Unable to go online during certain hours. All antivirus scans freeze up.

Discussion in 'Malware Help (A Specialist Will Reply)' started by Beary, Apr 10, 2010.

  1. Beary

    Beary Private E-2

    A few weeks ago I was on PalTalk and a message window popped up from an unknown user. Along with that message window came a warning about my computer being infected. At that moment I lost all sound on my computer. I closed PalTalk and restarted my computer so that my sound would come back. I removed PalTalk from my computer. Since then I have been unable to connect to the internet M-F between 2am-7am. I have tried Kaspersky's online scan but it freezes up about 2% of the way through the scan. I tried using drweb-cureit in safe mode but it also freezes up while scanning. I have tried getting help from a site called Spyware info only to run into a dead end. I'm hoping the folks here will be more knowledgeable.

    When I opened Root Repeal I got an error message. "Error - invalid PE image found!"

    I went ahead and scanned anyway, it seemed to have worked.

    I would like to thank you in advance for your time and assistance. It is greatly appreciated.
     

    Attached Files:

    Beary, Apr 10, 2010
    #1
  2. Beary

    Beary Private E-2

    Here is the MGTools log.
     

    Attached Files:

    Beary, Apr 10, 2010
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing much in the way of malware, but let's do this anyway:


    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

File::
C:\WINDOWS\system32\flcss.exe

Folder::
C:\Documents and Settings\Muin\Local Settings\Application Data\CJWFKL
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Your biggest problem is a lack of RAM:
    Code:
    Total Physical Memory    256.00 MB    
Available Physical Memory    70.96 MB
    You need 4 times that amount at least.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Apr 11, 2010
    #3
  4. Beary

    Beary Private E-2

    I can't scroll down in the code box.

    This is all I can see.

    KILLALL::

    File::
    C:\WINDOWS\system32\flcss.exe

    Folder::
    C:\Documents and Settings\Muin\Local Settings\Application Data\CJWFKL
     
    Beary, Apr 12, 2010
    #4
  5. Beary

    Beary Private E-2

    I followed the instructions and scanned with what I could see in the code box. I'm not sure if there was more to the message or if I'm not seeing scroll bars for some reason?

    When ComboFix restarted my computer, my firewall prompted to allow or deny a program called "sed" from running. I don't know if that's part of ComboFix or not so I allowed it and disabled my firewall.

    My antivirus also started itself so I had to disable that as well. I felt like they may have stalled ComboFix because it was taking a long time to produce a log. I opened my taskmanager and saw tons of activity programs opening and closing rapidly, all of which had the extension cfxxe. Programs with names like PEV, dumphive and ERUNT. I don't know if those are part of ComboFix.

    I tried googling them and got a bunch of forum topics about undetectable viruses.
     
    Beary, Apr 12, 2010
    #5
  6. Beary

    Beary Private E-2

    In my last response the logs didn't post. I'm trying again.
     

    Attached Files:

    Beary, Apr 12, 2010
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing any malware in your logs. What issues are you still having?
     
    TimW, Apr 13, 2010
    #7
  8. Beary

    Beary Private E-2

    Every weekday I can't connect to the internet with my desktop between 2 and 7 am, but my laptop connects just fine. Also when I try to view some picture pages like on facebook or other sites, sometimes I get a huge list of code at the top of the page. I can't get kaspersky online scan to run without freezing up and dr.webcureit also grinds down to almost a halt when it gets to the system32 drivers, scanning only 1 or 2 files every 15 minutes.

    Maybe it's a software problem? I dunno, should I post on the software forum?
     
    Beary, Apr 13, 2010
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds