Trojan's keep showing up each morning

Hi there...I haven't had to use you guys for a long time and hopefully it will be as quick and efficient as last time! I have not had any super noticable computer issues which is what's so weird about these Trojan's...I followed all of the prelim stuff last night and I thought my computer was clean and then this morning AVG 8.0 seems to tell me there is still stuff it found...so I'm wondering if something is replicating itself hidden in the registry or something.

Anyway, AVG 7.5 (which I was running until yesterday when I upgraded) found a trojan pop up on jan 4 and then another later that day and so on and it's been going on since then. No internet issues, no popups, but when I tried to log on to the chase.com website I was directed to a page with chase's logo (the exact address was deleted from my internet history with the malware cleanups but it was something like https://mfasa.chase.com/auth/login/fcc or something of that nature) asking for name, account, social security info which IS normal when chase doesn't recognize the computer...the only problem is it was also asking for bank account routing number, PIN #, etc and I DON'T have any of that with chase, only a credit card...so it made me suspicious and along with the Trojan's I wondered if that was going on...so I called Chase and they told me that's part of their website but part not and they showed no record of my even TRYING to log on to their site so he said it HAS to be a virus...now, I was able to log into some other credit card sites (amex being one of them) and had no trouble. So, I changed my user and passwords, etc. and after the cleanup was able to log into the site after bypassing that presumably "fake" info by entering a bunch of bunk numbers, etc.

So, at this point, I'm not sure what to think...I know when AVG 8.0 is pulling up trojans, that's not good period but I have not seen anything other than that one thing with chase's website (which obviously could be a big deal in and of itself).

I am attaching the info logs that you requested from the original malware removal process as well my avg scan from this morning (I hope it posts...it's in excel). Actually I will have to upload the last two files into the next post because I see 3 is the max.

Please let me know what to do!

Thanks!

Shawn

 

here's the last two logs...one is the avg 8.0 log from this AM.

 

http://www.majorgeeks.com/images/grenade.gifWelcome! to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif


Pre-Instructions:

1. First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.
   
2. Print out these instructions or save them to a text file so that you can operate with All Browser Windows CLOSED.

Step 1:

Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

Again, make sure ALL browser windows are closed when you click FIX.​

Step 3:

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.​

Step 4:

Default Security Settings

To Default Security Settings:
For Internet Explorer 6 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up navigate to the Security Tab and click Default Level for the following:

• Internet
• Local Intranet
• Trusted Sites
• Restricted Sites.

Click OK to exit.

For Internet Explorer 7 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up, navigate to the Security Tab and simply click the "Reset all zones to default level" button. Click OK to exit.

NOTE: If it's "grey" then it's already at the default level.​

Step 5:

Please download ATF-Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF-Cleaner menu to close the program.​

Step 6:

Finally, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

​

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.