (sectors): 2304000 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 2566144 | Size: 467163 MB
4 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 959315968 | Size: 8524 MB
User = LL1 ... OK
User = LL2 ... OK

Techwoman · Aug 21, 2015

Malwarebytes Anti-Malware
www.malwarebytes.org

Error, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Update, Bad md5 or size: akadomains, 11,
Error, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Update, Bad md5 or size: akaips, 11,
Update, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Manual, IP Database, 0.0.0.0, 2015.7.24.3,
Update, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Manual, Domain Database, 0.0.0.0, 2015.7.24.2,
Update, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Manual, Rootkit Database, 2015.6.2.1, 2015.8.16.1,
Update, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Manual, Remediation Database, 2015.5.13.1, 2015.8.18.1,
Update, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Manual, AKA IP Database, 0.0.0.0, 2015.8.6.1,
Update, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Manual, AKA Domain Database, 0.0.0.0, 2015.8.18.1,
Update, 8/20/2015 12:06 PM, SYSTEM, STEADYGAZE, Manual, Malware Database, 2015.6.3.3, 2015.8.20.5,
Update, 8/20/2015 12:10 PM, SYSTEM, STEADYGAZE, Manual, Failed, Unable to access update server,
Scan, 8/20/2015 12:38 PM, SYSTEM, STEADYGAZE, Manual, Start:8/20/2015 12:10 PM, Duration:24 min 31 sec, Threat Scan, Completed, 0 Malware Detections, 4 Non-Malware Detections,
Error, 8/20/2015 12:41 PM, SYSTEM, STEADYGAZE, Protection, IsLicensed, 13,
Protection, 8/20/2015 12:41 PM, SYSTEM, STEADYGAZE, Protection, Malware Protection, Stopping,
Protection, 8/20/2015 12:41 PM, SYSTEM, STEADYGAZE, Protection, Malware Protection, Stopped,

(end)

Techwoman · Aug 21, 2015

Code:

HitmanPro 3.7.9.242
www.hitmanpro.com

   Computer name . . . . : STEADYGAZE
   Windows . . . . . . . : 6.3.0.9600.X64/4
   User name . . . . . . : Steadygaze\Steadygaze1
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2015-08-21 16:13:29
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 5m 3s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 0

   Objects scanned . . . : 1,269,552
   Files scanned . . . . : 17,817
   Remnants scanned  . . : 241,707 files / 1,010,028 keys

Techwoman · Aug 21, 2015

Here is the Mgtool Logs Zip file. I hope we can get to the root of this. I completed them all.

Thanks

Techwoman · Aug 21, 2015

I am so Sorry I attached some of them wrong. I just noticed it. Argh I am seeing to many words after reading everything. lol :-o

If you want me to reattach them the right way let me know. :-o

Kestrel13! · Aug 22, 2015

You need to attach (not post inline) the correct log for Malware Bytes please... thanks

Techwoman · Aug 22, 2015

Please let me know if this is the right log. I could not get on earlier because the forum was shut down for whatever reason. Thanks for your patients.

Kestrel13! · Aug 23, 2015

Again, that is not the correct log. Please follow the instructions properly to get me the log that we request.

I have checked the other logs and am not actually seeing any problems. You'll have to attach a log from AVG next time it finds something or give me the exact file and file path of where it's being found.

Techwoman · Aug 23, 2015

Again I am so sorry. All the logs looked the same to me. HA HA! I am not very computer savvy. lol

Okay well I believe this is the correct log.

Kestrel13! · Aug 23, 2015

and I will then post the AVG log.
Click to expand...

OK post that and I'll take a look.

Techwoman · Aug 23, 2015

I am running a scan now I cannot seem to find the log from the other day. AI think CCleaner got rid of it when I ran the scan. Argh!!

Kestrel13! · Aug 23, 2015

No problem.

Techwoman · Aug 23, 2015

Ok I am trying to figure out how to get the report to you. It only found one thing.

Kestrel13! · Aug 23, 2015

Take a screenshot, but make sure the whole path is showing for example: C:\Program Files\78.exe

Or just write down the file path and the 'threat' it's finding.

Techwoman · Aug 23, 2015

Ok here is the problem I cannot seem to get the avg report to you. When I go to put it on desktop it wont attach to this fourm. I am trying to figure it out.

Techwoman · Aug 23, 2015

Okay here is the screen shot.

Techwoman · Aug 23, 2015

Question, " I am not sure if this has to do at all with Malware and I know we are doing one thing at a time but I am not able to download some updates for some reason could that be do to this issue??

Kestrel13! · Aug 23, 2015

Is incredimail something you use? You have it installed. It's just a false positive.

Techwoman · Aug 23, 2015

Yes my friend uses my Laptop and she likes that program. What do you mean it is a false positive???

Kestrel13! · Aug 23, 2015

A false positive is when a normal program has abilities that a virus checker thinks is 'virus like'.

Techwoman · Aug 23, 2015

Ohhhh K. lol

Kestrel13! · Aug 24, 2015

but I am not able to download some updates for some reason could that be do to this issue??
Click to expand...

You should post in the software forum about not being able to download updates.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Spware says there is a Trojan HELP!!!

Techwoman Specialist

Attached Files:

Capture.PNG

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Attached Files:

Capture.PNG

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Techwoman Specialist

Techwoman Specialist

Techwoman Specialist

Techwoman Specialist

Techwoman Specialist

Attached Files:

MGlogsR.zip

Techwoman Specialist

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Attached Files:

MBM. txt.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Attached Files:

MBM.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Techwoman Specialist

Attached Files:

Capture.PNG1.PNG

Techwoman Specialist

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Techwoman Specialist

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member