Trojan Problems

Welcome to Major Geeks!

No this is not using 99% of your CPU. This is a measure of how much free time (idle time) your CPU has. It is not a real process.

You don't really show any malware problems. I just have a few non-malware and cleanup things for you to do.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O24 - Desktop Component AutorunsDisabled: (no name) - (no file)

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below log:

• C:\MGlogs.zip

Are you still really having any malware problems? Is anything being detected? If so, provide a log that shows what and where.

 

You're welcome.

Your logs are fine now.


If you are not having any other malware problems, it is time to do our final steps:

1. You can uninstall SUPERAntiSpyware now.
2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\cf" /u
     • Notes: The space between the cf" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\cf folder from combofix.
4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Go to add/remove programs and uninstall HijackThis.
7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
8. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

Try renaming the ComboFix.exe file on your desktop to combo-fix.exe Then use the below command to uninstall it from the Run box.

"%userprofile%\Desktop\combo-fix" /u

 

If the C:\QooBox folder and the C:\ComboFix.txt file are gone, then it self uninstalled. If they are not gone, you can just manually delete them.

 

Yes if that folder and that file were also deleted and if you have completed the rest of the final instructions.

You're welcome. Surf safely!

 

There are other shells that you can use, but I'm not a big supporter of doing that as sooner or later you will run into some issue that something does not work properly due to using a different shell. I don't see going to this extreme to be necessary for security. It would be something where the functionality of the shell was needed where I could see another shell being used. Following the steps in the How to protect yourself from malware thread are quite adequate to protect you. Most malware problems orginate due to the end user doing things they should not be doing. So using that old phrase "the user can be their own worst enemy".